Add a serialized, cooldown-bounded single-attempt re-register reachable from listing, segment upload, and event relay 401s over the shared Arc<Inner>. Persist replacement identity before swapping Inner, and publish a recovery generation so try_probe skips the open breaker's remaining cooldown exactly once. Fix AC 17 rather than recording a residual: save_config now preserves key and stream from disk by default, while narrow save_identity is the only identity writer. A stale whole-struct write from solstone settings therefore cannot clobber a recovered key, and future non-identity writers are safe by omission. Deliberately change registration_403_latches_revoked to registration_403_does_not_latch_revoked because local_request_only is a register-route guard, not evidence of revocation; ingest, listing, and event 403s still latch. Preserve ensure_registered_skips_when_key_present with only its constructor adaptation. Keep revoked fully short-circuiting so a 403-latched observer attempts no recovery on any path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>