diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index ebeafe9..a128530 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `af7a7bd69966cb9939bf331cab169e2ec61e8f26`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `8e49e71ad0298326f565f57d4962e482e738d6e1`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index cc1e719..6353c0e 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "af7a7bd69966cb9939bf331cab169e2ec61e8f26",
+  "sourceRevision": "8e49e71ad0298326f565f57d4962e482e738d6e1",
   "files": [
     {
       "path": ".dockerignore",
@@ -1684,8 +1684,8 @@
     },
     {
       "path": "backend/tests/test_runner_resource_envelope.py",
-      "sha256": "1af414118af3be0dd4466fffe6a707249a84fc6cbeaf45e1b8aba9c739746241",
-      "bytes": 99527
+      "sha256": "f2a1c2468bdda62acbc91657a35cfc63fe525413ee56dc66b8bd4527597c9aba",
+      "bytes": 101609
     },
     {
       "path": "backend/tests/test_runner_scheduler_liveness_recovery.py",
diff --git a/backend/tests/test_runner_resource_envelope.py b/backend/tests/test_runner_resource_envelope.py
index c18bb23..0467976 100644
--- a/backend/tests/test_runner_resource_envelope.py
+++ b/backend/tests/test_runner_resource_envelope.py
@@ -1610,7 +1610,8 @@ def test_namespace_attestation_rechecks_engine_without_counts_only_adoption(monk
     if drift is None:
         assert envelope._attest_outer_namespace(envelope.DIND_NAME)[0] == before
     else:
-        with pytest.raises(RuntimeError, match="^resource_cgroup_process_mapping_invalid$"):
+        expected = "resource_cgroup_probe_namespace_invalid" if drift in {"pid", "start", "image"} else "resource_cgroup_process_mapping_invalid"
+        with pytest.raises(RuntimeError, match=f"^{expected}$"):
             envelope._attest_outer_namespace(envelope.DIND_NAME)
 
 
@@ -1653,8 +1654,9 @@ def test_engine_binding_preserves_all_mount_fields_but_not_incidental_order():
     assert envelope._engine_outer_binding(item) != envelope._engine_outer_binding(reordered)
 
 
-@pytest.mark.parametrize("drift", [False, True])
-def test_namespace_probe_lifecycle_rechecks_target_before_start(monkeypatch, drift):
+@pytest.mark.parametrize("drift", [None, "binding", "threads", "processes", "binding_and_threads"])
+@pytest.mark.parametrize("phase", ["before_start", "after_exit"])
+def test_namespace_probe_lifecycle_rechecks_identity_and_population(monkeypatch, drift, phase):
     envelope = _module()
     base, image_id, source = _host_probe_fixture(envelope)
     target = {"name": envelope.DIND_NAME, "id": "a" * 64}
@@ -1670,7 +1672,16 @@ def test_namespace_probe_lifecycle_rechecks_target_before_start(monkeypatch, dri
     def engine(name):
         assert name == envelope.DIND_NAME
         engine_calls.append(name)
-        return {"Id": target["id"], "State": {"Pid": 1234, "StartedAt": "changed" if drift and len(engine_calls) > 1 else "fixed"}}, [(1234, 1)]
+        changed = drift is not None and len(engine_calls) >= (2 if phase == "before_start" else 3)
+        binding = {"Id": target["id"], "State": {"Pid": 1234, "StartedAt": "fixed"}}
+        pairs = [(1234, 1)]
+        if changed and drift in {"binding", "binding_and_threads"}:
+            binding["State"]["StartedAt"] = "changed"
+        if changed and drift in {"threads", "binding_and_threads"}:
+            pairs = [(1234, 2)]
+        elif changed and drift == "processes":
+            pairs.append((1235, 1))
+        return binding, pairs
     monkeypatch.setattr(envelope, "_engine_outer_population", engine)
     commands = []
     def run(args, **_kwargs):
@@ -1691,9 +1702,10 @@ def test_namespace_probe_lifecycle_rechecks_target_before_start(monkeypatch, dri
     monkeypatch.setattr(envelope.subprocess, "run", start)
     payload = {"target": target, "processCount": 1, "threadCount": 1}
     if drift:
-        with pytest.raises(RuntimeError, match="^resource_cgroup_probe_namespace_invalid$"):
+        expected = "resource_cgroup_probe_namespace_invalid" if drift in {"binding", "binding_and_threads"} else "resource_cgroup_process_mapping_invalid"
+        with pytest.raises(RuntimeError, match=f"^{expected}$"):
             envelope._run_host_probe("population", payload)
-        assert starts == []
+        assert len(starts) == (0 if phase == "before_start" else 1)
     else:
         assert envelope._run_host_probe("population", payload)["namespaceOwned"] is True
         assert starts == [["docker", "start", "--attach", "--interactive", base["Id"]]]
@@ -2005,7 +2017,8 @@ def test_build_probe_attestor_does_not_retry_other_resource_refusals(monkeypatch
     assert len(attempts) == 1 and "probeWorkload" not in proof
 
 
-def test_collect_snapshot_uses_host_helper_and_exports_real_family_counters(monkeypatch):
+@pytest.mark.parametrize("drift", [None, "binding_before_snapshot", "binding_after_snapshot", "threads_after_snapshot", "binding_and_threads_after_snapshot"])
+def test_collect_snapshot_uses_host_helper_and_exports_real_family_counters(monkeypatch, drift):
     envelope = _module()
     snapshot = _snapshot()
     profile_names = {
@@ -2070,6 +2083,23 @@ def test_collect_snapshot_uses_host_helper_and_exports_real_family_counters(monk
 
     monkeypatch.setattr(envelope, "_run_host_probe", fake_probe)
     _fixture_outer_namespace(envelope, monkeypatch)
+    stable_namespace = envelope._attest_outer_namespace
+    namespace_calls = {}
+
+    def namespace(name):
+        namespace_calls[name] = namespace_calls.get(name, 0) + 1
+        binding, pairs, claim = copy.deepcopy(stable_namespace(name))
+        if name == envelope.DIND_NAME:
+            phase = "before_snapshot" if namespace_calls[name] == 1 else "after_snapshot"
+            if drift and drift.endswith(phase):
+                if drift.startswith("binding"):
+                    binding["State"]["StartedAt"] = "changed-start"
+                if "threads" in drift:
+                    pairs[0] = (pairs[0][0], 2)
+                    claim["threadCount"] = 2
+        return binding, pairs, claim
+
+    monkeypatch.setattr(envelope, "_attest_outer_namespace", namespace)
     real_read_text = Path.read_text
 
     def reject_local_proc_or_sys(path, *args, **kwargs):
@@ -2083,6 +2113,12 @@ def test_collect_snapshot_uses_host_helper_and_exports_real_family_counters(monk
         expected_host_budget={"cpuMilli": 8000, "memoryMiB": 16384},
     )
 
+    if drift:
+        expected = "resource_cgroup_probe_namespace_invalid" if drift.startswith("binding") else "resource_cgroup_process_mapping_invalid"
+        assert result["ready"] is False and result["reason"] == expected
+        if drift.endswith("before_snapshot"):
+            assert probe_calls == []
+        return
     assert probe_calls and probe_calls[0][0] == "snapshot"
     assert result["ready"] is True
     assert result["familyCpuUsageUsec"] == 1200