PASS actual runner selector/admission; unchanged default display/audio; authored identity consistency and bounded cleanup source controls. No native/managed-lifetime/geometry execution proof.