[huangruiteng]

A resumed Goal could still be blocked by legacy registry pause metadata that disagreed with activation.state (#8431). The existing backup-first upgrade sweep now retires status=paused/stopped and stored activation_state aliases before activating the candidate runtime. Normal registry reads and transactions reject those retired representations, and Resume writes only canonical activation.

status retains registration/archive meaning; activation_state remains a derived response field for the existing UI. The TS upgrade decoder preserves a stop when historical representations disagree, matches source/projection by exact route and Goal lifetime, and leaves unrelated configuration intact. The existing Python lifecycle service composes the upgrade; the registry transaction owns verified preimage backups, locking, format/protocol validation and compensated writes. There is no new configuration mode or normal-path compatibility reader.

The CLI/snapshot update path already invokes authority-archive upgrade --all-known --execute. This change adds metadata to that existing step, with original-byte private backups before any registry commit, read-only preview/currentness checks, idempotent retry and rejection of changed source routes. A lifecycle-only source_session_v1 execution pause remains rejected rather than being translated into newly runnable registration; this change does not activate that profile.

Validation:

• Final head: 50 migration, codec, Chat HTTP, real File/SQLite CLI and registry-I/O census tests pass; TS typecheck and the full CI Ruff command pass.
• The same File/SQLite CLI test fails the retirement oracle against immutable baseline f5110d3437befedfbeb860982e6282bbbf75284f, passes at this head, and fails both cases when metadata execution is deliberately removed. The original bytes, unknown/nested metadata, large integers, canonical authority revision, Stop, stale confirmation and receipt replay are checked.
• Broader related regression coverage passed before the final IO-owner consolidation. The consolidation removed an extra Python component and moved preimage writes into the codec after premerge exposed the twin-module budget and direct-IO ownership findings; no budget was raised.
• Standard premerge passes at 8637173797eda47575ff716cd0d8f6fc0c630d5a: 6 direct checks and all 17 selected catalog/risk/boundary checks, with no failures or manual holds. The boundary check uses an isolated registry; this is not a claim about unrelated live Goal diagnostics. Installed desktop/release qualification and remote CI are separate from the isolated CLI/HTTP evidence. Retire legacy Goal pause metadata through backed-up upgrades #8431 remains open; this proposal supersedes its dual-pause reconciliation approach rather than depending on a second writer being retained.

[huangruiteng]

Consolidated into #8431 on its original branch at 8e2d7a1. Closing this duplicate as requested; the original author commits and review history remain in #8431.