TransitionHistoryAuthentication

Required original-proof authentication for one installed transition. The bootstrap/activation implementation must read the entire committed history, original source and namespace blobs, fixed baseline and archive evidence, current enforced fences, and actual initial certificate or activation decision. It must reject a record from another transition or evidence class.

Recovery holds the application's safety gate. Read the supplied immutable state and journal; do not recursively call that same JournalSafetyStore or a controller gate already held by the invoking operation. A physical journal digest or a caller-provided status never substitutes for these proofs.