[gmemmy]

Problem

A repeated or delayed profile-session stop could append another terminal event and rewrite authoritative storage after a run had already stopped. A stale stop could also race with a newer active run unless the caller and storage transition were bound to the same scenario and run identity.

What changed

• Serialize authoritative stop transitions and return explicit stopped, already-stopped, or rejected outcomes.
• Make repeated and delayed same-run stops byte-identical no-ops.
• Reject missing, mismatched, ambiguous, or stale stop authority without mutating storage.
• Require scenario and runId on stop deep links while preserving argument-free in-process stopProfileSession() calls.
• Advance the app-helper payload identity to 1.2.0 and update package fixtures, declarations, and public contract text.

Why this approach

The durable authority manifest remains the source of truth. Stop decisions are serialized with the existing storage operation chain, so concurrent calls cannot each publish a terminal transition. The public helper keeps its existing no-argument path while allowing identity-bound callers to fail closed.

Proof

• pnpm typecheck - passed.
• Focused profile/storage/runner suites - 159/159 passed.
• Full repository suite in the exact final release check - 1,851/1,851 passed.
• pnpm package:smoke - passed, including packed installation and public declaration checks.
• pnpm release:check - passed, including package smoke and installed-consumer rehearsal.
• Independent final-diff review and documentation remediation re-review - clean, no P0-P3 findings.
• git diff --check - passed.

Risks and limits

• This proves package and synthetic lifecycle behavior, not downstream runtime acceptance.
• A default parallel full-suite attempt encountered shared Android lease contention. The affected live-Android file passed 4/4 in isolation, and the exact final release check passed with an isolated lease namespace.
• This PR does not change package version, publish artifacts, or broaden platform evidence claims.

Stack/review order

• Base: fix: make promoted evidence packages portable #342 portable promoted-evidence packages.
• This PR follows fix: make promoted evidence packages portable #342 and should be reviewed and merged after it.
• The single-platform CI evidence-scope correction will stack separately after this PR.

Follow-ups

• Add explicit single-platform evidence-pack scope without weakening dual-platform claims.
• Re-run installed-candidate lifecycle confirmation in downstream runtime lanes under separate authority.