## Scope
Fixes BigscreenVR/spt-bs-releases#308. W1a of [#307](https://github.com/BigscreenVR/spt-bs-releases/issues/307), v0.71.0.

One commit off `289e3cdfe39a8a4e91f5ea7d4b436f11a50b191e`.

- Replace the process-local serving writer mutex with one stable per-registry OS-file-lock sentinel, acquired before fresh load and retained through mutation, snapshot side effects and explicit publication.
- Coordinate broker mutations, brain TTL reaping, and direct live-daemon fixture writers. Keep readers lock-free and no-op paths free of automatic saves.
- Preserve expiry, acknowledged registrations and persistent name-allocation history; fail closed when lock acquisition fails.
- Add deterministic two-process storage regressions, including abrupt-holder-exit release; retain the original attachment membership assertion.
- Activate `REQ-HAZARD-SERVE-REGISTRY-LOST-UPDATE` doc/impl/unit/int evidence in the same commit and update storage, hazard, public serving and release-note documentation.

## Windows red-first proof
Only `lock.lock_exclusive()?` was temporarily omitted. The unchanged selected integration cell ran once and nextest returned **100**:

`serving registry worker: another process reported HELD but its sentinel was unlocked`

The worker exited before the `blocked` barrier; this is the independent OS-contention witness, not a timeout or compile failure. Fixed source was then restored byte-for-byte (SHA256 `a586a3839ec5d5c62794fdac695cfa2c2bc8549cef730069041067e0c33e1d90`).

Red receipt: `.spt/preserved/308-registry-process-lock/windows-validation/red/receipt.json`
Red stderr: `.spt/preserved/308-registry-process-lock/windows-validation/red/regression.stderr`

## Restored acceptance
HFENDULEAM, own worktree/target, jobs=2, private SPT_HOME/temp, ci-windows profile, zero retries. Hertz's separate evidence lane was authorized concurrent CPU contention.

| Gate | Result |
| --- | --- |
| Cold pool claim/build | native 0 |
| Required inventory | 44 selected tests, named prerequisites checked |
| Store serving units | 26 passed |
| Servehost units, including fail-closed | 13 passed |
| Two-process regressions | 3 passed |
| webserve_attachment_e2e | passed |
| webserve_cross_node_e2e | passed |
| Combined nextest run | native 0; 44/44 passed, 55.298s; 1637 outside-filter tests skipped |
| xtask gen / first native xtask check | native 0 / 0 |
| traceable-reqs 0.4.1 check | native 0; 923/923 complete; zero findings |
| Pool release | native 0 |

## Exact provenance and limits
Runtime tests ran at `e6e9a8cad719f1ce61c396bae119c1539110bd08`. Final head `c9e8051140bb060d22fde12424d44316bfc1b7f4` differs **only** in regenerated `docs-site/src/changelog.md` (+9 lines). All final source files byte-match the successful traceability input; runtime/test/build inputs match the Windows-tested commit. `final-provenance.json` records the full mapping.

The generator also normalized the otherwise unchanged CLI reference from CRLF to LF. A conservative artifact guard stopped before executing check; those original bytes were restored after proving normalized equality. The generator was not rerun. The first actual native docs check then passed. Both the guard refusal and classification are retained; no product failure is hidden.

The process regression proves the shared storage transaction contract, not a captured broker/brain incident schedule. The two affected composite E2Es separately exercised the consumer surfaces. Earlier Linux receipts concern the earlier draft/base and are not claimed as Linux verification of this head.

Retired Windows target removed only after outbound/inbound reparse classification, successful release and empty own-target process census. Source/proofs retained; observed free-space delta +13,664,698,368 bytes. No assembly edit or merge performed.

**Rollout constraint:** both broker and brain must run the fixed implementation. A new brain with an old broker does not close the race.

Doyle retains the independent isolated gate and ff-only assembly decision.