Restrict opaque-hash evidence to fully validated rustc verbose banners while rejecting commit hashes in every other field. Capture published-file device and inode ownership before rename and carry it through post-rename and parent-fsync failures so cleanup removes only the transaction-owned proof. Derive proof, artifact, image, and tool lookups from typed specifications where possible, with consistency invariants for serialized contracts that remain external to Rust types.