[jrcruciani]

What changed

• Added ADR 0003 before implementation, then exported nixosModules.deadman while preserving the full aether and default bundle.
• Kept the timer helper bodies in one module. Private composition includes Python transaction cancellation, recovery completion, token revocation and status only in the full bundle; standalone needs no agent/host configuration or policy state.
• Added the high-up human-only timer walkthrough and a standalone link target. Successful arming gates a scoped test; fresh SSH precedes manual disarm, which never grants apply confirmation.
• Extended the existing deadman VM check with an actual standalone node, closed-PATH helpers, configured-timeout recovery, absent agent state, full-bundle hook-failure recovery and package/export assertions. Existing full-bundle scenarios remain; the restricted apply fixture imports the aggregator with its exact fixture/preload layout unchanged.
• Merged item06 mode documentation without rewriting history or changing its scope.

Actual Linux evidence

Run 35639932541 passed at code SHA aa1f5bf299ce5235be670791b0c300a06cd1589d:

• All 11 deadman VM subtests, including actual standalone recovery of running path/profile/SSH, no policy state, full-bundle recovery despite failing state hooks, and the existing eight regression scenarios.
• All 17 policy tests and 13 actual restricted-account apply VM scenarios, including cancellation of a blocked activation independently of apply.lock, confirmation/token lifecycle, profile failure and reboot recovery.
• Both actual host-pinned options builds: 22,116 options at 25.05 and 23,290 at 25.11, including closed-PATH/helper failures preserving the old index.

Final SHA f52eb4e517ffd200f0ad91c276771076f478fd4e only appends the changelog evidence; its code tree is unchanged from the successful run. No live-host timer test and no local Nix evaluation. Superseded run 35639387864 was cancelled, not counted as passing evidence.

Scope

Only item07. Item08 timer edge hardening remains separate. No merge; parent coordinates integration.