Delete the post-rename rollback that non-atomically rewrote the target and could leave partial JSON after a directory-sync failure. Before rename the target is untouched; afterward it contains the new complete value, so restoration is never both necessary and safe. Directory-sync failures now require a complete old or new value instead of prior bytes. Make target validation, chmod, reads, rename, and directory sync authoritative through no-follow descriptors. Open the lock relative to an opened canonical-root descriptor and verify its kind and mode after fchmod so concurrent leaf swaps cannot defeat the contract. Have sessions hold the private-state lock for their lifetime, always install token persistence, and restore validated durable observer state into the real opener through persist-before-publish. Correct observer-rejection tests to apply loaded state to a real opener and pair-input tests to assert against the config root actually used. Narrow dead-code allowances to the six cutover roots, deleting or test-gating unreachable internals. Strengthen criterion 13 coverage for token precedence and exact multipart structure. No production call site changes. The cli.rs and upload.rs edits remain test-only and touch zero production lines.