[sfmskywalker]

A successful custom shell-registry activation currently has no generation association in the runner result: VerifiedGeneration intentionally stays null, and a later registry lookup can observe a replacement shell.

Add nullable scalar ReturnedGeneration metadata to the existing attempt and target snapshot, captured from the successful current shell returned by that call. Keep constructor signatures and VerifiedGeneration semantics unchanged. Stale, failed and call-canceled returns have no value; external satisfaction alone has no value, while an in-flight successful own return records its generation. Later reloads and cancellation after a successful return preserve that historical result.

Validation: all production targets (.NET 8/9/10) build with zero warnings/errors; 811 library and 31 end-to-end tests pass; final focused suite passes 24/24. An unchanged binary client compiled against the old public constructors executes against candidate abstractions on all three runtimes. Both compiled capture/projection mutations fail the intended current-return case while the stale control passes, followed by exact restoration. Independent source/evidence review and root self-review pass, including the added gated-observer cancellation regression. Full-suite evidence precedes a final test-only bounded-wait adjustment; the final focused suite verifies that adjustment.

Refs #167; child of #143. Keep the issue open until resulting-main checks, normal preview publication, full public package-family audit and fresh-cache .NET 8/9/10 package-consumer qualification complete. Copilot/Greptile requests are waived by the owner; no approval from either is claimed. No dependency, settlement, readiness or host-policy change.

[sfmskywalker]

Exact-head hosted CI passed for 757abfb4dbcbe4b183abc0aa4da147622f8688fd (whole-solution restore/build/test). Fresh reviews, inline comments, issue comments and review-thread readback contain no outstanding feedback; normal merge state is CLEAN.

Independent restored-source/evidence review and root self-review pass. Local evidence: all production TFMs build with zero warnings/errors; 811 library tests and31 E2E tests pass; final frozen focused runner suite24/24. The final test-only bounded-wait adjustment was checked by that focused run; production source is unchanged from broader gates. Two compiled mutations each fail the intended custom-current case (37 versus null) while stale control passes; exact source and production DLL restoration is proven. The unchanged prechange binary client executes the original9/15-parameter constructors against candidate abstractions on actual .NET8/9/10. The independent-review cancellation finding is fixed with an observer-gated test.

Copilot/Greptile requests are waived by the owner; no external approval is claimed. Normal squash merge is authorized. #167 remains open until resulting-main package publication, complete public family audit and fresh-cache PackageReference-only consumer qualification on all three runtimes. No stable-release or Foundation-adoption completion is claimed.