Add a single private module owning bounded pair-link input, native pair_from_link pairing, durable owner-only S/PL credential and observer-registration state, a setup/runtime exclusion lock, synchronous relay-token refresh persistence, and an embedded spl_transport::journal_bridge session with a mutable trusted carrier opener and a capability-gated, origin-confined loopback client. Pin spl-core and spl-transport to git revision 742bc9dc789c5a75658844849a04d75033aeb6e3. Allow exactly that git source in deny.toml while unknown-git, unknown-registry, and wildcards remain deny. No production call site changes: the module is reachable from tests only. The cli.rs and upload.rs edits add tests only and touch zero production lines. The pinned TransportClient makes a refreshed token live before invoking the persistence hook, so a concurrent in-flight request can observe it before the durable write completes. Closing that gap requires an upstream change.