[ZeroPoint95]

• Require successful durable endings for all three hosted tasks alongside the existing fourteen file and UI assertions, preserving the original five-minute guards.
• Retain sanitized task, action, model-call metadata and SQLite evidence before store rotation and cleanup; disable request and response bodies in the owned call log.
• Support application-bound profiles without reading or copying their credential file.
• Validation: build, exact-base make pr-ready, nine deterministic tooling regressions and independent source review passed. One authorized real-binary hosted run passed all sixteen assertions with three successful task endings on the outcome/evidence repair; the final call-log placement follow-up passed deterministic launch verification and independent review.