[itlezy]

Two daemon/offline writers can no longer independently open the same physical profile. Acquire an exclusive OS-backed lease before bootstrap/metadata work, retain it through cloned metadata handles, and release it when the owning process or final handle exits. Derived profile I/O stays bound to the acquired physical directory so an alias retarget cannot move writes outside that lease. Supplied configuration/display paths, bootstrap keys and explicit incoming/WebUI overrides keep their contracts.

Deterministic regressions cover process death and clean release, metadata-handle lifetime, concurrent fresh-profile creation, independent profiles, Windows junction aliases and denied-open bootstrap/database/WAL/SHM preservation. The existing scoped daemon package passed 90 unit tests, 8 hosted-lifecycle tests and 4 real OS ownership tests at the preserved pre-CI035 source faf9b247; the child-only test is intentionally invoked by those parent tests. The seven lease patches restacked unchanged onto #314.

Actual native Windows x64 package proof passed at the preserved pre-main-rebase source 0355d35 with merged Builder 90edab4e, Harness e3c4dafa and Tooling 3b045ab4. All three offline profile commands returned the specific profile-busy failure against the running packaged daemon; bootstrap/settings/roots stayed unchanged, and offline reconciliation succeeded after shutdown. The existing same-profile/same-binary partial restart preserved verified progress and settings, resumed and delivered the neutral 12 MiB payload with its expected SHA256, with 3 graceful shutdowns. All 9 operator runtime files retained identical hashes and sizes; validation used disposable local-only profiles. The ZIP SHA256 is 0e0785ce3c59417f6eeab89b95ba6560985a31f8f93b55221b9e5fbe0d70dd69. These are local-development artifacts and Windows evidence, not Linux proof or published-release provenance. The parent subsequently rebased the unchanged content onto actual merged main 08bfe94; that historical runtime receipt is not relabeled as execution on the new commit. Current-head hosted qualification is running separately.

Exact-source hosted Windows/Linux gates and analysis remain required before merge. Based on #314; merge after AICH #315 and atomic settings #316, then refresh against actual main and rerun applicable checks. No shared workflow-pin changes, profile migration, soak or Beta3 publication are included. AICH's separate schema 67→68 prerequisite retains the entirely-fresh-profile beta policy.

Hosted Ubuntu ARM64 Clippy identified redundant error unwrapping in the isolated race fixture before runtime tests. The follow-up uses a borrowed Err pattern and preserves the same busy-message assertion, readiness barrier and return. Production code is unchanged; normal formatting/commit/push checks passed and fresh hosted qualification is required on the corrected head.

Fixes #247 (RUST-BUG-163). Parent-coordinated consolidation uses isolated registered workstreams: #314 owns the workflow graph, #315 owns AICH trust, #316 owns atomic settings, and this lane owns daemon/profile leases. The parent owns source refreshes, reservations and merges; merge order is #314→#315→#316→profile ownership. All active human PRs carry parallel-approved, and no required check is waived. The parent records this additional coordinated lane on the existing PRs.