# Canonical participants at progression boundaries

Normal prison unlocking and carried-document recovery now use the mission roster's `CurrentActor` lookup and the configured player faction. A living body controlled by a player is insufficient if its account/life no longer owns that body. This brings both older entry points into agreement with radio defence, physical prison crossing and casualty loading. Existing range, phase, server and life checks remain in place; document recovery still permits a living unconscious canonical carrier.

`tests/test_progression_identity.py` executes the actual guards against focused identity doubles, including disconnected records, replaced bodies, stale account/life relationships and incorrect factions. A valid canonical rebind remains accepted.

The Workbench-only `ERR_NativeProgressionIdentityProbe` adds a disclosed synchronous fault injection to the ordinary full-loop fixture. It temporarily clears only the actual admitted record's `Actor`, calls normal unlock, and restores the original reference before assertions or any yield. For discovery, it waits for a physically held, unspent targeted document whose site is unidentified. It calls the production recovery method under the same temporary mismatch, restores the reference, checks no spending/knowledge change, then immediately allows normal recovery of that same document. Controller, UUID, faction, connection and used-life fields are never changed. The rejection and subsequent ordinary positive result are required in each full-loop round.

This is native API and production-boundary testing with explicit roster-body fault injection. It is not a remote identity, reconnect, possession or multiplayer test. The [100619 Core regression](evidence/native-2026-09-19-100619/report.json) verifies both injected rejection boundaries and ordinary positive recovery in each of two complete rounds, with 612 total assertions and zero captured errors.