[mblua]

Resolve configured create, root, restart and restore from the selected physical agents file and its current source-local profile cells. Missing or changed sources fail before launch or teardown and retain recoverable restore recipes. Replacements preserve binding UUID and origin.

Validate the opaque source seed before host preparation and admission, and stage restart metadata through the existing guarded lifecycle commit. Source-backed startup works on the first run while retaining staged creation/archive guards.

Validation on 1e780bb82b29efe4cca8052bb6793d791174e7e6: 165 named Rust tests and 9 layering-guard results passed; formatting, all-target check, strict Clippy and the evaluated cognitive-complexity classifier passed. Independent source and final execution reviews passed. Exact current-main PRE and integrated POST retain all 1,211 module pairs and complete cyclic SCC membership; regenerated arc records are byte-identical. Existing detector blind spots remain.

Part of #2432.

Closes #2899.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mblua]

Heads-up: the required checks on main changed (#3184, PR #3185).

The main ruleset now requires these checks instead of the old names:

• rust-regression is now rust-regression-windows
• windows-release-cli-smoke is now release-cli-smoke-windows
• new: issue-1850-release-windows, issue-1850-release-linux, issue-1850-release-macos and rust-slow-test-windows

This branch still runs the old workflow, so those checks never report here and the PR cannot merge as it is.

What to do when this PR is ready to land: wait until PR #3185 is merged, then bring this branch up to date with main (the ruleset already requires that). The new workflow comes with it and reports the new check names. Resolve any conflict in .github/workflows/pr-regression-gates.yml in favour of main.