[callumalpass]

Summary

Implement resumable Private ↔ Cloud copy switching with native proofs, whole-switch-set trust, a capability floor/token drain, explicit owner handover, receiver-only reading and shared inline controls.

Execution defaults off. LAB builds explicitly opt in; server startup advertises execution only after both normal-role Workers expose their authenticated readiness and retirement handlers. Deploy mode-capable Workers before enabling the server.

Recovery and safety

• Preserve exact request/publication identities, immutable signed genesis and authenticated history. No new trust exception or token/log format.
• Require support from every active keyed user device before Private publication; gate current token mint support and drain existing token lifetimes.
• Keep source consent separate from receiver reading. An applied return to Private clears the receiver witness, including on ineligible receivers.
• Let the existing policy producer release adjacency from observed log position without depending on owner finish. Provide owner abandonment of an unrekeyed published Private request without replacing its publication or creating an epoch; held mutations return typed conflicts.
• Preserve unrelated integrity faults alongside mode alerts. Failed optional persistent-keyring history repair restores existing keys and authority; mandatory RAM-only rebuild remains strict.
• Retain migration state during service-cache retirement. Readiness is not app admission or a physical-erasure claim.
• Add recovery metadata through a new migration; applied SQL is unchanged.

Validation

• Rust libraries: replica 1,022, daemon 455, hosted 217 passed; all-targets clippy with -D warnings and formatting passed.
• Server suite: 2,273 passed; final targeted release-gate/proof/configuration checks also passed.
• Six isolated PostgreSQL suites: 149 passed, 1 skipped, including missing-finish hold release, typed conflicts, owner abandonment and exact-request restart recovery.
• Management tests; server/management/shared-UI typechecks; generated inventories; 18 deployment-guard tests; architecture/changelog/diff checks passed.
• Prior managed LAB qualification completed the older-device blocker and both directions, including uninterrupted online Private exchange, Cloud return and separate cold receiver replay. These review fixes target failure/recovery paths rather than that successful handover; LAB was not redeployed for this revision.

No production/staging deployment, merge or release is included. New-head CI runs after push.