diff --git a/docs/guides/native-candidate.md b/docs/guides/native-candidate.md
index 7a31e89b0..2dbe382d3 100644
--- a/docs/guides/native-candidate.md
+++ b/docs/guides/native-candidate.md
@@ -118,6 +118,21 @@ complete bundle to change the candidate.
    binary refusing newer state is an unsupported downgrade, not a successful rollback.
    Preserve that state; do not rewrite receipts or adopt another home's data.
 
+Host cleanup or a reboot can remove the temporary `/private/tmp/hkl-<owner>` HOME
+alias while the private candidate home and disks remain intact. Normal commands
+report `provider_home_missing`; they do not initialize another pool or recreate the
+alias during observation. Explicit `runtime recover --json` can restore only that
+absent exact alias, after verifying the receipt-bound dead provider, both recorded
+disks, free VM lock, closed disk handles, and no active provider command. Existing
+files, directories, foreign links, a live or reused PID, and uncertain ownership
+refuse without replacement. Recovery rechecks the receipt before exclusive creation,
+then validates socket absence and flushes the disks before recording
+`recovered-unclean`. If those final checks fail, it reports
+`provider_home_restored_recovery_incomplete`, keeps the exact owned alias and retained
+data, and requires inspection before retry. No guest is started by alias recovery.
+Interrupted starts without a recorded process or both identified disks remain
+outside this repair path.
+
 Compatibility is qualified for specific bundle hashes and state formats. The
 displayed version alone does not establish frontend/executor or downgrade
 compatibility. V4 and candidate homes remain separate; this procedure does not
diff --git a/packages/runtime-core/src/provider/lifecycle.rs b/packages/runtime-core/src/provider/lifecycle.rs
index 60e7109d3..8b47b97b0 100644
--- a/packages/runtime-core/src/provider/lifecycle.rs
+++ b/packages/runtime-core/src/provider/lifecycle.rs
@@ -3,6 +3,7 @@ mod prepared_boot;
 #[cfg(any(target_os = "macos", test))]
 mod private_child;
 mod relay_process;
+mod short_home;
 use super::{
     admission, agent, artifact, identity, process,
     state::{self, Owner, io},
@@ -1812,6 +1813,12 @@ fn finish_absent(
     value: &str,
     record_disks: bool,
 ) -> Result<(), CandidateError> {
+    let vm_lock = lock_absent_disks(candidate, owner)?;
+    finish_absent_locked(candidate, owner, value, record_disks, &vm_lock)
+}
+
+/// Keep this descriptor through alias restoration and the stopped receipt.
+fn lock_absent_disks(candidate: &Candidate, owner: &Owner) -> Result<File, CandidateError> {
     let directory = owner.real_data_dir(candidate)?;
     let vm_lock = OpenOptions::new()
         .read(true)
@@ -1847,6 +1854,16 @@ fn finish_absent(
         ));
     }
     verify_disks(candidate, owner)?;
+    Ok(vm_lock)
+}
+
+fn finish_absent_locked(
+    candidate: &Candidate,
+    owner: &mut Owner,
+    value: &str,
+    record_disks: bool,
+    _vm_lock: &File,
+) -> Result<(), CandidateError> {
     if record_disks && owner.storage.is_none() {
         owner.storage = Some(identity::disk(
             &owner.real_data_dir(candidate)?.join("storage.raw"),
@@ -1896,7 +1913,13 @@ fn finish_absent(
 }
 
 pub fn recover(candidate: &Candidate) -> Result<RuntimeStatus, CandidateError> {
-    let initial = status(candidate)?;
+    let initial = match status(candidate) {
+        Ok(initial) => initial,
+        Err(error) if error.code == "provider_home_missing" => {
+            return short_home::recover(candidate);
+        }
+        Err(error) => return Err(error),
+    };
     if initial.phase == "uninitialized" {
         return Ok(initial);
     }
diff --git a/packages/runtime-core/src/provider/lifecycle/short_home.rs b/packages/runtime-core/src/provider/lifecycle/short_home.rs
new file mode 100644
index 000000000..6678ab602
--- /dev/null
+++ b/packages/runtime-core/src/provider/lifecycle/short_home.rs
@@ -0,0 +1,70 @@
+//! Explicit two-phase recovery of the receipt-bound temporary HOME after host cleanup.
+//!
+//! No provider is launched and no existing alias is replaced. Durable disks and VM absence
+//! are audited before restoring the short socket path; socket absence is then checked before
+//! committing the recovered phase. A later refusal retains the exact alias and unchanged data.
+use super::{
+    Owner, RuntimeStatus, binary, finish_absent_locked, identity, lock_absent_disks, root, state,
+    status, verify_disks,
+};
+use crate::{Candidate, CandidateError};
+
+fn dead_provider(candidate: &Candidate, owner: &Owner) -> Result<(), CandidateError> {
+    let process = owner.process.as_ref().ok_or_else(|| {
+        CandidateError::new(
+            "recovery_required",
+            "Missing HOME recovery requires a recorded provider identity; nothing was changed.",
+        )
+    })?;
+    // SAFETY: geteuid has no preconditions.
+    identity::verify(process, process, &binary(candidate), unsafe {
+        libc::geteuid()
+    })?;
+    if identity::alive(process.pid)? || identity::executable_running(&binary(candidate))? {
+        return Err(CandidateError::new(
+            "recovery_required",
+            "Missing HOME recovery requires a confirmed dead provider and no active provider command; nothing was changed.",
+        ));
+    }
+    if !owner.created || owner.storage.is_none() || owner.overlay.is_none() {
+        return Err(CandidateError::new(
+            "recovery_required",
+            "Missing HOME recovery requires both previously identified disks; nothing was adopted.",
+        ));
+    }
+    Ok(())
+}
+
+pub(super) fn recover(candidate: &Candidate) -> Result<RuntimeStatus, CandidateError> {
+    let _operation = state::Lock::acquire_existing(&root(candidate))?;
+    let mut owner = Owner::load_for_short_home_recovery(candidate)?;
+    dead_provider(candidate, &owner)?;
+    let vm_lock = lock_absent_disks(candidate, &owner)?;
+    // Recheck immediately before the only new external effect. The locks fence cooperative
+    // writers; no signal, disk adoption, overwrite or receipt update happens in this phase.
+    dead_provider(candidate, &owner)?;
+    verify_disks(candidate, &owner)?;
+    owner.restore_missing_short_home(candidate)?;
+    let mut finish = || -> Result<(), CandidateError> {
+        let observed = Owner::load(candidate)?;
+        if observed != owner {
+            return Err(CandidateError::new(
+                "foreign_state",
+                "Provider receipt changed after HOME restoration.",
+            ));
+        }
+        dead_provider(candidate, &owner)?;
+        verify_disks(candidate, &owner)?;
+        finish_absent_locked(candidate, &mut owner, "recovered-unclean", false, &vm_lock)
+    };
+    finish().map_err(|error| {
+        CandidateError::new(
+            "provider_home_restored_recovery_incomplete",
+            format!("Owned HOME alias restored; runtime recovery is incomplete ({}). Data retained; inspect and retry runtime recover.", error.code),
+        )
+    })?;
+    status(candidate)
+}
+
+#[cfg(all(test, target_os = "macos"))]
+mod tests;
diff --git a/packages/runtime-core/src/provider/lifecycle/short_home/tests.rs b/packages/runtime-core/src/provider/lifecycle/short_home/tests.rs
new file mode 100644
index 000000000..f22b62192
--- /dev/null
+++ b/packages/runtime-core/src/provider/lifecycle/short_home/tests.rs
@@ -0,0 +1,265 @@
+use super::*;
+use crate::provider::{NetworkIntent, Profile};
+use std::{
+    fs,
+    os::{
+        fd::AsRawFd,
+        unix::{fs::MetadataExt, net::UnixListener},
+    },
+    path::PathBuf,
+    process::Command,
+};
+
+struct Pool {
+    candidate: Candidate,
+    owner: Owner,
+    directory: PathBuf,
+}
+impl Pool {
+    fn new() -> Self {
+        let mut child = Command::new("/bin/sleep").arg("30").spawn().unwrap();
+        let mut process = identity::observe(child.id() as i32).unwrap();
+        child.kill().unwrap();
+        child.wait().unwrap();
+        let directory = fs::canonicalize(std::env::temp_dir())
+            .unwrap()
+            .join(format!(
+                "hack-home-recovery-{}-{}",
+                std::process::id(),
+                std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .unwrap()
+                    .as_nanos()
+            ));
+        state::private_directory(&directory).unwrap();
+        let candidate = Candidate::discover(&directory).unwrap();
+        let operation = state::Lock::acquire(&root(&candidate)).unwrap();
+        let mut owner = Owner::create(
+            &candidate,
+            Profile::Development,
+            None,
+            NetworkIntent::Isolated,
+        )
+        .unwrap();
+        let data = owner.real_data_dir(&candidate).unwrap();
+        state::private_directory(&data).unwrap();
+        for (name, tag) in [("storage.raw", 1u8), ("overlay.raw", 2)] {
+            let mut bytes = vec![0u8; 4096];
+            bytes[1080..1082].copy_from_slice(&[0x53, 0xef]);
+            bytes[1128..1144].fill(tag);
+            bytes[2048..2059].copy_from_slice(b"data-marker");
+            fs::write(data.join(name), bytes).unwrap();
+        }
+        fs::write(data.join("vm.lock"), b"").unwrap();
+        fs::write(data.join("name"), &owner.machine).unwrap();
+        process.executable = binary(&candidate);
+        owner.process = Some(process);
+        owner.created = true;
+        owner.phase = "running".into();
+        owner.storage = Some(identity::disk(&data.join("storage.raw")).unwrap());
+        owner.overlay = Some(identity::disk(&data.join("overlay.raw")).unwrap());
+        owner.save(&candidate).unwrap();
+        drop(operation);
+        Self {
+            candidate,
+            owner,
+            directory,
+        }
+    }
+    fn remove_alias(&self) {
+        fs::remove_file(&self.owner.short_home).unwrap();
+    }
+    fn receipt(&self) -> Vec<u8> {
+        fs::read(root(&self.candidate).join("owner.json")).unwrap()
+    }
+    fn data(&self) -> PathBuf {
+        self.owner.real_data_dir(&self.candidate).unwrap()
+    }
+    fn unchanged(&self, before: &[u8]) {
+        assert_eq!(self.receipt(), before);
+        assert!(self.owner.short_home.symlink_metadata().is_err());
+    }
+}
+impl Drop for Pool {
+    fn drop(&mut self) {
+        let _ = fs::remove_file(&self.owner.short_home);
+        fs::remove_dir_all(&self.directory).unwrap();
+    }
+}
+
+#[test]
+fn explicit_recovery_restores_only_missing_alias_and_preserves_disk_bytes() {
+    let pool = Pool::new();
+    let storage = fs::read(pool.data().join("storage.raw")).unwrap();
+    let overlay = fs::read(pool.data().join("overlay.raw")).unwrap();
+    pool.remove_alias();
+    assert_eq!(
+        status(&pool.candidate).unwrap_err().code,
+        "provider_home_missing"
+    );
+    let recovered = crate::provider::recover(&pool.candidate).unwrap();
+    assert_eq!(recovered.phase, "recovered-unclean");
+    assert_eq!(recovered.process_alive, Some(false));
+    assert_eq!(
+        fs::read_link(&pool.owner.short_home).unwrap(),
+        root(&pool.candidate).join("home")
+    );
+    assert_eq!(fs::read(pool.data().join("storage.raw")).unwrap(), storage);
+    assert_eq!(fs::read(pool.data().join("overlay.raw")).unwrap(), overlay);
+    assert_eq!(
+        Owner::load(&pool.candidate).unwrap().storage,
+        pool.owner.storage
+    );
+}
+
+#[test]
+fn live_or_reused_pid_and_missing_disk_identity_refuse_without_alias_effect() {
+    for case in 0..3 {
+        let mut pool = Pool::new();
+        if case < 2 {
+            let p = pool.owner.process.as_mut().unwrap();
+            p.pid = std::process::id() as i32;
+            p.start_micros = if case == 0 {
+                identity::observe(p.pid).unwrap().start_micros
+            } else {
+                1
+            };
+        } else {
+            pool.owner.overlay = None;
+        }
+        pool.owner.save(&pool.candidate).unwrap();
+        pool.remove_alias();
+        let before = pool.receipt();
+        assert_eq!(
+            crate::provider::recover(&pool.candidate).unwrap_err().code,
+            "recovery_required"
+        );
+        pool.unchanged(&before);
+    }
+}
+
+#[test]
+fn changed_disk_held_vm_lock_and_open_disk_refuse_before_alias_creation() {
+    for case in 0..3 {
+        let pool = Pool::new();
+        pool.remove_alias();
+        let before = pool.receipt();
+        let mut held = None;
+        if case == 0 {
+            fs::write(pool.data().join("overlay.raw"), b"changed disk").unwrap();
+        }
+        if case == 1 {
+            let f = fs::File::open(pool.data().join("vm.lock")).unwrap();
+            assert_eq!(
+                unsafe { libc::flock(f.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) },
+                0
+            );
+            held = Some(f);
+        }
+        if case == 2 {
+            held = Some(fs::File::open(pool.data().join("storage.raw")).unwrap());
+        }
+        assert!(crate::provider::recover(&pool.candidate).is_err());
+        pool.unchanged(&before);
+        drop(held);
+    }
+}
+
+#[test]
+fn existing_file_directory_and_foreign_symlink_are_never_replaced() {
+    for case in 0..3 {
+        let pool = Pool::new();
+        pool.remove_alias();
+        let before = pool.receipt();
+        if case == 0 {
+            fs::write(&pool.owner.short_home, b"foreign marker").unwrap();
+        }
+        if case == 1 {
+            fs::create_dir(&pool.owner.short_home).unwrap();
+        }
+        if case == 2 {
+            std::os::unix::fs::symlink(&pool.directory, &pool.owner.short_home).unwrap();
+        }
+        let inode = fs::symlink_metadata(&pool.owner.short_home).unwrap().ino();
+        assert_eq!(
+            crate::provider::recover(&pool.candidate).unwrap_err().code,
+            "foreign_state"
+        );
+        assert_eq!(pool.receipt(), before);
+        assert_eq!(
+            fs::symlink_metadata(&pool.owner.short_home).unwrap().ino(),
+            inode
+        );
+        if case == 1 {
+            fs::remove_dir(&pool.owner.short_home).unwrap();
+        }
+    }
+}
+
+#[test]
+fn active_socket_leaves_explicit_incomplete_recovery_then_retry_finishes() {
+    let pool = Pool::new();
+    let listener = UnixListener::bind(pool.owner.data_dir().join("agent.sock")).unwrap();
+    pool.remove_alias();
+    let before = pool.receipt();
+    let error = crate::provider::recover(&pool.candidate).unwrap_err();
+    assert_eq!(error.code, "provider_home_restored_recovery_incomplete");
+    assert!(error.message.contains("stop_uncertain"));
+    assert_eq!(pool.receipt(), before);
+    assert_eq!(
+        fs::read_link(&pool.owner.short_home).unwrap(),
+        root(&pool.candidate).join("home")
+    );
+    drop(listener);
+    assert_eq!(
+        crate::provider::recover(&pool.candidate).unwrap().phase,
+        "recovered-unclean"
+    );
+}
+
+#[test]
+fn receipt_change_and_concurrent_alias_creation_refuse_exclusive_repair() {
+    let mut pool = Pool::new();
+    pool.remove_alias();
+    let observed = Owner::load_for_short_home_recovery(&pool.candidate).unwrap();
+    pool.owner.phase = "stopped".into();
+    pool.owner.save(&pool.candidate).unwrap();
+    let before = pool.receipt();
+    assert_eq!(
+        observed
+            .restore_missing_short_home(&pool.candidate)
+            .unwrap_err()
+            .code,
+        "foreign_state"
+    );
+    pool.unchanged(&before);
+    std::os::unix::fs::symlink(root(&pool.candidate).join("home"), &pool.owner.short_home).unwrap();
+    let inode = fs::symlink_metadata(&pool.owner.short_home).unwrap().ino();
+    assert_eq!(
+        pool.owner
+            .restore_missing_short_home(&pool.candidate)
+            .unwrap_err()
+            .code,
+        "socket_alias_collision"
+    );
+    assert_eq!(
+        fs::symlink_metadata(&pool.owner.short_home).unwrap().ino(),
+        inode
+    );
+    assert_eq!(pool.receipt(), before);
+}
+
+#[test]
+fn pending_owner_update_is_preserved_and_refuses_alias_repair() {
+    let pool = Pool::new();
+    pool.remove_alias();
+    let before = pool.receipt();
+    let pending = root(&pool.candidate).join("owner.pending");
+    fs::write(&pending, b"interrupted update").unwrap();
+    assert_eq!(
+        crate::provider::recover(&pool.candidate).unwrap_err().code,
+        "recovery_required"
+    );
+    pool.unchanged(&before);
+    assert_eq!(fs::read(&pending).unwrap(), b"interrupted update");
+}
diff --git a/packages/runtime-core/src/provider/state.rs b/packages/runtime-core/src/provider/state.rs
index 7f3b1a81a..e8810dbe1 100644
--- a/packages/runtime-core/src/provider/state.rs
+++ b/packages/runtime-core/src/provider/state.rs
@@ -57,7 +57,6 @@ impl Lock {
     }
 
     /// Observe existing state without initializing a directory or lock file.
-    #[cfg(target_os = "macos")]
     pub fn acquire_existing(root: &Path) -> Result<Self, CandidateError> {
         check_private_directory(root)?;
         let file = OpenOptions::new()
@@ -177,7 +176,7 @@ impl Default for ReclamationPolicy {
     }
 }
 
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct Owner {
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -211,8 +210,34 @@ pub struct Owner {
 }
 impl Owner {
     pub fn load(candidate: &Candidate) -> Result<Self, CandidateError> {
+        Self::load_with_short_home(candidate, false)
+    }
+
+    /// Explicit recovery may inspect a missing temporary alias, never a replaced one.
+    /// Loading here is read-only; the lifecycle boundary still proves provider absence.
+    pub(super) fn load_for_short_home_recovery(
+        candidate: &Candidate,
+    ) -> Result<Self, CandidateError> {
+        Self::load_with_short_home(candidate, true)
+    }
+
+    fn load_with_short_home(
+        candidate: &Candidate,
+        allow_missing: bool,
+    ) -> Result<Self, CandidateError> {
         let root = candidate.state_root.join("run/smolvm");
         reject_aliased_state(&root)?;
+        if allow_missing {
+            match fs::symlink_metadata(root.join("owner.pending")) {
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                _ => {
+                    return Err(CandidateError::new(
+                        "recovery_required",
+                        "Provider owner update is pending or unobservable; HOME alias was not restored.",
+                    ));
+                }
+            }
+        }
         let owner: Self = read(&root.join("owner.json"))?;
         owner.network.validate()?;
         if let Some(share) = &owner.project_share {
@@ -250,20 +275,69 @@ impl Owner {
                 "Provider owner identity does not match this checkout.",
             ));
         }
-        // The only permitted alias is an exact, receipt-bound short HOME for Unix sockets.
-        let alias = fs::symlink_metadata(&owner.short_home).map_err(io)?;
+        owner.check_short_home(candidate, allow_missing)?;
+        check_private_directory(&root.join("home"))?;
+        Ok(owner)
+    }
+    /// The only permitted alias is the exact receipt-bound HOME for Unix sockets.
+    fn check_short_home(
+        &self,
+        candidate: &Candidate,
+        allow_missing: bool,
+    ) -> Result<(), CandidateError> {
+        let alias = match fs::symlink_metadata(&self.short_home) {
+            Ok(alias) => alias,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                return if allow_missing {
+                    Ok(())
+                } else {
+                    Err(CandidateError::new(
+                        "provider_home_missing",
+                        "Temporary provider HOME alias is absent. Use runtime recover to verify the stopped pool before restoring it.",
+                    ))
+                };
+            }
+            Err(error) => return Err(io(error)),
+        };
         if !alias.file_type().is_symlink()
             || alias.uid() != unsafe { libc::geteuid() }
-            || fs::read_link(&owner.short_home).map_err(io)? != root.join("home")
+            || fs::read_link(&self.short_home).map_err(io)?
+                != candidate.state_root.join("run/smolvm/home")
         {
             return Err(CandidateError::new(
                 "foreign_state",
                 "Short provider HOME alias was replaced.",
             ));
         }
-        check_private_directory(&root.join("home"))?;
-        Ok(owner)
+        Ok(())
     }
+
+    /// Called only while the lifecycle owns the pool and VM locks and has audited absence.
+    /// Recheck the durable selection, then create exclusively; a concurrent alias is retained.
+    pub(super) fn restore_missing_short_home(
+        &self,
+        candidate: &Candidate,
+    ) -> Result<(), CandidateError> {
+        let observed = Self::load_for_short_home_recovery(candidate)?;
+        if observed != *self {
+            return Err(CandidateError::new(
+                "foreign_state",
+                "Provider owner changed during HOME recovery; no alias was restored.",
+            ));
+        }
+        std::os::unix::fs::symlink(
+            candidate.state_root.join("run/smolvm/home"),
+            &self.short_home,
+        )
+        .map_err(|_| {
+            CandidateError::new(
+                "socket_alias_collision",
+                "Cannot exclusively restore provider HOME alias; no existing path was replaced.",
+            )
+        })?;
+        self.check_short_home(candidate, false)
+    }
+
     #[cfg(all(test, target_os = "macos"))]
     pub fn create(
         candidate: &Candidate,