@@ -930,6 +930,17 @@ provider. This is a bounded App companion, not full old-source/Host upgrade or
 D2/release-default qualification. Continue those original acceptance frontiers
 and retire each last caller separately.
 
+Cold-import preservation checkpoint (R5/D1, T4/C1): full-state backups now
+witness each saved regular member's bytes in their existing manifests, including
+raw Markdown history, lease/receipt files, SQLite snapshots and stored
+configuration. Hashing the copied stream avoids binding a reviewed backup to a
+later source reread; failed reads retain the previous backup. This is the backup
+binding prerequisite, not cold-import qualification. Continue the same reviewed
+source import through inventory/quiescence, lease/outbox disposition, immutable
+preview, explicit confirm, writer fence, File/SQLite import/readback and original
+operation recovery on the installed CLI and packaged App. Do not retire the last
+normal Markdown writer or claim the released SQLite default from this checkpoint.
+
 The qualified shadow→canonical archive→isolated File/SQLite restore path retains
 committed dependency archives, terminal lease facts and later canonical writes.
 It does not preserve every unreferenced old-source archive or raw historical
 
@@ -82,6 +82,31 @@ and [reviewed promotion](reviewed-coordination-promotion.md), then inspect the
 real Todo `authority_read` after cutover. An isolated SQLite archive or a
 configuration value alone cannot satisfy live provider acceptance.
 
+## Physical file witnesses
+
+Full `backup-state --execute` now records `execution.file_members` in both the
+in-archive manifest and the external manifest/readback. Each regular tar member
+has its archive path, copied byte count and SHA-256. Ordinary files are hashed
+while tarfile reads them; the witness never comes from rereading a source after
+it changed. SQLite members use the existing verified private snapshot, and
+`configuration-backup.json` witnesses its generated bytes. Unknown Markdown
+metadata, historical lease files and original receipts remain raw data.
+
+Inspect the private external manifest with
+`jq '.execution.file_members' loopx-state-BACKUP_ID.manifest.json`. To validate an
+isolated restore, independently hash each listed regular member and compare its
+byte count. The list excludes the self-containing `manifest.json`, directories
+and tar links; retain the existing whole-archive checksum for their integrity
+and inspect link destinations separately. Earlier backups may lack this list;
+its absence does not grant migration qualification or erase their recovery
+support. A failed or short source read leaves an earlier backup intact.
+
+These witnesses describe saved bytes, not one atomic observation of all live
+writers. A reviewed cold import still needs complete source discovery, writer
+and Host quiescence, lease/outbox disposition, immutable source/target binding,
+explicit confirmation and original-operation recovery. Neither this manifest
+nor configuration verification authorizes an import or a new execution grant.
+
 ## Privacy, consistency and limits
 
 Backups are **private by default**. Full Goal rows can contain private paths,
 
@@ -9,7 +9,7 @@
 import re
 import tarfile
 import tempfile
-from typing import Any
+from typing import Any, Protocol
 
 from . import __version__
 from .paths import select_default_runtime_root
@@ -447,6 +447,45 @@ def build_state_backup_plan(
     }
 
 
+class _BackupReadStream(Protocol):
+    def read(self, size: int = -1, /) -> bytes: ...
+
+
+class _BackupMemberReader:
+    """Witness the stream tarfile copies, without rereading a changing source."""
+
+    def __init__(self, source: _BackupReadStream) -> None:
+        self.source = source
+        self.digest = hashlib.sha256()
+        self.size = 0
+
+    def read(self, size: int = -1, /) -> bytes:
+        data = self.source.read(size)
+        self.digest.update(data)
+        self.size += len(data)
+        return data
+
+
+class _BackupTarFile(tarfile.TarFile):
+    """Retain tarfile's link/metadata behavior and witness every copied member."""
+
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        self.file_members: list[dict[str, Any]] = []
+        super().__init__(*args, **kwargs)
+
+    def addfile(self, tarinfo: tarfile.TarInfo, fileobj: _BackupReadStream | None = None) -> None:
+        # The manifest contains this list; the whole-archive digest covers it.
+        if not tarinfo.isfile() or tarinfo.name == "manifest.json":
+            super().addfile(tarinfo, fileobj)
+            return
+        if fileobj is None:
+            raise ValueError("backup regular member requires its copied byte stream")
+        reader = _BackupMemberReader(fileobj)
+        super().addfile(tarinfo, reader)
+        self.file_members.append({"archive_path": tarinfo.name,
+            "size_bytes": reader.size, "sha256": reader.digest.hexdigest()})
+
+
 def _add_path_to_tar(
     tar: tarfile.TarFile, source: Path, archive_path: str, exclude_roots: list[Path],
     staging: Path, snapshots: dict[Path, tuple[Path, dict[str, Any]]],
@@ -529,7 +568,7 @@ def execute_state_backup_plan(payload: dict[str, Any]) -> dict[str, Any]:
         staging = Path(temporary)
         staged_archive = staging / "archive.tar.gz"
         snapshots: dict[Path, tuple[Path, dict[str, Any]]] = {}
-        with tarfile.open(staged_archive, "w:gz", dereference=False) as tar:
+        with _BackupTarFile.open(staged_archive, "w:gz", dereference=False) as tar:
             for item in included:
                 if not isinstance(item, dict):
                     continue
@@ -550,6 +589,9 @@ def execute_state_backup_plan(payload: dict[str, Any]) -> dict[str, Any]:
             tar.addfile(info, io.BytesIO(configuration_bytes))
             updated["execution"]["configuration_backup"] = verify_configuration_backup(configuration)
             updated["execution"]["sqlite_snapshots"] = [entry[1] for entry in snapshots.values()]
+            # manifest.json is deliberately excluded: it contains this list.
+            # The existing external archive checksum witnesses the whole tar.
+            updated["execution"]["file_members"] = tar.file_members
             manifest_bytes = json.dumps(updated, ensure_ascii=False, indent=2).encode("utf-8")
             info = tarfile.TarInfo("manifest.json")
             info.size = len(manifest_bytes)
 
@@ -0,0 +1,133 @@
+"""Backup witnesses describe archived bytes, never a later source reread."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import sqlite3
+import sys
+import tarfile
+
+import pytest
+
+from loopx.state_backup import build_state_backup_plan, execute_state_backup_plan
+
+
+def fixture(root: Path):
+    project, runtime = root / "project", root / "runtime"
+    state = project / ".codex/goals/example/ACTIVE_GOAL_STATE.md"
+    state.parent.mkdir(parents=True)
+    state.write_bytes(b"## Agent Todo\n- [ ] Current work\n## Agent Todo Archive\n"
+                      b"- [x] Unreferenced history\n  <!-- future_metadata=null -->\n")
+    registry = project / ".loopx/registry.json"
+    registry.parent.mkdir(parents=True)
+    registry.write_text(json.dumps({"common_runtime_root": str(runtime), "goals": [
+        {"id": "example", "repo": str(project), "state_file": str(state),
+         "future_configuration": {"disabled": False, "unset": None}}]}))
+    historical = runtime / "goals/example/task-leases/retained.json"
+    historical.parent.mkdir(parents=True)
+    historical.write_bytes(b'{"status":"released","future":{"null":null,"flag":false}}\n')
+    receipt = runtime / "goals/example/receipts/original.json"
+    receipt.parent.mkdir(parents=True)
+    receipt.write_bytes(b'{"operation_id":"original","unknown":[false,null]}\n')
+    (runtime / "receipt-link").symlink_to("goals/example/receipts/original.json")
+    os.link(receipt, runtime / "receipt-hardlink")
+    return project, runtime, state, registry
+
+
+def plan(root: Path):
+    project, runtime, state, registry = fixture(root)
+    return build_state_backup_plan(project=project, runtime_root=runtime,
+        output_dir=root / "backups", backup_id="fixture", include_automations=False,
+        include_skills=False, include_registry_projects=False, registry_path=registry), state
+
+
+def assert_members(payload):
+    members = payload["execution"]["file_members"]
+    by_path = {row["archive_path"]: row for row in members}
+    assert len(by_path) == len(members)
+    with tarfile.open(payload["archive_path"]) as archive:
+        expected = {row.name for row in archive if row.isfile() and row.name != "manifest.json"}
+        assert set(by_path) == expected
+        for path, row in by_path.items():
+            data = archive.extractfile(path).read()
+            assert row == {"archive_path": path, "size_bytes": len(data),
+                           "sha256": hashlib.sha256(data).hexdigest()}
+        internal = json.load(archive.extractfile("manifest.json"))
+        assert internal["execution"]["file_members"] == members
+    external = json.loads(Path(payload["manifest_path"]).read_text())
+    assert external["execution"]["file_members"] == members
+
+
+@pytest.mark.parametrize("with_sqlite", [False, True])
+def test_real_cli_inventory_binds_raw_history_and_generated_configuration(tmp_path, with_sqlite):
+    project, runtime, state, registry = fixture(tmp_path)
+    original = state.read_bytes()
+    if with_sqlite:
+        with sqlite3.connect(runtime / "retained.data") as database:
+            database.execute("CREATE TABLE receipts(value TEXT)")
+            database.execute("INSERT INTO receipts VALUES(?)", ('{"future":[false,null]}',))
+    result = subprocess.run([sys.executable, "-I", "-m", "loopx.cli", "--registry", str(registry),
+        "--runtime-root", str(runtime), "--format", "json", "backup-state", "--project", str(project),
+        "--output-dir", str(tmp_path / "backups"), "--current-project-only", "--no-automations",
+        "--no-skills", "--execute"], env={**os.environ, "LOOPX_USAGE_PING": "0"},
+        capture_output=True, text=True, check=True)
+    payload = json.loads(result.stdout)
+    assert payload["ok"] is True
+    assert_members(payload)
+    restored = tmp_path / "restored"
+    with tarfile.open(payload["archive_path"]) as archive:
+        archive.extractall(restored, filter="data")
+    assert (restored / "project/.codex/goals/example/ACTIVE_GOAL_STATE.md").read_bytes() == original
+    assert (restored / "runtime-root/receipt-link").is_symlink()
+    assert (restored / "runtime-root/receipt-hardlink").read_bytes() == (
+        runtime / "goals/example/receipts/original.json").read_bytes()
+    if with_sqlite:
+        with sqlite3.connect(restored / "runtime-root/retained.data") as database:
+            assert database.execute("PRAGMA integrity_check").fetchone()[0] == "ok"
+            assert database.execute("SELECT value FROM receipts").fetchone()[0] == '{"future":[false,null]}'
+    assert state.read_bytes() == original
+
+
+def test_member_digest_uses_the_copied_stream_not_a_later_source_reread(tmp_path, monkeypatch):
+    payload, state = plan(tmp_path)
+    original = state.read_bytes()
+    addfile = tarfile.TarFile.addfile
+
+    def change_after_copy(archive, info, fileobj=None):
+        result = addfile(archive, info, fileobj)
+        if info.name == "project/.codex/goals/example/ACTIVE_GOAL_STATE.md":
+            state.write_bytes(b"later source contents\n")
+        return result
+
+    monkeypatch.setattr(tarfile.TarFile, "addfile", change_after_copy)
+    completed = execute_state_backup_plan(payload)
+    assert_members(completed)
+    row = next(row for row in completed["execution"]["file_members"]
+               if row["archive_path"] == "project/.codex/goals/example/ACTIVE_GOAL_STATE.md")
+    assert row["sha256"] == hashlib.sha256(original).hexdigest()
+    assert row["sha256"] != hashlib.sha256(state.read_bytes()).hexdigest()
+
+
+def test_short_source_read_cannot_publish_partial_inventory_or_replace_backup(tmp_path, monkeypatch):
+    payload, state = plan(tmp_path)
+    output = Path(payload["output_dir"])
+    output.mkdir()
+    archive, manifest = Path(payload["archive_path"]), Path(payload["manifest_path"])
+    archive.write_bytes(b"previous archive")
+    manifest.write_bytes(b"previous manifest")
+    addfile = tarfile.TarFile.addfile
+
+    def truncate_before_copy(archive, info, fileobj=None):
+        if info.name == "project/.codex/goals/example/ACTIVE_GOAL_STATE.md":
+            state.write_bytes(b"")
+        return addfile(archive, info, fileobj)
+
+    monkeypatch.setattr(tarfile.TarFile, "addfile", truncate_before_copy)
+    with pytest.raises(OSError, match="unexpected end of data"):
+        execute_state_backup_plan(payload)
+    assert archive.read_bytes() == b"previous archive"
+    assert manifest.read_bytes() == b"previous manifest"
+    assert sorted(path.name for path in output.iterdir()) == sorted([archive.name, manifest.name])