test(evidence): harden generation lifecycle boundaries

.superpowers/sdd/evidence-task-5c-report.md

@@ -53,3 +53,18 @@ legacy-config deprecation warnings.
 Fresh verification after the fix wave: full harness `672 passed, 5 deselected`; Docker pgvector,
 HTTP parity, and migration suites `43 passed`; exact direct inventory/delete integration `1 passed`;
 changed-file Ruff and `git diff --check` clean.
+
+## Final hardening verification
+
+- Canonical generation validation is exact (`^gen:[0-9a-f]{32}$`) before HTTP/direct deletion;
+  malformed HTTP inventory rows fail closed rather than entering the GC candidate set.
+- Added explicit protection coverage for running and failed-resumable JobRunner checkpoints, plus
+  a second-GC idempotence assertion for vector-only orphan reconciliation.
+- Added deterministic concurrent locking coverage: a job paused after discovery retains the corpus
+  writer lock, explicit GC blocks, then completes after publication without deleting the active run.
+- Added a descriptor-race regression: replacing the corpus pathname immediately after `read(2)`
+  leaves the atomically materialized session-owned copy byte-for-byte equal to the validated ACTIVE
+  document and its manifest hash.
+
+Final fresh evidence: Docker pgvector/HTTP/migration suites `48 passed`; full harness `680 passed,
+5 external L2 deselected`; changed-file Ruff and `git diff --check` clean.