[jrcruciani]

Scope

Implements only item 08 of the Aether improvement plan. No live-host timer testing, rollback rebuilds, or raw agent activation bypasses.

• Reject non-root aether-arm with an explicit root/sudo message and parse systemd time spans before state or unit creation; preserve existing pin/timer on invalid input.
• Refuse disarm before timer stop/token revocation when rollback is active, transitioning, queued, or marked as recovering. Keep the post-stop recovery check; never stop the rollback service and do not claim atomic race exclusion.
• Make sudo aether-status / ARMED stop-and-tell-human preflight explicit; align current proposal paths, correct README typos, and require VM or field evidence for module changes.
• Add nine disposable-VM subtests for early rejection, closed-PATH valid spans, and real held recovery lifecycle states with unchanged timer/pin/token state and verified activation completion.

Merged origin/main at 74a6182a557a9ba0eb31e4daed2ac473c22bb413 without rebasing. Preserved item 06 execution-mode documentation and item 07 standalone/full-bundle exports, optional Python hooks, and standalone/hook-failure VM coverage. No module-composition changes relative to main. Recovery markers/token hooks remain full-bundle-only.

Actual validation evidence

Combined Linux run 35643134551 is fully green at tested code SHA 3fb73928a78b16bc2c558a630957527711895ed1:

• All 20 deadman VM scenarios, including all nine new item08 edge cases, existing recovery/70-second-disarm/concurrent-arm cases, and item07 standalone/failing-hook coverage.
• All 13 actual restricted-account apply VM scenarios, including human confirmation/disarm, arm/disarm failures, blocked activation recovery, and actual reboot.
• All 17 policy tests.
• Both real host-pinned options-index builds: 22,116 options at 25.05 and 23,290 at 25.11.

The VM checks use locked NixOS 26.05 disposable direct-boot guests; the index checks use their own two host pins. This is not bootloader or live-host timer evidence. Local policy tests, VM-driver syntax and diff whitespace checks also passed.

Final SHA 0065e4f702daa8b0e00192c2e546e3df4e881e16 differs from the tested code SHA only by the appended 14-line item08 evidence paragraph in docs/CHANGELOG.md. An automatically triggered duplicate run for that documentation-only commit is not required for this handoff. Ready for review; not merged by the implementation session.