[ancongui]

A maintenance unit created from another native checkpoint-maintenance unit could not bind its issue notifications: the typed parent reference contains a run-creation request ID, and the service looked that ID up as an SCM delivery receipt. The API returned 404 Delivery receipt not found before saving the binding.

Resolve the stable typed reference through its authenticated SCM parent and the canonical native creation projection. Configuration, its locked recheck, and later notification revalidation share that resolution. The creation digest, original creator provenance, frozen source, project/component, and current reader/owner authority remain bound. Newer comments cannot replace the retained parent or confer execution authority.

Validation: meaningful nested-maintenance RED, then 77 controlled host tests pass; mypy (308 modules), configured Ruff/format, and strict documentation pass. Three controlled PostgreSQL cases pass (21.78 seconds), covering nested parent resolution, rejection of forged lineage references, and current-reader revocation. The negative case preserves the immutable creation record. Earlier fixture setup and immutable-record test failures are retained in the private validation record. Existing loader22/admission35/runtime21/template315 bytes are unchanged.

Based on current main after #59. The integration merge has the same complete tree as the previously tested feature head; the PR contains five changed paths. Full CI for the current commit is pending. This patch does not modify the CRM source or claim live CRM acceptance.