[jrcruciani]

What changed

I made aether-arm pin /run/current-system before activation. Recovery validates that store path, sets the system profile to it and activates it directly, without rebuilding or evaluating a flake. A missing or invalid pin warns and uses the current boot-default profile; it never steps back a generation. A failed profile update is reported but does not prevent a recovery activation attempt, and the service still reports failure rather than hiding the boot-default problem.

Disarm removes the pin, status shows it with time remaining, and arm/disarm share a root-owned lock so a competing arm cannot overwrite or remove a live timer's recovery target. Every helper's external commands are supplied by its runtime inputs. The README, playbook, prompt, option docs and changelog match the behavior.

This fixes nixos-rebuild test leaving the profile at known-good N while the old nix-env --rollback selected N-1.

Actual VM evidence

Final-head Linux VM run 35610510052 passed on 396b46376d81d5986e2bdee44903d8f9fe8029fa: job 2m0s, test script 86.32s. An earlier locked run also passed and is recorded in the changelog.

• Seed a different prebuilt system at N-1, then make the running base the system profile. Arm on the base, test-activate a prebuilt specialisation that stops sshd, and let the real timer fire. Assert /run/current-system and /nix/var/nix/profiles/system both resolve to the base and sshd listens on port 22 again.
• Repeat after deleting /run/aether/rollback-target; assert the same recovery and the explicit boot-default fallback warning in the journal.
• Run two concurrent arms; assert exactly one succeeds and its pin survives. Check status reports pin/time left and disarm removes the pin.

No rebuild runs inside the VM. Actions and the NixOS 26.05 test-only nixpkgs input are pinned, and flake.lock was generated by Nix on Linux and committed. nix flake check --no-update-lock-file --print-build-logs runs the check. The importing host still supplies the module's pkgs.

The first two runs exposed harness issues (GRUB installation on the direct-boot VM's unpartitioned disk, and the test shell exiting before recording an expected failed arm). Both were corrected before the passing runs. This is not live-host or bootloader coverage; Nix is absent locally on macOS.

Scope and coordination

Item 01 only, plus its prerequisite VM harness and tightly coupled pin-ownership lock. The broader scenario matrix remains item 04; general root/timespan/active-disarm hardening remains item 08. Item 02 was merged from origin/main without rewriting history; its R3 commit/failure order and both changelog sections are preserved. LICENSE is untouched.

Ready for the parent's coordinated merge: final-head CI passed, GitHub reports MERGEABLE/CLEAN, and the worktree is clean. No known blocking concerns remain for item 01. No merge has been performed by this session.