[aruintelligence]

What changed

• Add an optional host-owned claimOnce hook after the durable local grant claim and before the provider callback. A grant with a host operation ID uses the stable operation hash as its external claim key; a direct grant uses its idempotency key. Only an exact true from a committed atomic claim proceeds.
• Hold the local authority lock across async claims, then recheck directory identity, operation marker, clock, expiry, and issuer epoch before invoking the callback. Duplicate, uncertain, or expired claims invoke no callback and leave the local grant spent.
• Integrate the new host operation marker from Claim each prepared-mail operation once across local workers #430. Demonstrate both same-grant replay and a newly minted grant for the same operation after local store rollback, plus outage, expiry, path replacement, marker loss, and revocation contention. Document the host contract and limits.

Verification

• npm test — 986 pass on the combined tree.
• node scripts/check-package-artifact.mjs — 42 checks, no failures.
• npm run check:links — pass.
• npm run compatibility:consumer — passed on the initial branch; hosted CI covers the combined tree.

Boundary

The hook protects a spent grant or host operation after local authority rollback only if the separate host claim store is atomic, durable, and unchanged, and the operation ID remains stable. It does not preserve revoked issuer epochs for unspent grants or prove provider acceptance. The included file anchor is a test fixture, not a production trust service.