[gael-obin]

Reopening saved work must verify the retained source-operation result against its original invocation and current access, without silently invoking the provider again or replacing it with newer facts. This adds that public Accounts verification path, including proto/Go/TypeScript/catalog exports, SDK support and signed-ingress integration tests.

Classification: fix at the host's source-operation and authority owner. Consumers retain the exact receipt reference and use the owner verification operation; they do not implement another receipt store or treat a cached result as authority.

This publishes the complete 43-file change from previously exercised commits 14504154 and 74c64aee, without copying task configuration or credentials. The local combined-host qualification also uses installation setup. An independent reconstruction applied that complete setup diff plus these receipt commits over the selected host baseline and matched all 59 touched paths to the exercised host.

Validation: retained owner signed-Postgres-ingress/receipt verification tests and composed saved-review reopening; publication independently checked exact source/artifact closure and private-repository secret scans. No fresh whole-host CI, production deployment or provider integration is claimed here.

Pre-merge owner reconciliation: the invocation declaration fencing proposed in the original fencing PR is already integrated through the accepted owner implementation, merged as 35a8aca1dfd1b881d55cc17eb92c253fdfd8ec27 and an ancestor of current main. Independent current-source review verified the business invocation implementation/tests are identical to that fencing candidate, and this receipt change preserves them and the SDK fencing regression. The original open PR is therefore not an unresolved merge dependency. All 22 applicable hosted checks now pass (four other checks skipped). Owner merge-queue review is requested; compatible SDK/server release adoption and combined consumer qualification remain separate requirements.

Code and CI corrections — 3 November 2026

Fixed both original CI causes. The proto now truthfully declares the existing source-scope refusal event as FAILURE auditing; successful retained reads still emit no new invocation and never redispatch. RPC/helper names and wire shape are unchanged. Regenerated the complete contracts, policy catalogs and affected SDKs through owner tooling, including stale source-read provenance. New regression fails before and passes after. Authorization checks, source-operation Go race tests/vet, 108 SDK tests/build, source-read test/vet, naming/boundary/contract checks pass. A complete repeated generation leaves all 3,967 tracked files unchanged. Existing packed SDK artifacts remain historical compatible clients; no package release or live artifact substitution was performed.

Exact revised head: 8c4d97dfb7d4a2e67eeb1331315ded411e661a22. Fixes are pushed for fresh CI. Passing local checks do not certify the entire product or a release; existing dependency and qualification limits above remain. No gate was weakened.

Independent focused architecture and code reviews found no new blocker in these corrections. A documentation-only follow-up replaces the stale SDK generator version statement with a link to the maintained CI installer; implementation bytes remain those reviewed at 46471a65f9260f074e00990d634c6252c060b9ab.