refactor: unify terminal owned-resource release

CHANGELOG.md

@@ -9,6 +9,11 @@ Semantic Versioning after its first public release.
 
 ### Added
 
+- Shared terminal owned-resource finalization now routes historical and matrix
+  runs, benchmarks, and guarded execution through completion-before-release,
+  exactly-once admission release, and fail-closed release-error precedence.
+  Deterministic coverage includes watchdog, journal, and cache-pin ordering;
+  native guard-exec qualification remains separate and NOT_RUN.
 - Matrix v2 `doctor` and `dry-run` now inspect every declared runtime using
   lexically ordered, digest-labeled reports. Doctor performs one bounded
   runtime probe per entry; dry-run renders each explicit workspace and command

docs/ARCHITECTURE.md

@@ -87,6 +87,15 @@ executor, cache state, execution mode, target platform and optional requested
 CPU/memory ceilings. Persistence is advisory: failures produce a generic warning
 without changing process, admission, cancellation or receipt semantics.
 
+The run, benchmark, and guarded-terminal paths share a private terminal
+finalization primitive. It completes the owned workload result, joins any
+applicable watchdog, and then attempts the admission release exactly once;
+release failure overrides the primary result. This primitive does not change
+the cache-pin lifetime: a managed-cache pin remains held for the guarded child
+lifecycle and is released when that operation returns. Nor does it change the
+source-snapshot lifecycle: a run cleans its snapshot after terminal admission
+finalization and before sealing the receipt.
+
 On macOS, a fresh strict sample from the absolute system tools is required
 after slot acquisition and before heavy work. `run` starts a two-second
 resource watchdog before local execution; `benchmark` has pre-start admission

docs/COORDINATION_RUNBOOK.md

@@ -11,6 +11,9 @@ OrbStack/Docker workloads or quarantining another activity's state.
 The local shell is not the ownership boundary. The CCP admission root and its
 OS locks are host-wide. A process list from one activity cannot prove that the
 host-wide slot is idle.
+A child exit is not a slot-release handoff. A terminal handoff requires the
+explicit terminal result plus fresh `admission status --json`, `docker ps -q`,
+and `resource status --json` results before another activity proceeds.
 
 ## What is coordinated
 

docs/LOCAL_RUN.md

@@ -92,6 +92,8 @@ child runtime timeout. Both guard timeouts default to six hours, are capped at
     joins before slot release. Compressor occupancy alone never cancels an
     otherwise healthy in-progress run.
     `benchmark` has no mid-workload watchdog in this tranche.
+    The watchdog joins before admission release, and admission release is
+    attempted exactly once. A release failure overrides the primary result.
 13. Execute the `run` checks or benchmark workload with timeout, cancellation, and
     stale-generation guards.
 14. Mark cache entries complete only when every check passes.

docs/TESTING_AND_FAULT_INJECTION.md

@@ -86,6 +86,13 @@ journal avoids the limitation by publishing immutable create-new events.
 Native crash/power-loss and Windows-host qualification remain separate gates.
 Deterministic source tests do not claim either result.
 
+Deterministic fake-closure tests prove terminal ordering and precedence: the
+completion step precedes exactly one release, and a release failure overrides
+the primary result. Process-tree and Docker lifecycle tests prove their own
+containment boundaries only; they do not prove a real admission root, host
+cleanup, a published receipt, or another platform. Process lists do not prove
+release.
+
 ## Managed-cache pin contract
 
 The managed-cache pin tests are deterministic contract tests over an owned