[itlezy]

A peer-proposed AICH master no longer becomes trusted merely because its hashset is internally consistent. Persist accepted authority separately, require independent corroboration or explicit operator/local authority, and fence pending hashset answers and background publication by the current transfer/authority generation. Caller cancellation cannot abandon an admitted trust decision.

Regressions cover corroboration, conflicting proposals, deletion and same-master authority, publication races and a bounded loopback TCP late-answer case across an A→B→A authority change with a current-generation positive control. These are targeted causality tests, not a complete interoperability/parity claim.

Schema 67→68 requires an entirely fresh profile under the accepted beta policy. There is no migration or partial reset; retain the old profile separately for rollback. Validation uses disposable profiles and must not open an operator profile.

Validation: native managed metadata (95 tests), ED2K (1294 tests), and core (473 unit tests plus package integrations) passed at the preserved pre-CI035 source 388e4d01. The eleven AICH patches were restacked unchanged onto the #314 workflow candidate; normal hooks run on the final head. Current exact-head hosted Windows/Linux and analysis gates remain required before merge; the older interrupted full local run is not a pass.

Fixes #248 (RUST-BUG-164). Depends on #314; merge #314 first, then this PR, then atomic settings #299. The parent refreshes dependent branches against actual preceding merges and requires fresh applicable checks.

Parent-coordinated consolidation: #314 owns the CI graph and merged Builder selection. AICH trust #248 and atomic settings #299 are independently owned reliability work, with atomic settings explicitly stacked after AICH. They are being qualified in isolated registered checkouts in parallel using the exact #314 workflow candidate. Merge order is #314, then AICH, then atomic settings; each dependent branch will be refreshed against the actual preceding merge and applicable checks rerun before merge. The parent owns ref updates, conflict review and merges. File ownership and dependencies are recorded; no required CI/CodeQL gate is waived. This is the coordinated use of the parallel-approved policy, not an unrelated PR exception.

[itlezy]

The parent is also qualifying the existing profile-ownership lane (#247) in parallel. Its seven Rust commits own daemon/profile/metadata lease lifetimes and are separate from CI graph changes, AICH trust and atomic settings. Actual Windows packaged-daemon proof passed: all three offline writer commands specifically rejected the busy profile without settings/root/bootstrap mutation; clean shutdown released ownership, durable partial progress survived restart, and the 12 MiB transfer completed with the expected hash. Its current workflow base is the same #314 candidate; merge order remains #314, AICH #315, atomic settings #316, then parent-reviewed independent lanes. The parent will refresh exact branches and require applicable checks before each merge. No required status or author policy is waived; all affected human PRs carry the coordinated parallel-approved label.