[gonz0w]

Real Zsh can now launch the held helper to write exactly16 bytes to existing /home/probe, return0 and reach its prompt, then exit/export cleanly. Independent fresh OpenZFS readers verify those bytes after the writer stops.

The opt-in AEFP0005 path keeps namespace custody in Rust and admits WRITE only for the committed, READY helper generation. It preserves checked write/close outcomes without replay, old FILE profiles and DIRECTORY10, and all existing limits. The selected engine requires exactly seven mutations; the v3 Owner row reports completed write/close and cleanup facts.

Validation:

• Actual Zsh writer:35.657s,36/96 requests, helper/status0, prompt return, normal export,21 cleanup phases and three reclamations.
• Actual pristine/recovery cold cohort:31.319s; exact payload/EOF, terminfo hash/tree, metadata/ACL/link/inventory and preserved original digest; both disks unchanged and both guests stopped cleanly.
• Focused C/Rust positive, denial, short/unknown/no-replay and old-profile checks; fresh parent/helper/Owner/seven-engine/reader fits; separate source and artifact review. Normal hooks pass.

This delivers the fixed #145 checkpoint under the approved scoped gates. Full-root coverage remains in #141; general execution/redirection, login, packages and R1 retain their own gates. Owner Runtime is4056/4096 bytes, so further state changes require a fresh fit.

Reviewed tree: 4f1290b1fc96b8831f7f1b219d457135b05a67a3.

Closes #145.