@@ -7,8 +7,22 @@
   opens a 15-minute exact-coordinate wallet session, and resumes publishing
   automatically after Registry approval; `--no-open` supports remote and
   terminal-only environments. Session reads expose neither the polling secret
-  nor the resulting key ID to the browser. Submit distinguishes detected
-  in-browser connectors from the complete external-signature directory, uses
+  nor the resulting key ID to the browser. The publishing key is written to
+  the OS keychain as `pending` before the browser opens, promoted to `active`
+  only when either successful status returns the matching key ID, and removed
+  on cancellation or expiry. This closes the process-exit window after wallet
+  approval without treating local state as Registry authority. The browser
+  token survives same-tab refresh in `sessionStorage` and is removed on
+  completion or expiry. Session mode now
+  lists only connectors that can actually complete the browser flow and folds
+  challenge creation, wallet signing, and completion into one **Approve
+  publishing access** action; the full external-wallet directory remains in
+  the explicit manual CLI path. Session completion atomically consumes the
+  nonce, records the publishing key, claims or reviews the namespace, updates
+  the session, and writes its audit trail. Concurrent or replayed completion
+  returns the committed result without duplicating authority. Submit
+  distinguishes detected in-browser connectors from the complete
+  external-signature directory, uses
   plain publishing-access language on the first-run path, states the
   non-replaceable release rule directly, and preserves the explicit CLI path
   for external wallets and CI. Artifact details now derive one recommended
 
@@ -68,7 +68,15 @@ The CLI coverage includes both first-publish admission paths: the explicit
 `cellc auth capability submit`, `cellc auth namespace claim`, then
 `cellc publish` sequence, and the short-lived `cellc publish --authorise`
 browser session in which the private publishing key remains in the local OS
-keychain while the CLI polls with a one-time secret. Publisher maintenance additionally uses the capability-signed
+keychain as pending while the CLI polls with a one-time secret, becomes active
+only after the server returns the matching key ID, and is removed on terminal
+cancellation or expiry. The browser token survives a same-tab refresh but is
+cleared after completion or expiry. Browser-session completion is one atomic admission boundary across
+nonce consumption, publishing-key registration, namespace claim/review,
+session state, and audit events. API tests cover expiry, wrong browser/poll/
+challenge tokens, challenge replay, concurrent completion, conflicting
+namespace ownership, review-pending admission, and injected mid-transaction
+failure. Publisher maintenance additionally uses the capability-signed
 `cellc artifact set-availability` path, and `cellc artifact cell-dep` performs a
 fresh mainnet liveness check before producing a transaction-builder descriptor.
 Independent reproducibility builders use `cellc auth reproducer create`; CLI
 
@@ -170,10 +170,22 @@ scope:
 Each form also accepts `namespace/*`. Possessing one action does not imply either
 of the others.
 
+`POST /v1/authorisation-sessions/:session_id/complete` is idempotent after a
+successful completion. Its first successful call commits nonce use, capability
+registration, namespace claim or review state, session completion, and audit
+events in one store transaction. A concurrent call returns the committed
+session instead of creating a second capability use. Expired sessions, stale
+challenge tokens, and conflicting namespace owners leave the session pending
+and create none of those records.
+
 For an interactive first publish, `cellc publish --authorise` creates a
 15-minute, exact-coordinate browser session and opens the matching Registry
 site. The CLI generates the delegated P-256 key first and keeps its private key
-in the OS keychain. The API stores only the public key plus hashes of separate
+in the OS keychain as pending before opening the browser, then promotes it to
+active only after `authorised` or `review_pending` returns the same key ID.
+Cancellation and expiry remove the pending entry; an interrupted CLI can still
+recover the key through the key ID printed before the browser opens if the
+wallet completed first. The API stores only the public key plus hashes of separate
 one-time CLI-polling and browser-approval tokens. The browser token travels in
 the URL fragment, not the query string, so it is absent from HTTP logs and
 Referer headers; browser reads never return the polling token or resulting
 
@@ -2865,14 +2865,16 @@ async function handleCompleteAuthorisationSession(
       request_id: requestId,
       session_id: session.session_id,
       status: session.status,
+      ...(session.namespace_status ? { namespace_status: session.namespace_status } : {}),
     }, 200, headers);
   }
   if (!session.payload || !session.challenge_token_hash) {
     throw new ApiError(409, "authorisation_challenge_missing", "request a wallet challenge before completing this session");
   }
   const body = await readJson(request, Math.min(maxJsonBytes(env), 128 * 1024));
   const challengeToken = String(body["challenge_token"] ?? "").trim();
-  if (!challengeToken || `sha256:${await sha256Hex(challengeToken)}` !== session.challenge_token_hash) {
+  const challengeTokenHash = `sha256:${await sha256Hex(challengeToken)}`;
+  if (!challengeToken || !await constantTimeSecretEqual(challengeTokenHash, session.challenge_token_hash)) {
     throw new ApiError(401, "invalid_authorisation_challenge_token", "authorisation challenge token is invalid or stale");
   }
   const payload = validateCapabilityPayload(session.payload, registryOrigin, now);
@@ -2884,66 +2886,38 @@ async function handleCompleteAuthorisationSession(
   if (existing && (existing.owner_principal_type !== payload.principal_type || existing.owner_principal_id !== payload.principal_id)) {
     throw new ApiError(409, "namespace_already_claimed", "namespace is already claimed by another principal");
   }
-  if (!existing) {
-    await enforceNamespaceClaimCooldown(
-      store,
-      requestId,
-      payload.principal_type,
-      payload.principal_id,
-      now,
-      namespaceClaimCooldownSeconds(env),
-    );
-  }
-  const nonceKey = await consumeSignedNonce(store, requestId, {
+  const nonce = await signedNonceUse(requestId, {
     protocol: payload.protocol,
     action: `${payload.action}:capability_create`,
     nonce: payload.nonce,
     expires_at: payload.expires_at,
     principal_type: payload.principal_type,
     principal_id: payload.principal_id,
   });
-  let capability;
-  try {
-    capability = await store.recordCapability({ payload, principal_signature: signature, request_id: requestId });
-  } catch (error) {
-    await store.releaseNonce({ nonce_key: nonceKey, request_id: requestId });
-    throw error;
-  }
-  let namespaceStatus: "active" | "review_pending";
-  if (existing) {
-    namespaceStatus = existing.status === "active" ? "active" : "review_pending";
-  } else {
-    const claim = await store.claimNamespace({
-      namespace: session.namespace,
+  const completion = await store.finaliseAuthorisationSession({
+    session_id: sessionId,
+    expected_challenge_token_hash: challengeTokenHash,
+    payload,
+    principal_signature: signature,
+    nonce: {
+      ...nonce,
       principal_type: payload.principal_type,
       principal_id: payload.principal_id,
-      request_id: requestId,
-    });
-    namespaceStatus = claim.status;
-  }
-  const completed = await store.completeAuthorisationSession({
-    session_id: sessionId,
-    capability_key_id: capability.key_id,
-    namespace_status: namespaceStatus,
-    request_id: requestId,
-  });
-  await store.appendAuditEvent({
+    },
     request_id: requestId,
-    event_type: "authorisation_session.completed",
-    principal_type: payload.principal_type,
-    principal_id: payload.principal_id,
-    capability_key_id: capability.key_id,
-    namespace: session.namespace,
-    name: session.name,
-    data: { session_id: session.session_id, namespace_status: namespaceStatus },
+    now_iso: now.toISOString(),
+    namespace_claim_cooldown_seconds: namespaceClaimCooldownSeconds(env),
   });
+  const completed = completion.session;
+  const namespaceStatus = completed.namespace_status;
+  if (!namespaceStatus) throw new Error("completed authorisation session did not record namespace status");
   return json({
     schema: "cellscript-registry-authorisation-session-v1",
     request_id: requestId,
     session_id: completed.session_id,
     status: completed.status,
     namespace_status: namespaceStatus,
-  }, namespaceStatus === "active" ? 201 : 202, headers);
+  }, completion.replayed ? 200 : namespaceStatus === "active" ? 201 : 202, headers);
 }
 
 function validateAuthorisationSessionId(value: string): string {
@@ -3490,19 +3464,17 @@ function idempotencyResponse(record: IdempotencyRecord, headers: Headers): Respo
   return json(record.response_body, record.response_status, replayHeaders);
 }
 
-async function consumeSignedNonce(
-  store: RegistryStore,
-  requestId: string,
-  input: {
-    protocol: string;
-    action: string;
-    nonce: string;
-    expires_at: string;
-    principal_type?: string;
-    principal_id?: string;
-    capability_key_id?: string;
-  },
-): Promise<string> {
+type SignedNonceUseSource = {
+  protocol: string;
+  action: string;
+  nonce: string;
+  expires_at: string;
+  principal_type?: PrincipalType;
+  principal_id?: string;
+  capability_key_id?: string;
+};
+
+async function signedNonceUse(requestId: string, input: SignedNonceUseSource) {
   const nonceKey = `nonce_${await sha256Hex(canonicalJson({
     protocol: input.protocol,
     action: input.action,
@@ -3511,7 +3483,7 @@ async function consumeSignedNonce(
     principal_id: input.principal_id ?? null,
     capability_key_id: input.capability_key_id ?? null,
   }))}`;
-  const accepted = await store.consumeNonce({
+  return {
     nonce_key: nonceKey,
     protocol: input.protocol,
     action: input.action,
@@ -3521,7 +3493,16 @@ async function consumeSignedNonce(
     ...(input.principal_type ? { principal_type: input.principal_type } : {}),
     ...(input.principal_id ? { principal_id: input.principal_id } : {}),
     ...(input.capability_key_id ? { capability_key_id: input.capability_key_id } : {}),
-  });
+  };
+}
+
+async function consumeSignedNonce(
+  store: RegistryStore,
+  requestId: string,
+  input: SignedNonceUseSource,
+): Promise<string> {
+  const nonceUse = await signedNonceUse(requestId, input);
+  const accepted = await store.consumeNonce(nonceUse);
   if (!accepted) {
     await store.appendAuditEvent({
       request_id: requestId,
@@ -3532,12 +3513,12 @@ async function consumeSignedNonce(
       data: {
         protocol: input.protocol,
         action: input.action,
-        nonce_key: nonceKey,
+        nonce_key: nonceUse.nonce_key,
       },
     });
     throw new ApiError(409, "nonce_replay", "signed nonce has already been used");
   }
-  return nonceKey;
+  return nonceUse.nonce_key;
 }
 
 async function writeStaticRegistryVersionObject(