Third slice: NMRNet++ through the normal NMR API provider workflow

Dated design and evidence record. Selected design and evidence quotations retain their source line anchors and historical identities; use the current guides for operation.

Third slice: NMRNet++ through the normal NMR API provider workflow
Date: 2026-10-18
Author: repository coordinator
Status: 003 complete within the locally qualified scope below. R53 delivered both SDF ZIP records/eight C shifts through one actual API Job; R54 observed all four real-interpreter ambiguity decisions and all three MOL/PDB/MOL2 choices. Evidence and scientific-guide/API handoff are retained. Browser submission is not a qualification gate under the user's correction. Scientific, deployment and operating limits below remain explicit.

Completion audit, 2026-10-23 (API source154be58; interpreter sourcee211390; R54)
================================================================
This active list supersedes older open-ended status wording, while preserving
original outcomes, failed exits and scope. It grants no new external effects.

Required product outcomes
--------------------------
1. SATISFIED: the authorized two-record SDF ZIP API outcome. The user explicitly
   corrected "GUI is not SUT here"; no browser-submission prerequisite remains.
   R53's maintained provider/qualify/api/real-sdf-zip uses the signed API client
   and reuses R46's UXc3mVpW native result/R48's member request-hash joins. Its
   first actual run reserved one Upload, then received502 on the original PUT.
   The user then authorized a service-only restart and original-Upload recovery.
   The live storage owner confirmed absent bytes before renewed capability/PUT;
   the same Upload finalized and one API Job succeeded. All eight carbon shifts,
   ordered source records and scientific facts equal R46 exactly; all original
   native/host work retired and terminal evidence is archived. No duplicate
   reservation/Job or paid rerun occurred. Full IDs and hashes appear in R53.
   Existing R24/R25/R28/R32 API paths and R44 GUI readback retain their own scope.
2. SATISFIED: real semantic decisions for ambiguous/unsupported input. R24/R25/R28 already
   show the selected real endpoint on three valid API routes; R32 covers N>1;
   R24 includes genuine correction. R45/R49's interpreter_ambiguity.json four-case
   batch now passed4/4 against the real selected endpoint: absent units/count/
   record and unsupported input, with zero preparation attempts/corrections.
   R54 records the newly authorized run; no Jobs/science were supplied.
   R53 adds real multi-geometry
   Upload selection. Passing proves these decisions, not universal understanding.
   Real MOL/PDB/MOL2 argument choice now passed3/3 inR54, using the authored
   normative/atom_order_v2000.mol, models.pdb and mixed_records.mol2 metadata,
   requested units/order and existing reader-option admission. No parser or
   scientific effects were invoked. Compose these observations with the existing
   actual reader/science/acquisition proofs; no new full matrix is required.
3. SATISFIED: actual outcomes and compact source/runtime/scientific receipts are
   retained inR53/R54; current notes and scientific guide reflect their scope.
   docs/index.html is the scientific entry; docs/provider.md owns operation.
   stage_api_config.py already wires the guide into the description/Hello path;
   R53's actual API provider directory response contains that guide URL in
   provider_description; R54 retains its exact bytes/hash without another Job.
   The observed stale native-history warning was fixed at its owner in087a090.
   These outcomes close003's current scope, not remote deployment or universal
   semantic/accuracy claims. Original failures and historical proposals remain.

Existing owner/composition proof sufficient within recorded limits
------------------------------------------------------------------
- Science: R13b/lNCAQMBR covers137 outputs/64 independent positions at zero
  tolerance; R15b/A2nFXFz6 covers real128-atom H/C capacity and per-role resources.
  R24/R25/R28/R32 cover actual API paths and supplied/generated N1/N3 identity.
  No affected scientific code/oracle changed in R50: reuse these observations.
- Formats: R37/provider-native-formats.QFIJkrxt retains nine native cases,
  15 geometries/54 finite H/C rows and contained receipt review. Both original
  host exits stay failed. R46 adds the carbon-only SDF; R47/R48 qualify ZIP/member
  handling and exact request correspondence. Deterministic readers own atoms,
  units and record order. No paid per-format matrix is required merely to repeat
  those checks; R54 separately observes real MOL/PDB/MOL2 argument choice.
- Repeated use: R36/R40 connect three Jobs, lost terminal ACK and production
  stopped recovery with recording science. R39 separately covers installed
  inspection/replay/idle restart. Native R13b/R15b/R37/R46 cover exact replay
  without new science. This owner composition suffices; it is not a deployed
  multi-Job/native-crash experiment, and does not require buying that combination.
- Failures/recipients: R41/R42 cover input deadlines and phase/current-condition
  recovery; R43 covers bounded prediction replacement and synthetic cgroup OOM.
  Note018 records receiving error/cancellation/cleanup and permission proofs;
  note019 supersedes its old file sink with qualified bounded Docker logs.
  Configured service failure receipts cover requester guidance. Add one focused
  proof for an actual missing causal link, not every fault/route/model combination.

Limits and separate open operating work
---------------------------------------
R35 covers default4/selected1..17 digits and exact private evidence offline.
GUI fixtures request17 for exact comparison; no extra paid default/other-digit
gate is required solely because an old note says live precision is unqualified.
R24 already supplies real correction; do not manufacture another repair.
Generated-geometry accuracy, five-fold ensemble/GPU results and actual released-
model OOM retry equivalence are not established by the narrower evidence above.

R52 supersedes note017/9b89802's design-only storage status. Native sequence/
release and required finite confirmed history now have focused owner/service and
installed-runtime proof. They bound healthy operation; no physical disk quota,
power-loss guarantee or indefinite failure-free service is claimed. Existing
excess/malformed history and uncertain cleanup still require explicit inspection,
not automatic migration or deletion. Scientific capsules remain intact. Use the
refreshed controller and freshly staged required retention configuration for the
next reviewed API run; do not reuse R48's old image/configuration as current.
Remote/HA deployment, ensemble/training/GPU work and CI remain outside this slice.

R53: API SDF ZIP submission, authorized scope (2026-10-23)
---------------------------------------------------------
The user's correction, "GUI is not SUT here. Let the worker create the job via
API", replaces the browser-submission requirement above for this provider
qualification. Existing GUI readback remains a separate claim; three new browser
submissions are not a closure gate. Other selected-model ambiguity/format batches
remain separately unapproved.

Maintained target provider/qualify/api/real-sdf-zip reuses api_prediction.py's
installed NMR API signing/canonicalization/Upload owners and the normal provider
launcher. It creates one Upload, publishes its bytes once, finalizes it, creates
one closed Job, attaches the Upload, selects the provider and opens that Job.
Uncertain effects retain original identities and never trigger resubmission.
The existing gui_sdf.json instruction is shared; its filename does not imply a
browser produced this API request. Only the necessary API source files are
captured from committed Git blobs. Readback/process/host budgets are900/1200/1220s.

Source: normative/butane_conformers.sdf,1010 bytes, SHA256
  c8007f5a1a80ad080bb972caf005bbb4fedcd5a9bd15b892e1b640d2f01e4374
The client produces one deterministic ZIP_STORED member with a fixed DOS epoch;
it pins that original SDF and the R46 result before any API request. The actual
published ZIP hash/length comes from the signed finalized Upload and is compared
separately from the member hash/length. No existing reference is regenerated.
R46 scientific-result.json SHA256:
  bd5adb6f47ac7b5b739ae4c52ce36d308195bae56b6233c0d07e22918227a3a3
Exact retained path: .work/qualification/provider-service-nmrnet-native-service-
UXc3mVpW/formats/sdf-carbon-only/scientific-result.json (one joined path).
R48 and gui_science.mjs::compareSubmittedScience supply the reviewed source/
archive and ordered scientific comparison contract. Both records preserve four
supplied C atoms, no generated atoms/coordinates and eight C predictions total;
selected models, native runtime/image, request hashes, binary32 coordinates,
preparation, coverage and predictions must equal the retained reference exactly.
This proves repeatability/composition, not independent chemical-shift accuracy.

The authorized model is openai-gpt-5-6-luna at api.openai.com/v1/chat/completions,
model gpt-5.6-luna, reasoning_effort none, max6turns/Attempt. The API may schedule
a replacement Attempt; the client must not create another Job. No other model
batch, browser run, deployment or scientific matrix is authorized here.

Focused offline qualification: signed client34/0.697s, staging/composition15/
3.650s, Ruff0.15.15, bash syntax and diff whitespace pass. Refusal witnesses
cover altered source before API dispatch, missing/reordered/changed records,
wrong member/outer archive/Upload attribution, one PUT and one opened Job, and
the exact time profile and source mounts. The synthetic fixture does not claim
accuracy. Independent scientific and launcher review found no further mismatch
after removing the unrelated GUI input dependency. Actual run evidence follows
only after observation; this section alone establishes no new API/model result.

Active roadmap: useful, reproducible NMR predictions, 2026-10-23
================================================================
The repository has two connected aims: reproduce NMRNet++ H/C chemical-shift
prediction faithfully, and make it usable through the normal NMR API workflow.
Success means a commissioner submits molecular input and an analysis receiver
obtains understandable per-atom predictions with enough provenance to assess and
reproduce them. Containment, provider-core, launchers and checks support that
transaction. Their individual completion is not the product milestone.

This roadmap supersedes the earlier sequence in the 2026-10-20 chat and the
initial "Implementation slices and acceptance" section at c0bb2eb. It changes
sequencing, not the required scientific, containment, error or recovery contracts.
The dated implementation entries below retain their original evidence and limits.
The user resumed implementation after this roadmap revision on 2026-10-21.
The earlier pause remains a historical checkpoint; R24/R25/R28/R32 now update the
starting point. The current gates above adjudicate which remaining outcomes need
new observations and which are sufficiently covered by existing owner evidence.

Starting point
--------------
Native local witnesses already cover supplied coordinates, verified Uploads and
SMILES conformer generation; the four-reference population and real 128-atom
capacity have separate retained evidence (R13b/R15b below). The foreground caller
and installed startup helper were committed at c0bb2eb with focused checks. The
controller refresh and first actual API transaction through the complete foreground
caller were qualified with scripted interpretation (R21). The selected OpenAI
endpoint has since delivered all three input routes through the actual API:
pasted coordinates with one correction/two turns (R24), generated CCl/N1 in one
uncorrected turn (R25), and attached XYZ after inspection in two uncorrected turns
(R28). R32 adds the representative CCCC/N3 case in one uncorrected turn, with
three separately attributed geometries and successful normal shutdown. Pasted/
Upload native inputs and predictions match the pinned numerical oracle; generated
N1/N3 establish observed provenance/coverage without an
independent numerical reference. R28's overall target failed on cancellation of
a local liveness observer, despite confirmed exact retirement of all containers.
R36 adds configured successive Jobs and exact stopped-store recovery before a
third Job; R37 has native results for nine supplied-format cases, with both host
target failures retained. R39 qualifies installed operator inspection, exact
terminal replay and ordinary idle restart against synthetic local TLS, without
new science. R40 joins service-produced outcomes to the production stopped
inspection/recovery functions and subsequent Job, using recording science.
R44 now qualifies existing-result readback/download through the actual local GUI
for pasted coordinates, generated N1/N3 and XYZ Upload. It creates no new Jobs and
does not qualify GUI submission, additional real-model multi-geometry Upload/
format/ambiguity coverage, the broader connected fault matrix or final handoff.
Do not rebuild scientific machinery or present completed foundations as new work.

1. Deliver one prediction through the actual API.
   Qualified locally in R21 and with the real endpoint in R24/R25/R28/R32.
   The requirements below remain the repeatable transaction contract, not a claim
   that 003 is closed.
   Use one existing supplied-geometry fixture and the released prediction models.
   The path is: discover/select the offering, submit an authenticated Job, read
   the supplied geometry, predict H/C shifts, publish, and read back the result
   through the actual API. Use the installed foreground service entrypoint.
   Compare delivered atom indices and shifts with the applicable existing fixture
   evidence. Retain the exact executed geometries, selected model/scaler identities
   and runtime facts with the result. Scientific correspondence is part of this
   first transaction and remains required in every later milestone.

   Refresh the controller image for launch_capture and run its focused installed
   checks. Fix the startup, routing, permission, shutdown or diagnostic defects
   that prevent this transaction or violate its existing safety contracts. Verify
   actual grants while exercising that same run. Reuse the API's existing contained
   environment and identity workflow; this authorizes no sibling source changes.
   A short scripted-model/local-peer smoke run may establish the connections first;
   identify it as such. It does not close actual API or real interpretation proof.

   Identify API access, signing authority, endpoint/model, trust, explicit network
   interface and GUI prerequisites upfront. Missing external access is a named
   blocker to that qualification, while useful contained work can continue. Never
   invent credentials, endpoints, paid-call authority or deployment success.
   Exit: one submitted Job yields a scientifically traceable result through the
   actual API, with confirmed native cleanup and preserved input/result evidence.
   Record whether interpretation was scripted or real and whether GUI readback
   was exercised; remaining parts stay explicit for milestones 2 and 4.

2. Make the three agreed requests work with the real interpreter.
   Qualify the selected real endpoint early, as soon as its explicit prerequisites
   are available. The required requests are SMILES + conformer count N, pasted
   coordinates for one conformer, and an Upload with instructions. Include SMILES
   N > 1 and a multi-geometry Upload. Carry each request through prediction and
   receiver readback, using the existing API and scientific owners.

   Reuse the existing XYZ/MOL/SDF/PDB/MOL2 fixtures to finish declared file-format
   coverage. Preserve supplied atoms/order, selected records and explicit units;
   distinguish estimated RDKit geometries from supplied ones and record generated
   H/parent correspondence. Do not check uploaded records for molecular equivalence.
   Exercise real ambiguity and correction: unclear units/count/record selection,
   unsupported input and model-reported problems. Check that interpretation follows
   the request; deterministic validation alone cannot establish that fact. Model-
   supplied pasted/SMILES text must remain honestly attributed, not described as
   byte-exact extraction from the original Job. Never silently repair chemistry.
   Exit: a commissioner can use every advertised route and format, or receive
   useful guidance, and the receiver can identify each geometry and predicted atom.
   A model-authored result explanation remains attributed and qualified as such.

3. Make repeated use and interrupted work reliable.
   Exercise the same service over successive Jobs, graceful stop and restart.
   Cover capacity exhaustion, cancellation, interpreter/source outages, failure
   after partial H/C computation, lost API acknowledgements and storage/cleanup
   faults at the owners actually used by this workflow. Reuse existing fault
   witnesses; add only missing connected behavior. Publish all-or-nothing results.
   Prove exact retained-outcome replay without repeating successful interpretation,
   geometry generation or prediction. Confirm unresolved ownership blocks unsafe
   replacement and that forced stop cannot appear as a clean completed analysis.

   Complete the operator's stopped inspection/archive/restart procedure, keeping
   configuration, durable Attempt state and useful evidence. Verify the actual
   caller's private creation, mounted permissions and explicit sole network routes.
   Safe errors must reach commissioner, receiver and operator through the channels
   they use, including protected retained diagnostics outside a terminal; secrets
   must not propagate. Preserve operation, delivery uncertainty and cleanup causes.
   Exit: another Job and a restart are supported without orphaned work, duplicate
   science, hidden errors or unexplained operator intervention.

4. Hand over a reproducible offering and close 003.
   R44 qualifies the existing-result receiving surface for all three routes,
   including generated N3; actual GUI submission and remaining requirements below
   stay open. The running dev GUI reports no source commit; this is an observed
   receiving witness, not attestation of a deployed GUI source revision.
   Finish actual GUI submission/readback for all three routes, using the final
   admitted service and real interpreter. Confirm that recipients see atom and
   geometry correspondence, ppm units, warnings, provenance and relevant limits.
   Put copyable requests and the tested install/start/stop/recovery steps in the
   README. Lead with what the service does, what users supply and what they receive;
   implementation history stays in notes. Offering text must match delivered
   behavior and the existing API's bounds, with a usable guide link.

   Consolidate the scientific evidence from the delivered paths: exact input and
   output populations, producer transformations, selected artifacts and observed
   runtime. Reuse the four-reference/128-atom evidence where its scientific code,
   inputs, artifacts, runtime and enforced limits remain applicable. Repeat only
   affected qualifications; never regenerate expected values or tune tolerances.
   The qualified scientific configuration uses CPU float32 selected fold-0 H/C
   checkpoints. The offering must not claim the paper's five-fold ensemble accuracy.
   Return separate predictions per geometry; do not invent conformer averaging,
   confidence or experimental data.
   Preserve rights-appropriate inputs, methods, raw observations and precise
   source/runtime/model/prompt/config identities; publish no secrets or raw chats.
   Exit: a fresh operator can reproduce the supported workflow, and every 003
   obligation is either evidenced or explicitly open. An open required gate means
   003 remains open; local TLS alone never establishes deployed API/GUI completion.

How to execute this roadmap
---------------------------
R29 qualifies the foreground observation-race correction offline; R32 passes
normal shutdown without a live race injection. R28's original target exit2 remains.
R35 implements per-Job interpreter-selected output precision offline. Reuse that
proof; the next GUI fixtures select17 without requiring another paid default/
other-digit case. R36/R37/R39/R40 and R41-R43 supply the bounded repeated-use,
native-format, local operator and reviewed failure-owner evidence. Required real
semantic/GUI outcomes and optional proof limits are distinguished above. The
selected real-model ambiguity batch awaits explicit approval.
Treat each supporting fix as part of those outcomes and qualify it at its owner.
Do not put an exhaustive new platform-hardening campaign ahead of them; required admission,
image, credential, explicit-interface, isolation and exact-cleanup gates still apply.
Reuse the independent failure/recovery cases in milestone3; add a focused proof
only for a concrete uncovered causal gap. Arrange real API/model/GUI prerequisites alongside local work so
their absence becomes visible early rather than at final handoff.

Use tests-first coherent slices, focused contained checks and the recorded U/A
and ordinary code reviews. Batch validation of one coherent boundary; recheck it
when changes or findings justify it. Record evidence at each milestone, then
commit reviewed explicit paths. No host Python/RDKit, upstream/sibling edits,
optional package extraction, new generic framework, training, ensemble/GPU work
or standalone public prediction CLI. CI remains deferred. Preserve reproducibility
and rationale with compact reviewed evidence; raw scratch stays private/ignored
and is retained only while its purpose requires it.

Direct input tools and terminal selection: superseding correction, 2026-10-20
==========================================================================
User direction replaces the former byte-span and prepared-reference conversation:
prepare_pasted(source_text, source_format=table|xyz, source_unit),
prepare_smiles(smiles, requested_count), and prepare_upload with the existing
verified Upload reference/options. Pasted and SMILES text becomes bounded,
immutable UTF-8 bytes before worker allocation; existing deterministic readers
and the native generator own parsing, units, atoms and conformer admission.
No offsets, line selectors, substring verification or opaque token echo remain.
Successful preparation terminally selects input in that model turn. Expected
input rejection permits correction in the SAME bounded conversation; operational,
grant, digest, budget and cleanup failures retain their operational owners.

Job ref/fingerprint binds received argument bytes and their digest/provenance to
the Attempt. This is interpreter-supplied text, not verified exact extraction from
the Job or proof of faithful transcription. Reader positions refer to received
source_text. Uploads retain their distinct authenticated original-byte identity.
Native source digests/counts, generated H/parent mapping, supplied atom order,
conversion oracles and internal PreparedAnalysis identity remain exact. Source
and interpreter retirement still precede candidate handoff; durable execution
entry still precedes shift inference. There is no extra submit call or stale
model-reference registry. Normal pasted/SMILES requires one model exchange;
Upload inspection plus preparation requires two. Corrections add turns; no
successful preparation is repeated to confirm an opaque reference.

Precedents and adaptation rationale (user-requested; inspected in sibling source):
- magnet-deploy 600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf,
  models/g_01_nmr_forward/provider/magnet_provider_bindings/g_01_nmr_forward/processor.py,
  submit_interpretation_value_schema / InterpretationCapability.construct_interpretation;
  prompts/interpreter.md: direct SMILES/solvent values rather than source offsets.
- nmrpeak-repro 1697dc84dd1d76ae25b04efc8183fd80614000e5,
  nmrpeak_provider/interpreter.py::_dispatch and
  input_interpreter.py::InputInterpreter._validate_freeform_input: admit the actual
  value and return the candidate; expected rejection resumes correction.
- secs-repro 7356c354368f2355d3ab5cef00cf48c67cea9c2c,
  src/secs_inference/provider/interpreter.py::InterpretationSession.select/reject:
  separate semantic selection from deterministic admission. No formula policy is
  imported. Reuse existing ToolFinished rather than add a conversation framework.

Earlier dated span/reference implementation and R4-R12 receipt entries are
historical evidence for their recorded source revisions, not proof of this new
contract. Scripted model replies establish plumbing, bounded correction and
effect counts; real-model semantic interpretation remains unqualified. Full 003
continues, including the connected reference population/capacity work and the
separately blocked external-model/API/GUI qualifications.

Focused validation for this replacement: interpreter 17 passed; pasted 7 passed;
SMILES 36 tests (one native-only skip); Upload/preparation 13 tests (one native-only
skip); lifecycle helpers 15 tests (three native-only skips); configured runtime
10 passed; service 20 passed; generated-result unit contracts 11 passed. All ran
offline in contained lanes; changed Python files passed focused Ruff. The Upload
fixture exposed a preexisting missing Nmr-Api-Topology header before preparation;
it now uses the existing api_tls_peer, preserving production admission. Independent
ownership/cancellation and caller/scientific-proof reviews converged with no new
actionable signal after correction. Native service receipts for the new contract
must be refreshed separately; prior receipts retain their original meaning.

Correctable Upload input refusals, 2026-10-20
--------------------------------------------
JobUploads raises UploadInputRejected only before any grant for missing inspection,
an unknown inspected member, changed inspected membership, or a selected file
above the fixed per_source_bytes ceiling. The last is known unsupported input,
not provider malfunction. The interpreter converts this owner-typed refusal to
safe feedback in the same conversation, requiring explicit reinspection after
snapshot invalidation. No UploadFailed-wide catch or exception text classifier.
Grant issuance, byte/digest verification, exhausted remaining cumulative bytes,
requests/deadline, and unconfirmed resource cleanup stay operational. Existing
accounting, deadline and possible-grant evidence are preserved; no retry resets it.

Scientific/workflow precedent: secs-repro at
7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/source_access.py::SourceAccess._read_stream,
lines 160-170, distinguishes fixed max_member_bytes InputReadError from cumulative
ScopeLimitError. This supports the input-versus-spent-budget distinction only;
our authenticated Job membership/grant/verification owners remain in place.
Focused make test/unit/provider-core/uploads covers exact file ceiling, one byte
over without a grant, cumulative accounting and the existing operational cases.
Configured TLS witnesses cover all three membership corrections before one grant
and native allocation, plus grant/digest/request-budget stop controls. A fourth
TLS case corrects an oversized attached member to an exact-limit member. Spent
budgets dominate simultaneous input refusal, including a membership refresh
which spends the last request; explicit repair cannot revive exhausted work.
The focused acquisition lane passes 18 tests; configured runtime passes 12 tests
including these four correction cases. Changed Python files pass Ruff; the new
hierarchical Make target uses the existing offline installed-package runner.
These use
scripted model replies and recording science; no real semantic-model claim.

Actionable interpreter reports to the requester, 2026-10-20
--------------------------------------------------------
report_input_problem now requires an admitted issue choice and a separate private
message. The binding owns public guidance for source_unit_unclear,
conformer_count_unclear and record_selection_unclear, with other_input_problem
for an attributed general report. Unknown choices invite correction without
echoing their text or silently becoming a general report. Message bounds and
known-secret redaction remain; no freeform model report enters public failure
text. Public guidance explicitly says the interpreter could not determine the
input and that its report is not independently verified. Evidence retains the
issue and the full bounded, redacted explanation, not an invented diagnosis.

Tests-first: the four-issue actual signed-TLS service recipient witness failed
before the closed report contract, then passed after implementation. It checks
durable exact FAIL bytes before recipient acknowledgement, closed workers,
confirmed exact receipt, safe actionable public text, protected full canary report,
and no acquisition/science. An unknown-code correction witness checks safe feedback
in the same bounded conversation and no freeform echo. Focused interpreter passes
18 tests; focused service passes 20 tests. These prove plumbing and recipient
delivery locally, not real-model semantic judgment or deployed API/GUI rendering.

R14: native service refresh after direct-input correction, 2026-10-20
-----------------------------------------------------------------
At f01e52d0e91b7afd23af7465bc27da38aaa8b9e1 all three fixed
test/integration/provider-service/{uploads,pasted,smiles} lanes passed sequentially
using existing local pinned images/artifacts and unchanged scientific oracles.
Actual result observations show Upload inspect_uploads+prepare_upload in two
model turns, pasted prepare_pasted in one, SMILES prepare_smiles in one. Each has
one scientific execution, both exact native retirements confirmed, and exact
terminal replay after reopening with no new model/science. Pasted retains its
independent binary64 conversion bound; supplied atoms and generated H/parent,
conformer/source/request/artifact/runtime identities remain checked by the route
owners. These are scripted local TLS peers, not external/deployed qualification.

Private receipts under .work/qualification/provider-service-nmrnet-native-service-:
uploads TMRiIqjV:
  summary 04e5a1ade907e5e6e025d46ae1777fc26a2b8ffa746e78c85b245c232ca1e1c3
  result  9b3afaac5efa67ba2ac4ec30d7e388dc7eb3162594559baaaace231976f05ab2
  sources 6d5eb736c8a9b2f2753712e414ac33b0e7325312686efe1b4ce73ea65f636d8a
pasted wMwkAIMq:
  summary 2b6edadbe832014785149e7d0ffc1ec73d3d8bb24bedc57c78451e0de7ba285c
  result  9ae5017c42af5c5691554eb3ff6dced7895c6a00ab177975d8aa15ae0c58f59a
  sources a401fdccd06005266c5f13fab3f9037c62b8f6944e79b0f606560df2cf114a54
smiles P3INGwm9:
  summary 44e72ddc5a8a5295d1b60fed9bf40dfaa371c692de0e8e0abf4dd118eab1d990
  result  2a0fd6718ecb1adf9c1b6c128292dfc2c3e4ffac5e3ef8e0ad0cd685caa112dd
  sources 2935474b6cc91faa71ed7aadef314fdf711e9d463f1bff8f820311ecf87799d7
Compact successful receipts retain the result/source closure, exact host/container
posture and retirement evidence; disposable credentials/transcripts/journals are
not promoted. Earlier R4-R12 records remain evidence for their own source revisions.
Full 003 continues with four-reference/population, real capacity/overhead and the
other explicit local/external exits.

R13a: exact private reference-input groundwork, 2026-10-20
-------------------------------------------------------
tests/integration/provider_core/reference_fixtures.py exports input XYZ plus a
private manifest, never regenerated prediction expectations. The renderer retains
original producer/raw-record identities and original request identities. The pure
XYZ reader emits compact JSON; reconstruct the historical default JSON encoding
only to compare its original byte identity, without equating it to executed bytes.
Round-trip checks preserve binary64 values, atom order, record IDs and source lines.
Pinned packet identities are the existing reference-cpu-float32.json and
prediction-cpu-float32.json SHA256 values, not a new numerical oracle.

The structured normative/adversarial tests call the original-input join and show:
literal independent original JSON differs in bytes/hash from executed compact JSON
while values match; producer element/key/raw SHA changes reject; a self-consistent
XYZ/request/manifest-hash substitution passes local round-trip but fails the
previously qualified request identity. Duplicate producers and atom/nucleus keys
also reject. Focused contained lifecycle lane: 17 tests, three native-only skips;
changed files pass Ruff. This is input binding and population-key groundwork,
not the connected four-reference/137-prediction/historical64 qualification yet.
The private producer container and existing Upload service composition are next.

R13b: connected four-reference service lane, 2026-10-20
----------------------------------------------------
The fixed test/integration/provider-service/references target reuses the existing
ProviderService/native factory/Upload lifecycle and scientific assertion owners.
Supplied record selection is fixture data; its existing source, conversion,
prepared/executed identity, artifact/runtime, retirement and replay joins remain.
The only new source is a qualification-only private XYZ exported from the exact
four retained validation records. It is not a new production route or scheduler.

The existing host qualifier owns the decoder's exact CID, admitted 1 GiB/no-swap,
2 CPU/64 PID/offline/nonroot/read-only profile, wait-zero and exact retirement.
It grants only the five required prepared files, pinned reference declaration and
source; no checkpoint weights, API/store credentials or native IPC. The controller
receives private output read-only only after that producer is stopped/removed.
Decoder reuse: tests/test_prediction_release.py::reference_requests at 3bd6114;
its exact prepared receipt, keys, raw records and restricted decoder are retained.
Producer-observed source hashes are joined to the independent host manifest and
admitted image/upstream/revision, rather than merely copied into a report.

ReferenceServiceLifecycle compares all 137 predictions (82 H, 55 C), keyed by
source dataset element/key plus predicted nucleus/atom. It independently derives
42 H and 22 C original positions from reference-cpu-float32.json, checks that exact
64-key mask against prediction-cpu-float32.json's real_model_callable population,
then compares values exactly. ATOL=RTOL=0. Original request hashes remain separate
from executed compact-reader JSON hashes. Altered shifts, atom/nucleus keys,
producers and omitted rows fail the same comparison without another execution.
Authored unit populations additionally challenge extra rows and historical
value/mask substitutions; they are labelled synthetic, not real-model evidence.

Focused contained lifecycle: 19 tests, three native-only skips. Two affected
launcher tests pass; changed Python files pass Ruff; host shell syntax passes.
Independent reviews converged after correcting launcher coverage, producer-source
closure and retirement-diagnostic propagation. Native reference execution is the
next evidence gate; this entry does not yet claim its success, capacity or overhead.

R13b native result: passed, 2026-10-20
-----------------------------------
The fixed references lane passed at parent c294dca, with the exact mounted-source
closure below and one correction: the producer's explicit PYTHONPATH must preserve
the image-owned /opt/nmrnet root (containers/inference/Dockerfile:8), just as
baseline.sh inherits it. An initial run omitted it and stopped in decoder import;
wait recorded exit 1, exact producer retirement confirmed and no controller was
created. The correction adds no mount/dependency or upstream edit. Protected
failure evidence remains in private nmrnet-native-service-TG9pnYji scratch.

Successful private receipt:
.work/qualification/provider-service-nmrnet-native-service-lNCAQMBR
  summary  ac163b7e5a210b126218bff7458d1fe65c4a17da3d7f98faf40feb3a7a9bef29
  result   b81736bf2d20a7caafd28c803cd8881cc707b234595ca46df3674b02d95a7240
  sources  bc92b7ba203741573e862f5d92351c823c69194032c6b7ac787bded8f801fd2b
  manifest d8762cf72e329f5d94374287ef5df704e3b29bdf1f449dba8d296cb6d027fa14

Observed complete population: 137 (82 H/55 C); independent historical population:
64 (42 H/22 C); ATOL=RTOL=0. All five in-memory causal controls refused. One actual
scientific execution, two model turns, exact reader/prediction retirement and
terminal replay after reopening without another execution. Original producer/raw
record/default-JSON and executed compact-JSON identities are preserved separately.
Private producer resources: memory.peak 293543936 bytes, memory.max 1073741824,
cpu.max 200000/100000, swap.max 0, pids.max 64. This measures the decoder only;
connected 128-atom capacity and full service/worker process overhead remain next.
Independent code/authority reviews sustained no further actionable signal after
the import-root correction. No expected packet or tolerance was changed.

R15a: bounded resource observations before capacity qualification, 2026-10-20
----------------------------------------------------------------------------
worker_main now writes a completed resources.json through its existing diagnostic
grant after handler/listener teardown, including setup or listener failure. The
existing primary exception survives; a second capture failure is retained with it.
The shared stdlib-only tools/container_resources.py reads six fixed cgroup v2
files with a 4096-byte per-file ceiling and no unavailable-value fallback. Each
report joins allocation/role and explicitly means cgroup_through_final_snapshot.
memory.peak covers that container through sampling, not exit, science success,
or a measured simultaneous sum across containers. No extra protocol or registry.

The ordinary host retirement request offers an elapsed one-second observation
budget; emergency and late-create retirement never wait for it. After exact
container removal and IPC release, only a bounded regular non-symlink completed
report is linked into the existing controller-readable receipt grant, before the
retired receipt. Missing/invalid evidence cannot prevent retirement. A retention
failure preserves diagnostics and marks actual retirement before returning the
error; retry cannot repeat native removal. Capacity qualification must separately
require and validate these observations; this slice alone proves no capacity.

Focused contained validation: 13 kernel/listener tests and 22 allocation tests
passed; Ruff format/check and shell syntax passed. Added witnesses include exact
kernel facts, missing/oversized files, real reader teardown, paired failures,
stale report refusal, bounded normal grace despite a delayed poll, emergency
bypass, symlink/oversize exclusion and failed retention without repeat removal.
Independent source/ownership/proof reviews corrected polling-count-only timing
to an elapsed deadline and otherwise sustained no actionable signal. Next: the
connected H128/C128 fixture and controller/producer/native resource receipt joins.

R15b: connected 128-atom capacity and resource proof, 2026-10-20
-------------------------------------------------------------
The fixed make test/integration/provider-service/capacity lane reuses the earlier
producer, existing Upload/service/factory lifecycle and supplied scientific joins.
Its synthetic H128/C128 recipe is test_prediction_release.py::assert_synthetic_capacity
at 3bd6114. Both original input requests are checked independently against that
fixed recipe. Every supplied atom/coordinate/order/source/request identity, 128
indices per nucleus, finite output and only required head remains checked by
SuppliedLifecycle; no new expected shifts or chemical accuracy claim. The existing
002 tensor proof establishes 128->130->136; this lane observes service input/output
capacity, not a second tensor trace. Capacity gets no prepared LMDB/pickle/reference
packet grants and no new dependency or scientific implementation.

Private resource evidence joins each native role/allocation only after exact host
retirement. Fixed 2-CPU, 64-PID, no-swap ceilings remain 4 GiB for prediction and
512 MiB for source/controller; producer is a separate earlier 1 GiB stage. The
controller sample includes installed-package setup, service, replay and peer
cleanup. Producer sampling follows input rendering but precedes serialization
and output writes. Each memory.peak/CPU observation covers its own sampling
interval; no simultaneous sum, complete-lifetime peak or production baseline is
claimed. Missing/foreign/malformed reports fail qualification after retirement.

Tests-first focused lifecycle lane: 25 tests, 3 explicit native-only skips; two
host-launcher tests passed. Added controls reject smaller/changed/reordered input,
wrong limits, missing/nonpositive/invalid usage and peak, absent/oversized/malformed
reports and foreign role/token/scope. Changed Python passed Ruff format/check and
host Bash syntax passed. Independent review corrected an overbroad producer sample
label. An initial native run stopped before any native request: the explicit
extra source list repeated tools/container_resources.py, already captured by
qualification_execution_identity's root-tools glob. The provenance owner refused
the duplicate; producer exit 0 and exact producer/controller retirement were
retained in private nmrnet-native-service-bIfMhhL3 scratch. Remove only the
duplicate extra entry; its bytes remain in both closure owners. No scientific
input, oracle, limit or check changes. Native success remains to be recorded below.

R15b native result: passed, 2026-10-20
-----------------------------------
make test/integration/provider-service/capacity passed at parent 7e5d3da with its
exact retained source closure. All 128 H and 128 C indices and finite predictions
passed the connected supplied-source gates. One scientific batch execution, two
model exchanges, exact source/prediction retirement, periodic Hello and terminal
replay after reopening without repeating interpretation or science. No expected
prediction was created, packet changed, tolerance tuned or runtime limit widened.

Private receipt:
.work/qualification/provider-service-nmrnet-native-service-A2nFXFz6
  summary  a6550347aeb32da905d9612fd22c72307ab19834849434e5ca67062f1f47d92c
  result   a02020802704e76976ff763f87d821d5c8fff74b41b2f6c91d70fea3e545805e
  sources  877ad88284b9c4c98b703a6e50cd94a512237036fa145cf4f30100a3af4d6490
  manifest fa7b85f57855cc91e285363ce5e7332c93a15f70b27308cf5d8c2cc3291d6759

Observed kernel facts, bytes and CPU microseconds through each stated snapshot:
  role          memory.peak   memory.max   cpu.stat usage_usec
  prediction    2596728832    4294967296   7699657
  reader          16846848     536870912    146154
  controller     137089024     536870912   10372160
  input producer  22249472    1073741824    362260
All observed cpu.max = 200000/100000, memory.swap.max = 0, pids.max = 64.
Controller includes offline package installation/local TLS fixture overhead;
producer is an earlier separate stage. These are not an aggregate peak, complete
container lifetimes or a production resource recommendation. The prediction
snapshot follows handler/channel closure; exact retirement is separately proven.

Independent ownership/code/provenance reviews sustained no further signal after
the duplicate source-entry correction. Native success closes this local capacity
and observation obligation, not full 003. Next: a real configured foreground
provider process and host caller (composition currently exists in fixtures),
then explicit local operation/recovery/network/recipient exits. External selected
model behavior and actual API/GUI delivery remain unqualified and require their
explicit endpoint/credential/disclosure prerequisites.

R16: real foreground process and operational caller plan, 2026-10-20
-----------------------------------------------------------------
The existing ProviderService and NativeAttemptFactory are runnable composition
owners, but only fixtures construct them. Do not ship tools.provider_core_tests
or unittest as a provider. Add a thin contained process that loads its startup
inputs once, opens the existing store/API/factory/service, translates SIGINT/TERM
to the existing stop event, and preserves original lifetime owners through exit.
Source precedents, inspected read-only: SECS 7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/main.py:67-108 (frozen config/signals), runtime.py:113-140
(join Hello); NMRPeak 1697dc84dd1d76ae25b04efc8183fd80614000e5,
nmrpeak_provider/provider_main.py:71-157,160-193 (partial acquisition/independent
cleanup). Reuse those responsibilities, not their synchronous loops or eager
runner startup. Startup admission/discovery must still precede native allocation.

R16a completes the single closed startup config with required service presentation
and paging/cadence/drain/settle/native waits. It retains existing Announcement,
ServicePolicy and NativePolicy objects in ServiceSettings; no second policy
schema/default source or analysis selector. hello_body owns text admission, the
existing constructors own policy validation. Deferred decoder imports resolve
the current config/service/factory dependency cycle. source_seconds is reader
I/O; SMILES retains preparation.generation_seconds. Host grants remain host-owned.

R16b must consume those exact objects in the actual process. Service settlement
joins original work before factory settlement; API/store cannot close while a
borrower remains active. asyncio.run's automatic pending-task cancellation is
not cleanup proof. If original tasks or cleanup stay held, publish bounded safe
operator/effect/correlation diagnostics before any event-loop shutdown and retain
the process/owners for explicit host retirement. Test this with a real contained
subprocess; never substitute a clean exit or erase native obligations.

Then add an offline installed controller image and foreground host caller using
provider_workers.sh's singleton/fixed grants/exact CID retirement. Normal stop
must signal the controller and continue servicing native retirement during its
bounded drain before emergency retirement; retain config/state/evidence. Define
whole-run request-leaf exhaustion as a controlled stop/hold until a reviewed
retention path exists. Recovery/archive, bounded outages and network denial still
need separate behavioral witnesses. No second journal or optional core extraction.

Network review found no ready sibling enforcement owner: SECS at the revision
above, compose/provider.yml:134-139 explicitly disclaims destination enforcement.
tools/docker.sh at 3ee113a:329-338,460-463 provides a useful device-bound proxy relay
implementation precedent, but host-network clients plus cooperative proxy env are
not sole-route enforcement; core HttpTransport currently uses direct httpcore.
The GUI at 69c58319acf9c9ca4a61cc1d15e71745666b1f4d,
docker/compose/npm-deps.shared-egress.yml:23-27,76-80 supplies internal-client/dual-
network-proxy topology only, without interface binding. Decide the explicit
runtime proxy seam, allowed authorities and host-gateway/IPv4/IPv6/DNS denial proof
before claiming network closure. Do not weaken 003 or invent external credentials.

Tests-first R16a validation: focused contained config lane went red for missing
service objects/unrefused policies, then all 17 cases passed, including exact
typed-policy construction and missing/unknown fields, text bounds and invalid
budgets before store/factory effects. Full003 continues through R16b and remaining
local operation/recovery/network/recipient exits; real-model/API/GUI proof remains
separate and requires explicit external prerequisites.

R16b foreground process and private operator evidence, 2026-10-20
---------------------------------------------------------------
The actual process now composes the existing store/API/NativeAttemptFactory/
ProviderService with the exact admitted config policies. It never calls unittest,
fixture selectors or an engine. Signals set the existing stop event; service work
is joined before factory setup settlement, then service observes that release.
API/store close only after those borrowers release. If work or cleanup remains
held, bounded safe evidence is published before waiting with original owners
alive for enclosing host retirement. No automatic asyncio.run teardown is claimed
as cleanup. No second lifetime registry, lifecycle journal or scientific decoder.

New execution/model files are admission boundaries, not trusted Python argument
bags. Exact execution fields: image_id, geometry_image_id, controller_image_id,
repository_revision, upstream_revision, runtime_identity_source=caller, and a
nonempty tool_sources mapping of canonical relative paths to exact size/SHA256.
Images/revisions retain tools/baseline_prepare.py::execution_identity's existing
grammars; source files may be empty. This validates declarations, not their truth.
Observed TOML/execution/model declaration digests are added from consumed bytes;
caller overrides/unknown fields fail before storage/API/allocation. Native model
projection matches the earlier native service (3ee113a): dictionary and exactly
H/C checkpoint/scaler, each with member/positive size/SHA256/archive SHA256.
No **member or opaque execution mapping reaches public ResultPlan.execution.
Existing archive acquisition metadata is explicitly excluded, not published.
provider_core.response_json.read_document owns bounded strict JSON admission;
tools.artifacts.safe_member_name owns canonical member path checks. Scientific
scalar/model-byte verification remains with the native owners. These local
metadata tests neither establish source-closure completeness nor execute science.

process_reports.py ports SECS 7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/diagnostics.py::exception_evidence, with actual local
owner fields and separate cause/context edges. The private operator sees safe
operation, request correlation/status, uncertain effects, independent cleanup,
OS errno and reviewed native traceback head/tail. The structural graph excludes
raw HTTP/model/result payloads, unknown exception messages/notes and path fields.
The separate protected native traceback can contain native paths or notes; it
is bounded/redacted, not a claim that every native path is removed. Configured
keys and credential-like fields are redacted first, including escaped quotes; the latter
ports the quoted-field pattern from NMRPeak at 1697dc84dd1d76ae25b04efc8183fd80614000e5,
nmrpeak_provider/diagnostic_text.py::_CREDENTIAL. This reuses the interpreter's
redaction owner. A rejected diagnostics destination receives no writes, while
safe owned reason/errno still reaches the private host stderr capture. A failed
file publication cannot erase the first emitted primary report.

Tests-first: malformed/unknown/private execution and member facts initially
reached idle service, deep JSON escaped controlled admission, and rejected log
directories lost their causes. The corrected contained process lane passed 15
tests, including actual signed local TLS discovery and SIGTERM/store reopening;
retained pending-start bytes survive refusal before Hello; private canaries and
malformed identity/path/deep JSON fail before runtime effects. A real child-only
fault shim holds executor I/O owned by the actual factory. The child publishes
requires_host_retirement=true, retains its original task/store lock, acknowledges
a second signal without recancelling/cleanup, and has no result.json. Only the
parent's exact child kill releases that lock. This is process/ownership proof,
not native container retirement proof. A separate real service/factory/store
witness establishes settlement of factory-owned I/O before service dependency
release. Independent ownership, privacy/provenance and simplicity U/A reviews
converged without new actionable signal. A late result publication collision
keeps prior bytes, reports safe errno and released dependencies, exits nonzero
and permits store reopening. Fresh focused config (17) and interpreter (18)
lanes passed; the argv witness admits only read-only sources, no engine socket,
and selects the offline installed-package process lane with init reaping.
Focused Ruff and new-file silent-default/guard-posture scans passed. The whole
repository scans remain red on existing findings in other files; they were not
weakened or presented as green, and unrelated repairs were not folded into R16b.

One validation invocation was invalidated by editing tools/container.sh while
its Bash process was waiting for a container; the changed source offset caused
an EOF after config's 17 tests passed. No product syntax defect was inferred:
bash -n passed on the completed source. The affected command must be rerun with
launcher source frozen; the fresh config/interpreter rerun above passed. Do not
claim the invalidated invocation as a successful lane.
Installed controller/host caller, recovery/archive, enforced sole-route network
and the separately blocked real-model/API/GUI qualifications remain open.

R16c installed controller image: tests-first plan, 2026-10-20
-----------------------------------------------------------
Purpose: run the real foreground entrypoint from installed immutable code, with
no startup pip, wheelhouse/source mounts or qualification runner. Port the local
geometry_image.sh and containers/geometry build pattern at 9c0d9b0: exact committed
blob/mode capture, frozen wheel contexts, --network none/--pull=false, admitted
immutable image ID and committed-input label. Keep existing container_native and
launcher cleanup owners; no new generic image framework. Use the already pinned
Debian Python base and approved retained dependency locks; acquire nothing here.

Build inputs: controller provider modules excluding the three scientific worker
entrypoints; nmrnet_inference/predict.py; tools/artifacts.py/container_guard.py;
the actual provider-core metadata/src and its build/runtime locks; build helper
and Dockerfile-specific deny-by-default context. Core is wheel-installed; the
binding/support modules are copied into the pip-free environment's site-packages.
Isolated Python then requires no PYTHONPATH or current-directory imports. Build
wheel creation ports tools/provider_core_tests.py; external pip/pip-free runtime
ports tools/rdkit_environment.py at that revision, without invoking test code or
changing/rebuilding the scientific images. Two frozen wheel contexts contain the
runtime wheelhouse and the single locked setuptools wheel. Runtime/lock membership
and hashes are checked before installer execution; build-only tooling is absent
from the final runtime. No credentials, upstream source, weights, fixtures, engine
socket, device, network access or published port is granted to the controller.
Host engine access remains solely with the explicit image-build caller.

Focused proof order: launcher argv and real Git capture adversarial controls;
bad/missing/extra wheel refusal before any installation; commit build inputs;
actual offline build and isolated installed-image tests. Qualify exact runtime
distribution multiset, native Ed25519 use, image-owned import origins, no
Torch/RDKit/NumPy/LMDB/fixture imports and actual process --help from unrelated cwd.
Image-input labels identify committed source/locks, while the immutable image
identifies actual output; frozen wheel identities must be retained if cited.
Do not label this packaging proof as service/scientific/network/deployment proof.
The production host caller and local service witness follow without changing
the already-qualified native science owners or expected values.

R16c input implementation checkpoint: the maintained targets now exist. Tests
first failed for missing owner/target, then the focused contained image lane
passed 7 tests: exact command contexts, real committed Git input capture plus
six source mutations, excluded private/native source, unchanged input identity
across unrelated commits, six dependency mutations before any installer call,
intermediate wheelhouse symlink refusal, missing local base and mismatched input
label preserving the prior record. Review found and corrected cold-root admission,
the missing wheelhouse ancestor check and implicit missing-FROM acquisition risk;
the base admission gate follows tools/inference_image.sh:259-260 at 9c0d9b0.
Independent authority, code and provenance reviews then sustained no new signal.
Actual build and installed-runtime qualification follow the committed-input
checkpoint; no dirty-build exception or image qualification is claimed here.

The first real build at c395353 failed in RUN. Its protected native receipt
lqnFMNcg/command.log contained only the generic RUN exit 1 because inherited
Docker --quiet suppressed the installer cause. That receipt alone does not
identify the cause. An independent contained call to the actual wheelhouse
reader reproduced rejection of the real build lock's inline hash before pip;
the real-file unit regression went red for the same reason. The build lock is
now normalized to the existing multiline grammar without changing setuptools
84.0.0 or its allowed SHA256. Original lock-file SHA256 was
d34ba4ca99c7a43c836b08cb9e7893dfc499321619fc21df5d76ef92cb27043e.
No dependency resolution, expected-value regeneration or tolerance change.

The build caller now retains capped --progress plain diagnostics and admits
identity solely from the private --iidfile after successful original-client
completion. It requires a regular non-symlink 71/72-byte lowercase sha256 ID with
only optional final LF, then the original inspected-ID and input-label gates.
Modeled-native-port tests exercise actual source capture and both valid ID forms,
misleading progress IDs, missing/link/FIFO/NUL/trailing/oversized/malformed IDs,
nonzero/unconfirmed build, and inspect/label mismatch preserving the prior record.
They are not real engine-retirement proof. The expanded contained unit lane
passed 10 cases, including the actual mounted build lock. Three independent
reviews sustained no additional signal. Keep the failed-source checkpoint in
history as reproducible development evidence; the corrected build is qualified
separately, without repeating unchanged scientific qualifications.

R16c actual qualification at source 9bb0783, 2026-10-20: the corrected maintained
provider/image/build succeeded, then test/integration/provider-runtime passed all
four tests. Image: sha256:129a218bf8d5ce9665f049ef5fd9e0112028c4adfb0b350385be5d01b4c24c96.
Observed io.nmrnet-repro.provider-inputs:
sha256:9d640a5f9a998d116f95a09c7e010f43104a2d7c92d4bfc3a2fefb77c9abfff9.
Observed image USER 65532:65532 and entrypoint
/opt/provider/environment/bin/python -I -B -m nmrnet_provider.process.
The test caller used no network, a read-only root, nonroot caller identity,
cap-drop ALL/no-new-privileges, 2 CPUs/512MiB/no swap/64 PIDs, bounded noexec tmpfs
and only its read-only test tree. No application source, wheelhouse, credentials,
state, engine socket or scientific data mounts. It qualified the exact 11 locked
dependencies plus provider-core 0.1.0, absent pip/setuptools/scientific/fixture
imports, installed module origins, actual native Ed25519 use and isolated process
--help despite a hostile current-directory/PYTHONPATH canary. Binding/support
files are image-owned copies, while core is an installed wheel.

Read back from that admitted image:
- dependency-inputs.json SHA256: 3e50b6a1132fa0ea5ba1d962b9340a28355fd705e3237f5edbc0adb5e371fabe
- build lock SHA256: f6dad15c3a5102ff3ad70f920ba21ba9d132b2b373eb374dd2bd578050392d36
- runtime lock SHA256: 79c90c01283941561cbc6f5838f700f5dd932388890ba7510e55bf5d23a11dac
- actual frozen wheel inventory: one build wheel and eleven runtime wheels.
No external acquisition or scientific image rebuild was needed. This closes
installed-controller packaging/import qualification only. Next is the explicit
sole-route transport/proxy path needed by the production host caller, followed by
its connected service, recovery/retention and recipient obligations. External
selected-model and actual API/GUI prerequisites remain separately unspecified.

R16d production network and host caller: connected-path plan, 2026-10-20
---------------------------------------------------------------------
The installed controller must use Docker network none (loopback only), without
a route to peer networks. HTTPS leaves through a host-granted private Unix
socket. Preserve destination URL/Host/signature/SNI/TLS trust; no proxy env, direct
fallback, resend, custom TLS stack or second timeout/cleanup owner.

D1 adds an optional explicit Unix CONNECT route to existing core HttpTransport/
OwnedNetworkBackend. Direct mode remains the reusable core's explicit absence
case; the production host assembly must require the route for all outbound roles.
The existing backend owns raw Unix streams across CONNECT/TLS interruption. Use
httpcore.AsyncHTTPProxy with the original request and zero retries. Source:
httpcore 1.0.9, retained wheel SHA256
2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55,
httpcore/_async/http_proxy.py:146-166,271-316. Its HTTPS tunnel forwards the backend
but omits the advertised uds option; backend connect_tcp must use only the fixed
Unix socket in this mode, with no DNS/TCP attempt. httpcore already owns CONNECT
and destination TLS. Qualify fixed Unix acquisition, actual signed TLS, credential
absence from CONNECT, certificate rejection, lost POST without resend, aggregate
CONNECT/TLS/body deadlines and original-stream cleanup retention.

D1 implementation and qualification, 2026-10-20: core now admits the fixed
absolute Linux Unix path and routes its existing owned backend through it.
The focused unit lane includes backend stream ownership tests. Real local
Unix/TLS witnesses preserve a verified Ed25519 request and destination SNI,
exclude credentials from CONNECT, reject the wrong certificate, refuse missing/
malformed/denied proxies without direct TCP, and send a lost-reply POST once.
CONNECT and TLS stalls settle on aggregate deadline or original cancellation.
The test proxy is a disposable fixed-origin relay, not a production ACL or
network-isolation proof. Review found pinned httpcore's unbracketed IPv6 literal
CONNECT construction; those destinations now refuse before any backend/client
allocation, with a zero-I/O unit witness. DNS names and IPv4 literals remain
supported. No dependency, request signing, native model or scientific oracle
changed. D2/D3 and installed-image refresh remain required before service use.
Focused contained validation: make test/unit/provider-core/transport (18 passed)
and make test/integration/provider-core/transport (6 passed); selected-file Ruff
check/format and Bash syntax checks passed. Independent code, authority and
provenance reviews ended without additional actionable signal after the IPv6
refusal. No whole-repository or scientific rerun was needed for this seam.

D2 adds a CONNECT-only service listener to existing bound_http_proxy; acquisition
TCP mode stays distinct. Exact admitted HTTPS authority ACL precedes DNS/socket
creation. Reuse header/thread/relay bounds and device-bound DNS/TCP. External
relay uses host networking with an explicitly selected interface. Local relay
belongs only to a named internal network. Local DNS-named peers need a frozen,
host-observed unique network-member address mapping rather than system/Docker
DNS fallback; keep original names for TLS/signatures. Literal-address component
tests cannot claim DNS-named API/GUI completion. Proxy grants exclude credentials,
CA material, state, native IPC and engine sockets. Readiness follows private
socket/policy admission; never unlink old evidence. Confirm exact relay-container
retirement after controller drain; socket/listener closure is not tunnel proof.
Qualify allowed TLS routes plus denied unlisted authority before DNS, controller
direct IPv4/IPv6/DNS/host-gateway bypass, local external egress and socket mutation.

D2 implementation and component qualification, 2026-10-20: the separate
tools.provider_proxy entrypoint takes an explicit interface, local/external mode,
repeated canonical host:port authorities, socket/readiness paths, and local-only
host=IPv4 assignments. These are a host projection, not model/Job input or a new
configuration schema. Exactly one local address covers every granted host;
duplicates, extra/missing entries, rewritten literal hosts and external mappings
refuse. The host still owes actual named-network membership observations.
The CONNECT target owns destination selection; Host headers do not authorize it.
Ordinary HTTP, malformed/noncanonical and unlisted authorities refuse before
DNS/socket acquisition. Existing bound_http_proxy owns device-bound transport,
header/thread/relay bounds and half-closes; narrow handler hooks preserve the
acquisition listener's behavior. The Unix listener requires a fresh private
caller-owned 0700 parent, applies mode0600 before activation, and shares the
existing complete/exclusive readiness publisher. Old leaves are never unlinked.
Fault witnesses prove failed permission admission closes the acquired socket
before activation, and an invalid interface publishes neither socket nor ready.
Owned method/authority/selection reasons and native phase/type/errno reach the
operator without raw request data. DNS owns safe missing-resolver/no-address/
failed-query reasons while retaining original query failures privately; service
output bounds native cause projections to eight lines. Filesystem refusal keeps
its original private cause and safe errno. No broad request exception rendering.
make test/unit/provider/proxy passed 59 tests (including all selected existing
acquisition/posture tests); make test/integration/provider/proxy passed its real
Unix-listener/TLS witness. That witness uses actual interface binding to lo,
forbids DNS, authenticates the original localhost TLS name and preserves exact
request target/headers/body. It observes its fixture's handler/listener closure.
This is a network-none loopback component proof, not named-network isolation,
external egress restriction, production container retirement or deployed API/
GUI/model proof. Those D3 obligations remain. Selected-file Ruff and the shared
host-execution guard/hierarchical-Make convention checks passed. Independent
authority/code/provenance reviews caught setup and diagnostic gaps corrected
above; unchanged scientific boundaries were not rerun.
The final DNS-deadline witness preserves the first exact query cause when its
shared deadline prevents a second resolver from starting. TimeoutError remains
the old caller contract; safe DNS-specific diagnostics keep the causal distinction.
Exceptions keep raw causes only for their live owner; omitted operator details
have no implied later lookup. No new diagnostic store or transcript was added.

D3 is one foreground host caller using the installed process and original
provider_workers owner. Stage and admit startup config/secrets/CAs in an offline
contained helper, emitting only a closed bounded host plan (never source/eval).
Preserve consumed bytes and original TOML correspondence if staging rewrites
paths. Use stable installation/native roots for singleton ownership and retained
receipts, actual frozen native-source identities and the same model declaration
for controller/science. Continue servicing retirement requests after one exact
controller SIGTERM through a finite host drain; then exact emergency retirement
if held. Preserve config/state and all failed/unconfirmed obligations. Reserve
enough remaining whole-run request leaves for prediction plus bounded preparation
before another prediction dispatch; exhaustion stops admission, never deletes
leaves. Qualify connected service, held shutdown, exhaustion, explicit stopped
inspection/archive/restart and actual operator/requester surfaces. Keep external
selected-model/API-GUI prerequisites separate; no invented credentials.

D3a required process routes, 2026-10-20: process startup now requires explicit
API/interpreter/store Unix paths. Immutable HttpsSettings propagation covers
lifecycle API, independent Hello, source API, every model endpoint and Upload
store before storage/runtime acquisition. Existing in-code runtime composition
keeps its absent/direct-route option; the process offers no direct-mode switch.
The original TOML hash and all endpoint/TLS/budget settings remain unchanged;
route grants belong to the later host run's protected evidence. The subprocess
fixture now traverses the actual D2 relay to its signed disposable API. It owns
non-daemon workers through the pinned socketserver owner, stops admission,
closes the peer, joins all worker threads and only then releases scratch; partial
setup is also settled. Focused make test/integration/provider-core/process:
17 tests passed, including missing/invalid route refusal before journal/API work,
all-role/two-endpoint settings propagation, normal stop and held-work diagnostics.
Ruff check/format passed. Changed-file guard scan reports only pre-existing
config defaults (ConfigurationRejected/_fields/read_startup_file/cleanup tuple);
none were weakened or hidden. The host launcher, network grant proof and refreshed
installed image remain unfinished; this is source/process wiring qualification.

D3 host-budget wiring, 2026-10-20: provider_workers.sh now passes prediction,
reader and SMILES generation I/O deadlines separately. Generation uses the
preparation generation_seconds budget; its RDKit embedding timeout remains
independent. The recording-engine witness deliberately uses prediction13,
reader2, generation7 and embedding3: old source passed2 to SMILES rather than7.
The maintained allocation lane then passes24 tests, including exact lifecycle
and private creation checks. Qualification's reader10/generation5/embedding1
now match its existing typed configuration (prediction90). This is host argv
wiring proof, not a new scientific execution or changed accuracy evidence.
Logs: /tmp/nmrnet-role-budget-red.log and /tmp/nmrnet-role-budget-final.log.
The production caller must derive these values from admitted startup inputs.

D3 offline startup capture, 2026-10-20
-------------------------------------
The new nmrnet_provider.startup_capture helper invokes the existing config.py
admission owner with an explicit internal reader port. It retains exactly each
read_startup_file result after its descriptor has been read and closed; it never
validates one pathname read and then copies a different read. Only consumed
TOML/credential/key/explicit-CA files enter a fresh0700 capture with0600 files.
An unrelated private file is excluded. Repeated paths repeat the original
secret/bounds/ownership admission and must return identical bytes. A host-supplied
aggregate byte ceiling bounds distinct captured bytes; no limit is inferred from
network or lifecycle policy. No HTTP, worker or Attempt storage is acquired.

The original TOML is unchanged. The future caller mounts capture/inputs at the
same original absolute source root, then starts the same immutable controller
image against those frozen bytes. Source_sha256 therefore retains its actual
meaning. System TLS roots remain owned by that image; CLI execution/model
declarations are separate frozen/admitted grants. The helper does not claim to
capture either through this config reader. The source root must stay immutable
during capture; path checks reject parent components/intermediate links rather
than claiming final-component O_NOFOLLOW alone confines a tree.

plan.json is a closed, protected projection of actual host consumers: three
authority sets, native time/embedding/seed/call budgets, state path, shutdown
budgets and original configuration identity. No config object, key or signing
credential representation is serialized. It is published only after whole typed
configuration validation and successful private writes/closes. Partial captures
remain private evidence. Source/capture/writable-store roots must be canonical
and disjoint in both directions; no ready plan is published on refusal.

Authority admission reuses tools.provider_proxy.authority_parts, not a new URL
policy. Port443 is selected only for an omitted port. Explicit:0 and unsupported
IPv6 literals refuse before plan publication. Omitted and custom ports retain
their destinations; API explicit:443 follows its signing owner's normalization.
Model/store explicit:443 retains their existing canonical-URL refusal rather than
rewriting input. The image's existing support-file capture/install closure now
includes provider_proxy.py and bound_http_proxy.py so startup and later relay
entrypoints use the same admission owner. No dependencies or proxy rules changed.

Tests-first witnesses cover source mutation immediately after the consumed key
read, exact original TOML hash, frozen-byte reloading, unrelated-file exclusion,
repeated-path permission/byte changes, exact/over aggregate capacity, write failure,
all three ambient masks including nested output directories, root overlap/aliases,
port preservation/refusal and actual CLI symlink-loop error delivery without a
private path canary. The first red was the absent reader-port/module import,
not scientific or behavioral evidence. Config qualification is focused on
test/integration/provider-core/config; image closure uses test/unit/provider/image.
Final focused results:27 configuration tests and10 image-input tests pass;
selected-file Ruff check/format and whitespace pass. New capture-owner convention
scans find no issues; config.py retains its four named pre-existing default
findings without weakening them. Independent authority/code/provenance reviews
identified the port substitution, alias overlap and symlink-loop delivery defects
corrected above; subsequent reviews found no additional actionable signal.
Logs (ephemeral): /tmp/nmrnet-startup-capture-qualified.log and
/tmp/nmrnet-startup-capture-image-inputs.log.
Current same-path container grants and refreshed installed import qualification
remain separate until run. This helper does not close the production caller,
named-network routing, host drain/retirement or external-model/API-GUI obligations.

Implementation sources: nmrnet_provider/config.py::read_startup_file and
_read_provider_config; process.py::_publish/failure_evidence; existing
tools/provider_proxy.py::authority_parts. Their pinned sibling/protocol provenance
is documented in their module headers and the D1/D2 records above. The reader
port is introduced only to capture bytes already admitted by that owner; pure
policy constructors and the public load_provider_config call remain unchanged.

Installed/same-path component qualification: the source9b9c347 build produced
sha256:cf5d5ca374b2c5dbd21db44a5a201a4d54f731add22c5c585a8bccacfdc4b741,
with input label
sha256:da911110cabaf7ce8619a4491c281e8c59317cdb77e1e7a7969b165488d5d315
matching committed controller inputs. The four maintained runtime tests pass.
An independent actual CLI/container probe grants the original source rootRO and
a separate private snapshot destination. After capture, it replaces the original
TOML and key; a fresh container mounts only snapshot/inputs at that same original
absolute path. The installed loader recovers the original TOML/key hashes, without
the unrelated file or state creation. Observed callerUID:GID1000:1000, roots0700,
files0600, rootRO, networknone, zero capabilities, no-new-privileges,2CPU,
512MiB/no swap,64PIDs. All three exact containers (including fixture setup) were
removed; final ownership-filtered inspection was empty. Evidence (ephemeral):
/tmp/nmrnet-samepath-capture.1kDpj8wM/reload.json SHA256
bc8d1f5209d77439a2013ef3371b952eb1b2fedd56cd63891b9fb578ac1846fb;
frozen/snapshot/plan.json SHA256
27bd11f3070a7276849bc0d4b811a5feafff1e0f0ffe02bb900191fe3f44f051.
This qualifies synthetic/system-CA component mounting, not custom-CA handoff,
production launch routing/retirement, HTTP, native execution or deployment.
Note018 separately records the repaired installed diagnostic-file fault modes.

D3 frozen native sources, 2026-10-20
------------------------------------
provider_workers_capture_sources now uses the existing copy_git_blobs owner to
freeze committed native/provider Python, support files, model declaration and
native locks before worker dispatch. It requires the caller's declared revision
to equal HEAD, rejects dirty/untracked/incomplete input, records exact Git modes,
and publishes its source-root/revision fields only after successful copy and
inventory/hash completion. All three worker profiles mount that explicit root;
prepared weights/checkpoints have a separate read-only root and retain existing
native byte verification. Upstream model code remains in its admitted image.
The qualification caller uses the same capture, checks frozen SHA rows against
its independent source manifest before dispatch, and retains revision/Git/hash
inventories in the successful receipt. The declaration includes git_inputs.sh;
an independent audit caught its initial omission before integration.

The shared Git copier now checks each effect explicitly. Bash conditional calls
disable errexit inside functions: a completed stdout stream did not previously
ensure ls-tree/cat-file/chmod succeeded. The failure witness runs the real Git
operation through a disposable fixture port and then returns91; the unchanged
old copier admits all three failures, whereas the corrected owner propagates91
without admitting a source root or dispatching the engine. An initial executable
wrapper in /tmp was skipped because that lane mounts /tmp noexec; direct lookup
confirmed /usr/bin/git was selected. The corrected fixture port preserves that
mount policy. Initial fixture text/bytes setup errors are not behavioral proof.

Focused proofs cover exact committed bytes/modes, excluded files, frozen bytes
after live mutation, positive manifest join followed by changed-live refusal,
declared-revision mismatch with unchanged native bytes, missing/dirty/new inputs,
all three modeled worker grant sets and unchanged native ownership/retirement.
make test/unit/provider/image passes13 tests; allocation passes25. The old-copier
negative control reproduces three failures with the corrected injection.
Logs: /tmp/nmrnet-native-source-qualified-final.log,
/tmp/nmrnet-native-source-allocation-qualified.log and
/tmp/nmrnet-native-source-status-verified-red.log. These qualify host capture and
recording-engine contracts; native scientific oracles were not rerun or changed.
The actual production controller/proxy host lifecycle remains to be connected.

D3 retained-request capacity before host dispatch, 2026-10-20
-----------------------------------------------------------
The native allocation owner requires an explicit total request bound and the
configuration's existing maximum source-call count. Before dispatching a prediction
it reserves every allowed source call plus one subsequent refused request awaiting
retirement. Retained requests continue counting, including completed requests;
there is no evidence deletion or independent reservation registry. Exhaustion
closes creation while still servicing exact retirement requests. The foreground
caller must observe this state and request controller shutdown; that connection
is still pending, so this is not yet a complete production capacity witness.

The minimum installation bound is source_calls + 2. A focused recording-engine
witness consumes prediction and the full two-call source budget, then refuses and
retires the next prediction within the four-leaf ceiling. An extra request fails
without another create. Exact-boundary, pre-root refusal and closed-admission
retirement cases pass. Engine argv records now use separate bounded files because
the real command owner's unchanged 4 KiB file limit also covers the test engine;
growing one aggregate argv file caused a fixture EFBIG, not a runtime chemistry
failure. No production limit was relaxed.

The exact pre-change host reproduces two assertion failures for insufficient
reserve and creation after admission closes; no setup errors count as this proof.
Final focused allocation tests pass 29 tests in 8.428s; logs:
/tmp/nmrnet-native-capacity-verified-red.log and
/tmp/nmrnet-native-capacity-final.log. Independent ownership, provenance and code
reviews found no remaining actionable issue. Scientific inputs/oracles and the
installed controller image are unchanged; no native accuracy witness was repeated.

D3 shared exact create admission, 2026-10-20
------------------------------------------
worker_retirement.sh now owns worker_container_created for both native allocations
and the service qualification's existing static components. The forthcoming
foreground caller reuses this admission rather than copying a third CID parser.
It clears the output identity, requires the original engine client to be retired,
and admits only matching complete CID/stdout bytes in caller-owned 0600 regular
files. A CID may end with one LF; stdout must be the exact ID plus LF. Create's
exit status remains the caller's separate fact: a failed create can provide an
exact cleanup handle but cannot authorize start. No new engine calls or registry.
Tests first failed on the missing owner; focused allocation now passes 31 tests
in 9.122s. Cases cover both valid forms, missing/mismatched/trailing/public/linked
receipts, unretired clients, stale-output clearing and zero admission effects.
Logs: /tmp/nmrnet-create-admission-red.log and
/tmp/nmrnet-create-admission-green.log. Independent code review found no signal.
This remains recording-engine evidence, not production mount qualification.

D3 foreground caller checkpoint: paused at user request, 2026-10-20
-----------------------------------------------------------------
Committed prerequisites: ee9220f reserves retained-request capacity before native
prediction dispatch; 92493f0 shares exact private create-receipt admission. The
foreground implementation is preserved as a paused source checkpoint and is not
qualified for use.
No production launcher, external model, deployed API or GUI run was performed.

This checkpoint adds tools/provider.sh and the image-owned launch_capture helper,
plus focused normative/adversarial tests and hierarchical provider/run and
test/unit/provider/host targets. The offline helper reuses startup capture, joins
frozen native bytes to their exact inventory/hashes, publishes the closed execution
declaration, and emits 17 NUL-delimited host inputs. The host adopts those fields
only after helper exit0 and exact removal. Native source reads have a separate
1 MiB ceiling from the 64 KiB execution declaration: the real inference lock is
100780 bytes at 92493f0. A 110000-byte fixture prevents repeating that mistake.

The caller connects explicit local/external routes, observed internal-network
peer identities, caller UID/GID, private grants and the original native owner.
All three proxies reuse the installed lightweight controller image: its proxy
modules are image-owned, so proxies require neither a source-code bind nor another
image installation. They receive no startup secrets, model data, state or engine.
The controller has networknone and read-only route/socket parents. This describes
the current implementation, not actual mounted-grant or connected-service proof.

Review corrections currently implemented: reuse existing provider/RDKit image
input-label admission; preserve controller failure observed during signal drain;
hold native and installation locks through proxy retirement; refuse helper mount
target collisions; render early safe startup refusals; consume all peer/resolver
list entries and refuse an empty parsed resolver list. Native creation checks the
same absolute drain deadline both between dispatches and after late create before
start, retiring the late allocation without starting it. Extend the existing frozen
source inventory to the actual host launch/client/retirement/image owners; the
fixture scaffold and independent qualification manifest were updated accordingly.
The focused image-input rerun passes 13 tests in 5.053s, including this enlarged
source inventory. This proves capture behavior, not an installed foreground run.

User correction: MAXIMUM_STARTUP_BYTES is a positive decimal forwarded unchanged
to contained Python; it has no unrelated six-digit host-arithmetic restriction.
The focused recording witness passes 2097152 unchanged into the real capture launch
argv and confirms exact component retirement. Request count and host elapsed
seconds retain their own host bounds. Capacity exhaustion now records an explicit
operator reason before drain; connected receiving proof of that path is pending.

Completed focused contained checks at this checkpoint:
- configuration/launch capture: 30 tests in 2.598s, including all 17 fields, multiple
  interpreter authorities, large source input and zero handoff bytes on refusal;
- host: 7 tests in 1.478s, including above-1-MiB argv, malformed/still-owned handoff,
  SIGTERM followed by controller exit1 reaching host exit2, and failed retirement
  retaining its handle without a repeat. Drain deadline expiry is also a retained
  nonzero outcome even when subsequent emergency removal succeeds;
- allocation: 33 tests in 8.858s, including a late create retired without start and
  closure between queued requests at the same drain deadline.
Logs: /tmp/nmrnet-launch-capture-qualified.log,
/tmp/nmrnet-checkpoint-host.log and
/tmp/nmrnet-provider-host-deadlines.log. The enlarged image-input and two real-Make
selector regressions also pass; see /tmp/nmrnet-checkpoint-image-inputs.log and
/tmp/nmrnet-checkpoint-make-inputs.log. The Make proof covers literal unexpanded
values, protected internal aliases, unexported public selectors and zero engine
effects. Changed Python passes focused Ruff/format; shell syntax and diff checks
pass. No scientific accuracy or capacity witness was repeated.

Resume with remaining actual-owner proofs: resolver/early-refusal/held-lock and
final grant contracts;
document supported invocation and stopped inspection/archive/restart. Commit only
reviewed explicit paths, refresh the installed image once for the new helper, then
run one complete maintained foreground local signed-TLS/scripted-model/native
service witness. Keep capacity-exhaustion and protected operator evidence visible.
Do not repeat unchanged scientific accuracy witnesses or add optional machinery.
The selected real model and deployed API/GUI prerequisites remain separate.

Foreground audit follow-through, 2026-10-20: note018 preserves the checkpoint-
pinned reproduced error/permission findings and separate repair evidence. The
first independently qualified receiving-renderer repair covers model response
correlation/reason, native input diagnostics under cleanup failure, reviewed
owner reasons, truthful receipt-presence facts and independent stderr/file
reporting, including held-process ownership when both sinks fail. Focused target
test/integration/provider-core/process passed 32 tests independently. Endpoint
history, interruption, DNS owner reasons and the production launcher's private
creation/mount contract remain explicit work; this does not close full003.
Note018's DNS follow-up now qualifies the decoder-to-operator reason path with
real binary packets and 60 independently passing focused proxy tests. Routing,
scientific inputs and native model execution did not change.

Subsequent source repairs, 2026-10-20: note018 now records terminal and successful
endpoint-history retention, useful private native/model reasons, interruption
through actual task joins, independent report sinks and expected Hello shutdown
observations. The source series through 02aee36 preserves exact cancellation and
late operational-child failures without calling successful joins cleanup failures.
The final Hello follow-up retains unconfirmed acceptance separately from failure/
release decisions. Focused receiving qualification passes 37 tests independently;
note018 gives exact reproduction limits, logs and the separate unit/service counts.
No scientific expected output or tolerance changed. Rebuild/qualify the installed
controller once for these repairs, then run the queued full permission audit and
continue D3's production host caller/connected proof. Native creation permissions
and real mounted grants remain open; prior preliminary probes do not close them.
External selected-model and deployed API/GUI evidence are still distinct and
require real supplied environment/credentials. This does not close full003.

Configured runtime assembly: implementation plan, 2026-10-20
==========================================================
Purpose: make the existing input interpreter, acquisition, native-worker session
and core Attempt lifecycle usable through one explicit production assembly.
Implement and test this assembly before a continuous service loop or deployment
controller. The accepted full-dependency package remains unchanged. This plan
does not authorize sibling/upstream edits, external model calls or deployment.

Current evidence: at 4621bd851700c2d0b3ef662781b07651488e1000, native
scientific-smiles uses actual generation, released prediction, signed local API,
durable entry, exact host retirement and lost-completion replay, but scripts the
chooser and assembles owners inside its test. Upload preparation has real source
acquisition/reader proof with recording prediction. No normal configuration
decoder, credential-artifact parser or production assembly exists. ProviderAPI
has no Hello operation; host tooling prestarts qualification allocations rather
than providing a production allocator. Do not promote these fixtures into a
scheduler, infer external authority, or call assembly proof a working service.

Responsibilities and construction order
---------------------------------------
1. provider_core.credential admits bytes of the API-issued
   nmr.provider.private_signing_credential.v1 document. Preserve its seven fields,
   profile vocabulary, Ed25519 public/private pairing and canonical encodings.
   Reuse existing reference validators. Return a small immutable credential with
   private key excluded from repr. No key generation, registration, file discovery
   or alternative seed/environment credential format belongs in this parser.
2. nmrnet_provider.config decodes one bounded closed TOML document. Group settings
   by existing owners: API/TLS; ordered interpreter endpoints; Upload store and
   budgets; preparation/generation budgets; lifecycle and stable recovery scope.
   Delegate values to SigningIdentity/ChatEndpointSpec, UploadLimits,
   GenerationSettings, StoreLimits and existing lifecycle admission. Do not copy
   their numeric or scientific validators. Accept explicit secret/CA inputs;
   use verified system roots or an explicit CA, never disable TLS verification.
   No ambient credentials/proxies, URL/model defaults, route selector, command
   imports, hot reload or configuration framework. Reject unknown keys without
   echoing their potentially private names/values. Startup file reads are bounded
   regular-file reads, with explicit ownership/mode/symlink rules for secrets.
3. nmrnet_provider.runtime assembles existing owners for one selected authenticated
   Job. Worker ports/factories and observed execution/model/runtime facts come
   from trusted host composition, not from Job text or interpreter arguments.
   Keep lifecycle API transport separate from source API/store and model I/O:
   JobUploads -> InputPreparation(InputInterpreter, allocators) -> NMRNetSession
   -> AttemptController. The interpreter chooses the route. No new start/execute/
   publish state machine, reference registry, transport or replay journal.
4. The outer caller owns retained storage and lifecycle API I/O. Inspect storage
   before requesting fresh allocation or dispatch; retained nonterminal
   obligations require explicit recovery or refusal, not automatic replay.
   A caller supplying preallocated ports retains their setup/refusal cleanup.
   The native fixtures prestart workers before storage admission and therefore
   cannot establish allocation-after-inventory ordering. Input facts must come
   from the outer caller's actual signed ProviderAPI.jobs read and explicit
   selection, not a TOML FeedInputFacts lookalike. Bound any pagination. Keep
   recovery generation stable across restarts;
   disposable native-allocation IDs are not persistent deployment generations.
   Construct JobUploads shortly before use because its total deadline starts
   at construction. Before controller adoption, construction failure leaves
   created resources explicitly caller-owned or retires them with all causes.
   After adoption, settle the controller before releasing its dependencies.
   Unconfirmed retirement retains ownership and blocks replacement; do not race
   an independent session.retire against controller settlement or close retained
   storage while its selected owner still needs it.

Tests-first slices and acceptance
--------------------------------
R1 credential admission: package normative/adversarial tests first. Prove signing
with the admitted key, original API field/profile/reference meanings, exact key
pairing and rejection of substitutions, ambiguous JSON/base64 and unsupported
algorithms. Check safe error text/repr and installed portable guard/inventory.
No dependency acquisition or version change is required.

R2 configuration: focused contained decoder/file tests before implementation.
One valid concrete configuration produces actual owned policy objects. Unknown
fields, duplicate/malformed TOML, missing endpoints/secrets, identity mismatch,
invalid trust and inconsistent native deadline settings fail before any worker,
network or journal acquisition. Public observations exclude secrets and private
paths; retain useful owned field/operation context. No placeholder deployment
identity or guessed endpoint makes a configuration usable.

R3 assembly: focused local TLS integration through the production factory, with
recording native ports first. Prove all three routes, source/API credential
separation, construction/refusal cleanup, no scientific dispatch after input or
cleanup failure, cancellation, and exact durable/publication behavior. Reuse the
existing store/controller and structured normative/adversarial test layout.
Include actual signed jobs-page discovery -> selected input facts -> verified
Job-input retrieval. Wrong input identity fails before preparation. A retained
obligation refuses with zero allocator calls/dispatch, unchanged records, and
confirmed cleanup of any caller-owned preallocated ports; refusal does not recover.
Preserve the existing explicitly direct binding separately: NMRNetSession with
input_preparation=None still consumes exact coordinate-JSON bytes through
prepare_direct_job; malformed declared JSON remains terminal without a model
call. Keep its focused tests and native direct proof. The new interpreted assembly
supports the three agreed interpreted routes; it does not claim automatic direct-
JSON detection. Do not guess a route from syntax, add a deployment route selector,
or fall through after JSON failure. Any future unified direct-input declaration
needs an explicit source contract; retaining the direct binding is not that claim.
Expose a named hierarchical focused target; no temporary review script or
standalone diagnostic command is the product.

R4 native binding: update the existing scientific-smiles proof to call the same
production assembly and configured InputInterpreter against a separate local
TLS model peer. Keep qualified CCCC/N=3, seed/settings and independent H-parent
oracle in smiles.json; rigid CCl/N=2 may legitimately shortfall. Preserve its
durable prepared identity, exact generated/native coordinates, host-confirmed
generator retirement before science, full result and lost-completion replay.
Reopen/replay exact terminal bytes without another conversation or science run.

R5 supplied routes: extend that same native lifecycle spine, not another framework.
Pasted: authored nonzero chloromethane table in nm, UTF-8 prefix, exact selected
byte span, independent x10 angstrom oracle and original atom positions.
Upload: mixed_records.xyz, unlike records 2,1, exact source bytes/hash/options,
water then chloromethane, original source positions and complete predictions.
Water loads H only; never impose the generated fixture's H/C expectation on it.
Extend host grants, prestarted-reader failure cleanup, source manifests and private
receipts for each scenario. Retain network none, separate preparation/science
grants, current measured resource/deadline bounds and exact-container retirement.
An outer native-fixture guard owns every prestarted-but-unused generator/reader
and prediction grant across setup/choice/refusal failures. InputPreparation owns
only allocations returned by its factories. Preserve the existing extra cleanup
currently supplied by PrestartedGeneratorInput without moving that test subclass
into production or claiming that a closed socket confirms host retirement.
Do not widen a limit or tolerance to make a fixture pass.

For every slice: reproduce missing behavior with focused contained tests, implement,
review code and important U/A, fix concrete findings, repeat to two settled
no-signal rounds, commit explicit -- FILE paths and record actual results here.
Runtime failures remain distinct from correctable input rejection; retain primary
and independent cleanup evidence privately, with safe recipient-specific context.
Do not log raw credentials, model transcripts, source contents or response bodies.

Closure and limits
------------------
This assembly milestone requires R1-R5, actual production-factory witnesses for all
three native routes, passing affected focused conventions and accurate operator
documentation. It does not close 003. Continuous Hello/discovery/readiness,
production host allocation/installation, capacity/population gates, configured
external-model behavior and actual API/GUI delivery remain explicit work. User
credentials, disclosed request material and network interface must be selected
before external invocation; local ephemeral TLS peers require none of them.

Sources inspected and adaptation rationale
-----------------------------------------
Local source snapshot above: controller.py:48-50 in provider_core owns adoption;
uploads.py:113 starts Job-bound deadlines; input_preparation.py owns allocations;
session.py owns native retirement. Native proof:
tests/integration/provider_core/normative/test_nmrnet_smiles_lifecycle.py,
tests/integration/provider_core/test_nmrnet_upload_session.py,
tools/worker_qualification.sh and tests/fixtures/preparation/smiles.json.
Reuse real owners/fixtures and their independent observations; do not copy checked
test subclasses or their allocation-derived disposable generation into runtime.

API 6a163b7a9cc1e2c7485b681c0b2b969c7c20e6c8:
nmr_api/provider/{credential_registration.py:80-139,private_signing_v1.py} and
nmr_api/security/private_signing_credential.py:52-123 own the issued artifact.
https://github.com/numpde/nmr-api-v1/blob/6a163b7a9cc1e2c7485b681c0b2b969c7c20e6c8/nmr_api/provider/credential_registration.py
SECS 7356c354368f2355d3ab5cef00cf48c67cea9c2c:
src/secs_inference/provider/{credential.py:49-108,config.py:54-81,113-165,main.py:67-105}.
https://github.com/numpde/secs-repro/blob/7356c354368f2355d3ab5cef00cf48c67cea9c2c/src/secs_inference/provider/config.py
Rationale: closed bounded TOML, one startup read and explicit trust/endpoint facts.
NMRPeak 1697dc84dd1d76ae25b04efc8183fd80614000e5:
nmrpeak_provider/{provider_config.py:91-225,provider_main.py:71-147}.
https://github.com/numpde/nmrpeak-repro/blob/1697dc84dd1d76ae25b04efc8183fd80614000e5/nmrpeak_provider/provider_config.py
Rationale: construct existing policy objects; admit identity before resources.
Magnet 600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf:
magnet_provider/provider_process.py:506-542.
https://github.com/numpde/magnet-deploy/blob/600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf/magnet_provider/provider_process.py
Rationale: load config and API-issued identity before acquisition; do not import
its multi-lane product architecture into this one binding.
Three independent read-only investigators supplied ownership, code/precedent and
science/qualification challenges. These are design findings, not runtime proof.
After correcting preallocation cleanup/order, authenticated discovery and the
separate direct-JSON binding, all three reviewers returned two settled rounds
without further actionable plan findings. Implementation proceeds tests first.

R1 implemented: API-issued credential admission, 2026-10-20
----------------------------------------------------------
provider_core.credential ports SECS's existing reader into the installed package,
using the core bounded JSON decoder and shared provider/credential reference
validators. It preserves the original seven-field canonical artifact, profile
vocabulary, Ed25519 pair and key encodings. Safe admission errors retain private
decode causes; private keys are excluded from repr. File permissions and intended
provider/profile binding remain startup responsibilities. No alternate credential
format, issuance, registration or dependency change was introduced.

The new focused make test/unit/provider-core/credential initially failed because
the parser did not exist; the port then passed 14 artifact/signing tests. These
include mismatched/actual non-Ed25519 keys, base64 padding bits, ambiguous JSON,
artifact identity and real signing with the admitted key. Five installed contracts,
seven launcher tests and 37 focused repository conventions passed, all contained
and offline. Changed Python lint/format, shell syntax and whitespace passed.
Three independent source/U/A reviewers returned two settled no-signal rounds.
The source and adaptation rationale are recorded beside the parser and its package
README. This closes R1 only; R2-R5 and normal service remain open.

R2 implemented: explicit startup configuration, 2026-10-20
---------------------------------------------------------
nmrnet_provider.config ports the SECS closed-TOML/descriptor startup pattern,
constructing existing policy objects as NMRPeak does. One public loader reads the
original issued signing credential, binds its provider/profile, admits ordered
interpreter endpoints and returns settings grouped by the actual runtime owners.
It acquires no HTTP, native worker or Attempt journal. Runtime assembly and a
continuous service remain separate work. Source revisions/locations, intentional
port differences and exact configuration fields are recorded in source/README.

One draft setting was removed during sibling review: analysis_kind_ref is now
code-owned peaks_from_mol, following G01's forward-prediction offering and SECS's
ownership of scientific identity. Deployers cannot relabel the computation.
Generation/recovery identities, origins, files and budgets remain explicit.
Extracted existing owner preconditions admit limits before allocating transports,
carriers or a storage executor; the constructors use the same unchanged rules.

The file port completes short reads and checks consumed length, regular-file
status, size, ownership/mode and final-component symlinks on the same descriptor.
Parent mounts remain host-controlled; this does not establish whole-tree safety
or immutable inode contents. Public errors keep owned field/operation reasons;
raw paths/parser evidence and independent close failures remain private. Exact
interruption identity and any previous cause survive a secondary close failure.
Explicit CA certificates are materialized from consumed bytes; empty CA input
cannot silently select system roots. Ambient OpenSSL root overrides and Python
TLS key logging are rejected. The observed checker runtime is CPython 3.12.12;
Lib/ssl.py::create_default_context was inspected directly for this rationale.
source_sha256 identifies only TOML bytes, not credential/CA/runtime closure.

Tests first: the new make test/integration/provider-core/config failed exactly
because the module was absent, then passed 14 focused tests. Actual local TLS
uses the admitted CA after its pathname is replaced; no external service or
native chemistry was contacted. Tests also exercise missing/unsafe secret files,
0400 permissions, owner mismatch, FIFO refusal, short reads/growth, read+close
failure, interruption causes, malformed/closed configuration, identity mismatch,
oversized numbers and forbidden ambient TLS settings. Existing focused input
interpreter tests (17), launcher regressions (7) and provider-core repository
conventions (37) passed. These establish configuration admission only; R3-R5
and normal provider service remain open.
Changed Python lint/format, shell syntax and whitespace checks passed. Three
independent code/authority/provenance reviewers reached two settled no-signal
rounds after the corrections above; the wrong-owner test now targets the key's
actual descriptor rather than accidentally rejecting the configuration file.

R3 implemented: configured Attempt assembly, 2026-10-20
-------------------------------------------------------
nmrnet_provider.runtime.assemble_attempt wires the admitted configuration into
existing JobUploads, InputInterpreter, InputPreparation, NMRNetSession and
AttemptController. SECS/NMRPeak startup sources and adaptation rationale are in
the module; no replacement scheduler, state machine, journal or transport exists.
ProviderAPI exposes its original signing capability so composition can require
that source and lifecycle API calls use the same configured identity, rather
than comparing copied credential claims. All HTTP roles retain separate owners.

Assembly checks scope/offering and retained inventory before passive wiring.
Its inventory check does not reserve work; the controller still performs its
own admission/claim checks at run. The caller must run the same pending start
and retains opened store/API lifetime. Scientific preallocations belong to the
caller on refusal, and transfer only when the controller is returned. A returned
but never-run controller can retire its allocation through settle. Cancellation
of preflight may leave the original threaded inventory read pending: the caller
must settle that exact read before retry or close. Lazy input factories remain
owned by the existing preparation owner; partial allocation stays factory-owned.

Tests first: the focused make test/integration/provider-core/runtime initially
failed because the module was absent, then passed nine tests (the three-route
case separately exercises SMILES, pasted nm coordinates and an ordered Upload).
All input facts come through actual signed local TLS jobs-page discovery; the
fixture verifies the discovery signature against the admitted signing key.
Separate local model/store peers prove credential separation and actual HTTPS.
Recording prediction ports prove complete result publication/durable confirmation;
this is neither native chemistry nor external-model/API qualification. Additional
witnesses cover changed input after discovery, retained obligations without
recovery, wrong signing identity/scope/offering, construction refusal before
ownership transfer, cancellation before/after adoption, and unconfirmed host
retirement preventing publication without a second scientific run. The Upload
tool fixture was corrected to include its required explicit alternate_location.
The prestarted-fixture cleanup handles only owned allocations; no host authority
is inferred from a closed socket or test recording.

Fourteen focused configuration tests, seven launcher regressions and 37 focused
repository conventions passed after this change. Changed Python lint/format,
shell syntax and whitespace passed. The existing direct-coordinate session
binding is unchanged and is not a guessed fallback in this interpreted assembly.
R4/R5 still need to run this same assembly with actual isolated native workers;
continuous service and external qualification remain open.
Three independent code/authority/provenance reviewers reached two settled
no-signal rounds after the fixture and handoff-test corrections.

R4 implemented: configured interpretation with native generation/science, 2026-10-20
--------------------------------------------------------------------------------
The existing make test/integration/provider-scientific-worker/smiles now runs
load_provider_config and assemble_attempt, with actual InputInterpreter over a
separate local TLS model peer. The API-shaped disposable signing artifact is consumed through
the same credential loader and signs actual jobs-page discovery. Selected facts
construct the pending start; the original verified Job text feeds two scripted
model turns (prepare_smiles, submit). This qualifies the interpreter wiring, not
external model behavior or a deployed API. Configuration uses its explicit stable
fixture generation identity; host allocation labels are not deployment defaults.

The CCCC/N=3 case, seed 20261019, ETKDG settings, independent literal atom/H-parent
oracle and original bounds remain unchanged. Actual native returned coordinates,
stereochemistry, source span, durable identity, complete H/C predictions and exact
terminal bytes remain checked. Confirmed generator retirement still precedes
prediction. A lost completion is replayed after store reopening with no additional
conversation, generation or inference: two model exchanges, one native generation,
one scientific preparation/execution, two identical completion sends.

PrestartedSourcesRetirement replaces the input-owner test subclass. This fixture
owns prestarted hosts even when interpretation refuses before factory allocation;
it services every source host before the prediction host, matching the host script.
Normal preparation still owns only returned allocations. Outer base-host cleanup
covers setup failures. Audits additionally closed discovery/store-open cleanup,
pre-adoption prediction-channel cleanup and pending preflight settlement. Replay
now retains/settles its exact recovery owner before releasing a borrowed claim,
and independently observes store/API cleanup; primary failures and prior
cancellation causes survive later close/retirement failures. Focused fault tests
exercise these setup and retirement boundaries. No production cleanup framework
or new scientific policy was introduced.

The native lane passed after all corrections. Final selected private evidence:
.work/qualification/provider-lifecycle-nmrnet-worker-proof-H5uNlP2F/
  summary.json SHA-256 8dd4c4b16383f32d0bbb309c68bdb798f69817e4e09c27626397d074781502db
  scientific-result.json SHA-256 dd0f0a1b0b930fec594959ab35c34afff5bef5fe6d4d8e9f98b018d7e00e5cf7
    35247 bytes; preserves actual result and interpretation provenance.
  sources.sha256 SHA-256 6751ea270d4a4d527eada57bae1d9d8fbf101c9a18e4ccbed39a8cf019941ba1
The host checks source hashes before/after and preserves independent posture,
stopped/removed and source/science retirement receipts. The new configuration
test helper joins both host manifest and consumed execution identity. Private
keys, disposable successful journals and raw model transcripts are not retained.
Earlier successful route runs preceded cleanup audit corrections; this final
source-bound receipt supersedes them. R5 supplied-native routes and normal
service/external qualification remain open.
Changed-file lint/format, seven launcher tests, 37 focused repository conventions,
shell syntax and whitespace passed. Three independent U/A/code reviewers reached
two settled no-signal source rounds. Their final provenance correction records
the credential as API-shaped, not actually issued/registered by the fixture API.

R5 implemented: supplied native routes on the same lifecycle, 2026-10-20
------------------------------------------------------------------------
tests/integration/provider_core/native_lifecycle.py extracts the qualified R4
spine at 6f8a763: configured assembly, actual interpreter, signed local discovery,
durable execution entry, exact host retirement, complete result and lost-completion
replay. Molecular selection and independent expectations remain route-local.
The host's existing optional source slot is now named geometry and carries either
the generator or reader. No extra allocator, lifecycle, native parser, public route
selector, framework or credential owner was introduced. Three containers remain:
geometry and controller at 512 MiB/2 CPUs/64 PIDs, science at 4 GiB/2 CPUs/64 PIDs;
all read-only, nonroot, network none, cap-drop ALL/no-new-privileges, without swap
beyond memory limits. Preparation receives neither models nor API/model secrets.

make test/integration/provider-scientific-worker/pasted selects an authored
chloromethane table in nm from an exact UTF-8 Job byte span. The independent
expected.json oracle fixes atoms H/Cl/C/H/H and angstrom literals. An initial
places=12 assertion was replaced following monitoring review. For exact source
decimal x, parsed binary64 p=RN(x) and multiplication y=RN(10p), the explicit bound is
  |y - 10x| <= 10|p - x| + 0.5 ULP(RN(10p)).
nm_conversion_oracle derives this allowance using exact Fraction arithmetic from
fixed source/target literals before reader execution; it first proves target=10x.
The test requires radix 2, 53-bit significand and round-to-nearest. For these
fixed finite normal values, parsing contributes its exactly computed error and
one multiplication contributes at most half an ULP; 10 itself is exact. Zero
has zero allowance. No observed output chooses the bound, and no chemical or
decimal tolerance is fitted. Source/hash/span/record/replay identities stay exact.
The scientific unit reference remains input_geometry.coordinate_conversion and
fixture README reference 6. This refinement strengthens fixture proof; it is not
evidence of incorrect runtime chemistry.

make test/integration/provider-scientific-worker/uploads selects XYZ records 2,1:
water then chloromethane, positions [10,11,12] then [3,4,5,6,7]. Actual signed
membership/read-capability operations and a separate TLS store provide verified
source bytes; API/model/store credential separation is checked at each peer.
Reader options, original records, atom order and angstrom coordinates are exact.
Water requires H only; chloromethane requires H/C. Source retirement is confirmed
before science. Both supplied routes run one reader and one scientific batch;
pasted uses two model exchanges, Upload three. Two identical completion sends
establish replay after storage reopening without another conversation or execution.

Native Upload exposed an independent fixture verifier's assumption that every
POST carries JSON. The API read-capability route is bodyless. The shared reply
now checks its actual body is empty, and the verifier checks the bodyless signature
base and absence of content type/digest. JSON lifecycle requests retain digest
verification. This corrects the verifier, not production signing. Review also
separated pasted selection=None from its returned record 1, and preserved exact
Upload selection (2,1). Setup/refusal/cancellation cleanup remains the R4 owner.

Final native runs passed against the same shared source snapshot; selected private
receipts under .work/qualification/provider-lifecycle-nmrnet-worker-proof-:
  TCGhjV1l/ (pasted)
    summary.json SHA-256 854a4427290da202183d7b4b0269aca2c9028c5704a4f44d34d6905ab624bab5
    scientific-result.json SHA-256 1787fc519ef84c8924145eda495d322de1a84f8ed7e1d7dd57ed42b1c14df8fd
      22339 bytes
    sources.sha256 SHA-256 4b3a14cd139b575770e9692ad6ccd0c9ab7732e4d0474b5a7e1fb7891f6c485c
  UXfNPn23/ (Upload)
    summary.json SHA-256 8747bf7bd39a2d2f22e69c16124615d94ed02ef51bb54c378751ef1542093006
    scientific-result.json SHA-256 05e00186a420bafd48f787df493496239bfd5e0e996916a1a4f765417ea20ab9
      23743 bytes
    sources.sha256 SHA-256 c37a8492f47447483949e0bdf24a431e509b6a5161ebc2b2fb9778d012976431
  vW35e07o/ (SMILES regression)
    summary.json SHA-256 fb1f69512cd65ddd12f6740b6964b0cb24a10d5d23f73e3303f29763fc81b9a2
    scientific-result.json SHA-256 a2bb5355af591a3a6bfd3b81da79b7e247601deea74ab26ed5b857d963d2d3b5
      35559 bytes
    sources.sha256 SHA-256 bd8530c6d6b18ceb92d9f0686ed01e59e1f0258140b5d9bfeda298b4ad2d64f6
Each retains actual results, consumed source/model/runtime/interpretation identity,
posture, independent source hashes and exact-container/grant retirement receipts.
Successful keys, journals and raw model transcripts are discarded. Earlier R5
receipts predate verifier/source corrections and are superseded, not fresh proof.
The failed Upload verifier run retains private diagnostics at
/tmp/nmrnet-worker-proof-KRAB2BaX; its host timeout does not establish chemistry.

Focused lifecycle tests passed (8 setup/cleanup/source tests; 3 native cases skip
outside their selected host lane); launcher tests (7), repository conventions
(37), changed-source lint, shell syntax and whitespace passed. New/reworked
Python files pass formatting; unrelated old formatting in test_live_worker.py
was preserved while changing only its verifier. README stale integration claims
were corrected to distinguish carrier/planner scope from actual native proof.
Independent code, authority and scientific-provenance/U&A reviewers reached
two settled no-signal rounds after the verifier and documentation corrections.
This completes R1-R5 local assembly qualification, not 003: normal service,
production allocation/installation, four-reference/capacity/population gates,
selected external interpreter and actual API/GUI delivery remain open.

Next closure work: normal provider operation, 2026-10-20
-------------------------------------------------------
R6 adds the missing Hello wire operation to provider-core before a service loop.
Composition retains display text, code-owned scientific offering and scheduling;
core prepares one complete bounded announcement, signs/sends once through its
existing transport and admits the identity-bound acceptance receipt. Acceptance
is an announcement/heartbeat fact, never scientific readiness. On response loss,
keep acceptance unknown; do not automatically replay a stale snapshot. The outer
service can deliberately publish its current complete snapshot on its next send.
No second API client, request framework, retry policy or deployment command.

Tests first: normative/adversarial Hello body and receipt tests, followed by actual
local TLS signed acceptance, malformed/wrong-provider replies, lost response and
cancellation/retirement. Use named focused unit/integration targets, existing
installed-wheel harness, package inventory and guard checks. Verify Unicode scalar
bounds, closed schemas, original ordering, unique analysis kinds and safe errors
without echoing presentation text or private response bodies. Independent audits
must distinguish wire acceptance from readiness and preserve recipient causes.
Exact authority: API 6a163b7a9cc1e2c7485b681c0b2b969c7c20e6c8,
nmr_api/provider/routes.py::PROVIDER_HELLO_ROUTE and
nmr_api/provider/schemas/hello_{request,response}.v1.schema.json; adaptation from
SECS 7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/hello.py::prepare_hello/parse_hello_receipt and
provider/api.py::publish_hello. Reuse core's reference/JSON/timestamp/transport
owners rather than duplicating sibling helpers. This is note017's missing shared
operation, not migration of the sibling's synchronous process or retry machinery.

Then connect admitted configuration/storage, periodic current Hello, bounded
authenticated discovery, one Attempt and graceful shutdown through existing core
owners. Keep observation/recovery holds and readiness as separate facts. Production
host allocation/installation and enforced network grants follow that ownership
contract; do not promote fixed prestarted qualification allocations into a service.
Local implementation/qualification proceeds without external credentials. Actual
API/GUI and model qualification require the selected deployment/endpoint, explicit
credentials and disclosure/network authorization before contact, as already above.

R6 implemented: shared Hello wire operation, 2026-10-20
-----------------------------------------------------
provider_core.hello owns AnalysisOffering, hello_body, read_hello and HelloAccepted;
ProviderAPI.publish_hello uses the existing signed transport once. Composition
supplies the expected provider and complete current presentation. Existing core
reference, JSON, timestamp, envelope and private-failure owners are reused. Empty
offerings intentionally withdraw the advertised set; no old request is scheduled,
journaled or replayed. Equal accepted_at timestamps remain legal. Acceptance is
an announcement fact then, neither readiness nor proof no newer publisher exists.

Request validation precedes signing/send. Unicode scalar bounds, NUL/surrogate
rejection, at most 64 unique kinds, original order and wire byte ceiling match
the API authority recorded in R6's plan. UTF-8 serialization preserves maximum
legal supplementary Unicode without unnecessary surrogate-escape expansion.
Malformed/foreign successful receipts retain the exact private response/cause.
HTTP/transport failures and cancellation keep their original evidence, with a
safe note that acceptance is unconfirmed, the directory may already have changed,
and no retry occurred. Attempt/grant effect flags are not used for Hello.

Tests first reproduced the missing module through the installed-wheel unit lane.
Focused unit tests then passed (7), local TLS integration (3), installed package
contracts (5) and launcher selectors/grants (7). The TLS witness loads an API-shaped
disposable credential, independently verifies the actual digest/signature and
checks the identity-bound receipt. Lost response sends once; only an explicit new
caller snapshot sends again. Cancellation preserves failure evidence and confirms
socket cleanup. Its test name was corrected after audit: ordinary cancellation
may already settle transport ownership, so it does not claim ownership must remain
until a later retire call. Existing transport tests own unfinished-cleanup cases.

New hierarchical targets are test/unit/provider-core/hello and
test/integration/provider-core/hello. The latter uses the same isolated installed
harness and structured integration/hello/{normative,adversarial} layout as chat,
without consumer source grants. Wheel inventory, own container guard and cold
independent imports include the new module. No dependencies, external calls,
service scheduling, configuration or scientific offering changed in this slice.
Focused repository conventions (37), lint/format, shell syntax and whitespace
passed. Code, authority and provenance/U&A reviewers reached two settled
no-signal rounds after the cancellation proof-label correction.
Normal service, topology/correlation admission and the remaining 003 qualifications
stay open. Sibling repositories and NMRNetplusplus remain unchanged.

Next prerequisite: API environment and diagnostic correlation
-------------------------------------------------------------
Before normal service, port the response boundary already identified in note017.
R7a preserves protocol-neutral received status/headers when response streaming or
cleanup fails. Only a complete body yields HttpResponse. Failed/unfinished I/O
retains its exact owner and private causes; late retirement augments the same
failure object. No partial response becomes admission or mutation confirmation.
Tests first cover body failure, overflow, cancellation and late received headers,
plus actual TLS truncation/timeout. No API header semantics enter HttpTransport.

R7b then requires an explicit configured API topology (dev-local/dev/web) for all
ProviderAPI operations, captures valid singleton header correlation before body
admission, and admits reviewed problem meaning only with matching body/header
request identity. Reject missing/duplicate/wrong topology; preserve trustworthy
correlation through malformed/failed responses. Chat/store transport remains
protocol-neutral. Exact source: API 6a163b7a9cc1e2c7485b681c0b2b969c7c20e6c8,
nmr_api/edge_topology.py, entrypoints/_edge_runtime.py::send_with_topology,
request_ids.py and security/problems.py; precedent SECS
7356c354368f2355d3ab5cef00cf48c67cea9c2c provider/http.py:290-377 (under
src/secs_inference/). This is existing whole-client qualification work, not a
new generic transport policy. Service composition follows these prerequisites.
Its retained inventory and full-obligation capacity check must precede native
allocation: confirmed records still occupy store slots. A full store holds
admission; never delete journals silently to claim sustained service. Independent
service reviews also require bounded provider-wide inventory, separate Hello I/O,
exact controller settlement and host-owned partial-allocation cleanup.

R7a implemented: received metadata survives failed I/O, 2026-10-20
-----------------------------------------------------------------
ExchangeFailed.response_head privately retains received status/raw headers, with
headers excluded from repr. HttpResponse still requires full body consumption and
confirmed cleanup. The original causes, byte accounting, deadlines and retirement
gates remain; no response body is promoted from failed I/O. Transport interprets
neither API topology nor request identity. The same retained failure gains later
head/cause observations during explicit retirement.

An audit found that storing metadata only in the worker task's local result lost
already-received headers while cleanup resisted cancellation. A focused test first
reproduced response_head=None despite a known body failure and received headers.
One private _Exchange now groups the actual task, shared _Outcome and caller,
replacing separate task/pending-owner fields. Known heads/causes remain reachable
while held; only the existing completed-task/clean-retirement gate releases the
owner or returns a complete response. Primary body failure and timeout interruption
are both preserved. Tests also cover late headers after a resistant send, exact
cancellation, overflow and foreign-owner refusal. The real TLS witness checks
truncation/body timeout and preserves the actual Content-Length header casing.

Tests-first initially failed on the absent response_head attribute. The corrected
focused installed transport suite passed (13); local TLS test passed in both modes
(one parametrized test); launcher tests passed (7). No external network, new
dependencies, changed numerical tolerance, scientific execution or sibling edits.
Focused repository conventions (37), source lint/format, shell syntax and whitespace
passed. Code, authority and provenance/U&A reviewers reached two settled no-signal
rounds after the held-cleanup correction.
Exact parser source inspected in the retained httpcore-1.0.9 wheel:
httpcore/_async/http11.py:45-63,170-199; its existing framing/header machinery is
unchanged. R7b must still consume this evidence at the API boundary. Service,
capacity/retention policy, production host allocation and final 003 qualification
remain open; the metadata carrier alone claims none of them.

R7b implemented locally: API environment and correlation admission, 2026-10-20
------------------------------------------------------------------------------
ProviderAPI now requires expected_topology explicitly: dev-local, dev or web.
There is no optional/default bypass and no derivation from credential profile
(which instead includes run). Startup's closed API table requires topology;
ApiSettings and both lifecycle/source clients carry it. assemble_attempt rejects
the same signing capability with a different configured topology before reading
store inventory or adopting the caller's prediction allocation.

All API operations admit content type, no-store, absence of content encoding and
exactly one matching Nmr-Api-Topology before interpreting a body/problem. Success
request IDs remain optional, as in the API/SECS contract. A valid single bounded
visible-ASCII X-Request-ID remains diagnostic correlation through wrong topology,
malformed body, truncation or late transport retirement. Duplicate/invalid IDs
never become trusted correlation. Reviewed problem meaning additionally requires
the body's request_id to match the header; no status alone establishes no change.
ApiFailure.status/request_id derive directly from the complete response or original
ExchangeFailed.response_head, so they cannot become stale copies. Late observations
never assign a problem code or recalculate/lower retained mutation uncertainty.
No recursive exception search, response registry or new metadata authority exists.

Existing API constructors now pass an explicit fixture/configuration value. This
mechanical change was generated with AST call locations in a contained checker,
reviewed as a diff and applied by the coordinator; the deliberate missing-keyword
test stays missing. Legacy caller formatting was limited to changed constructor
ranges/imports; new/maintained code uses the normal formatter. API-only local TLS
fixtures supply authored environment headers, preserving explicit adversarial
headers verbatim. Mixed model/store peers keep their generic transport/headers.
The generic TLS peer now applies explicitly supplied headers to truncated/stalled
replies as well, allowing an actual received-correlation witness.

Tests first reproduced the missing keyword contract. Focused API/mutation tests
initially passed (46), including original verified-refusal and durable TerminalHeld assertions.
Review found two remaining problem fixtures with only Content-Type; these now
provide full no-store/topology and matching header/body IDs rather than weakening
their assertions. Unknown/malformed problem bodies retain valid header correlation.
Final audit added an otherwise valid success body with duplicate request IDs: a
malformed-body-only case could mask removal of duplicate-ID rejection. This
strengthens the independent negative witness without changing runtime policy.
Actual TLS API test passed all four cases: foreign environment, malformed body,
truncation and body timeout. Configuration tests passed (15), configured runtime
(10, including same-key/wrong-topology refusal), Hello TLS (3), and launcher (7).
All changed Python passes lint; 18 maintained/new Python files pass full formatting.
No dependencies, scientific meanings, model/scaler bytes or native budgets changed.

Authority and adaptation are the pinned API/SECS sources in the R7a/R7b plan above
and the source/README links at the actual API boundary. R5 native receipts remain
historical evidence for their recorded source snapshots; they are not relabeled
as current qualification. Fresh native refresh and final audit evidence follow.
Normal service, retained capacity/retirement policy, production allocation and
actual external/API/GUI qualification remain open; 003 is not closed.

Final R7b evidence: focused API/mutation tests passed (47), including the added
valid-body duplicate-ID witness. Installed package contracts (5), repository
conventions (37), and shared lifecycle fault cases (8; three native cases skipped
in that cheap lane) passed. Changed-source lint, maintained-source formatting,
shell syntax and whitespace checks passed. Independent code, authority and
provenance/U&A reviewers reached two settled no-signal rounds. No broad suite ran.

The three native routes were then refreshed sequentially against the R7b source
snapshots, without changing sources between runs. Private receipts below retain
safe scientific results/source manifests and confirmed exact host retirement;
keys, raw model transcripts and journals are not preserved. Each run executed
science once, reopened storage and replayed the exact terminal request without
another scientific execution. Pasted used one reader/two model exchanges; Upload
used one reader/three exchanges and retained record order (2,1); SMILES used two
model exchanges. These remain local scripted-model/TLS qualifications, not external
interpreter behavior, published accuracy, sustained capacity or deployed delivery.

.work/qualification/provider-lifecycle-nmrnet-worker-proof-bHa9lqct/ (pasted):
  summary.json sha256 afd744fb413b62aa86fe7b8cf61f952fd80ad2e8b08ee72a920f2d654739fa68
  scientific-result.json 22753 bytes, sha256 a33cfa4a5fe449df0f4b0fe9fd7d942d7ccc63cf5f66dc555e7ce5c8c7f6a5fe
  sources.sha256 sha256 1cb7eadf3dd011e859c54bd40af3d4822fc5a1ae34692ebc6ae5b07cd5fa6818
.work/qualification/provider-lifecycle-nmrnet-worker-proof-3drNyuaB/ (Upload):
  summary.json sha256 427623fdeccbbc8c332ab9bcca0c83f405cfd71f92ae3b949ad18e5f1d214d0f
  scientific-result.json 24157 bytes, sha256 edfc48bfe3952553ba3338f45c8adbe9c9a33d676929e3641f36c0c210b6e758
  sources.sha256 sha256 c578992e6c3a718e5365b9d49bea769199a3e6de13c14f092f85eb43b9ea80e8
.work/qualification/provider-lifecycle-nmrnet-worker-proof-dKfGPkrT/ (SMILES):
  summary.json sha256 b37831986534f9a243f8842d24431102580c92f22ccf50909b7a1f670cd37b12
  scientific-result.json 35973 bytes, sha256 0295377ef4d5061176f27292a867448f49e33f7f315826a61d7773c61cb5f00a
  sources.sha256 sha256 f00d4d2cbede103812173c213e3000dd9e0f2e5da5c41c9c5664ab7654f78085

The earlier R5 receipts above remain tied to their original source snapshots.
The fixed independent nm/angstrom literals and exact binary64 conversion budget
are unchanged by this API slice; exact source/atom/request/replay identities stay
exact. Passing these fixtures does not close the service/deployment exits of 003.

R8 plan: normal service using the existing lifecycle owners, 2026-10-20
---------------------------------------------------------------------
R8a first exposes a serialized, owner-aware AttemptStore.admission_inventory read.
It returns the existing records only after checking a free logical slot and the
same full-obligation/staging filesystem headroom used by admit. Reuse that exact
calculation; keep authoritative admission/replacement checks in place. Preflight
observes capacity, reserves no physical blocks, changes no records and authorizes
no execution or recovery. Tests first: empty/nonempty read without mutation,
confirmed-record saturation, low space, failed filesystem observation and cancelled
I/O retaining its exact owner. A focused contained target owns these checks.

R8b supplies the NMRNet-owned service admission/loop around existing controller,
API and store owners. Startup checks local obligations/capacity and a bounded
provider-wide inventory before initial current Hello or fresh discovery. Any live
remote row, regardless of analysis kind, holds fresh admission while recovery is
explicit; there is no need to build/deduplicate a partial remote inventory when
the first row already refuses all new work. Empty pagination must terminate within
explicit page and exchange limits; cycles/incomplete traversal never mean empty.
Select the first eligible signed feed row in server order, retain one fresh start
key, then ask a trusted host factory for the existing AttemptController. The factory
owns partial allocations until returning; the service owns the returned controller.
No new execution/replay journal, scientific transformation, command or engine grant.

Use separate Hello transport/task ownership so publication can refresh during a
blocked Attempt. A later publication is a current complete announcement, never an
old queued mutation. On stop, prohibit new admission, drain then cancel/observe
the original invocation under explicit bounds, settle its exact controller and
join Hello before releasing dependencies. Keep held work and independent primary/
cleanup failures; no replacement until retirement is confirmed. Initial policy
may refuse automatic recovery/outages rather than silently retry uncertain work;
continuous-outage recovery and confirmed-record retention need explicit tests/policy
before claiming sustained service. Readiness remains distinct from Hello acceptance.

Tests use actual installed core and local TLS with recording scientific ports:
zero allocation under local/remote/capacity holds; exact discovered source/key into
the existing controller; independent Hello during held execution; idle/discovery/
partial-allocation/active-work stop; failed retirement or lost completion preserves
records and never reruns science. Native/external/deployed qualifications remain
separate. Keep focused routine lanes; repeat expensive native routes only when a
changed boundary requires new evidence. Important U/A and code audits run after
each coherent change through two settled no-signal rounds, then explicit-path commit.

Sources and rationale: NMRPeak 1697dc84dd1d76ae25b04efc8183fd80614000e5,
nmrpeak_provider/provider_process.py:192-214,263-320,445-495 and
attempt_inventory.py:62-116,130-183 establish startup inventory before publication,
bounded traversal and shutdown ownership; its thread/two-lane machinery is not
needed here. SECS 7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/process.py:38-108 and runtime.py:113-140 establish
paced publication and preservation of independent service failures. Adapt current
async owners; do not copy frozen announcement retries or invent a second scheduler.
Current core attempt_files.py:208-275 owns the capacity arithmetic. Configured
assembly at 33cc2c9 receives an already allocated prediction port, so its existing
inventory check alone cannot prove allocation-after-capacity ordering. These are
the precise gaps R8 addresses; this plan does not claim service implementation.

R8a implemented locally: capacity preflight before allocation, 2026-10-20
------------------------------------------------------------------------
AttemptStore.admission_inventory is an ordinary serialized, owner-aware read;
AttemptFiles reuses one _require_new_record_capacity helper for preflight and new
admission. Idempotent admission of an existing exact record still precedes this
fresh-slot check. No new filesystem formula, reservation, cleanup or retention
policy was added. The returned records remain the consumer's lifecycle/recovery
authority; a full-capacity failure is itself a truthful fresh-admission hold.

Tests first failed because the method did not exist. New normative/adversarial
tests then passed: unchanged empty/nonempty inventory without consumed slots,
confirmed-record saturation, changed headroom rechecked by actual admission,
private filesystem failure with blocked reuse, and cancelled I/O held until the
exact owner observes it. Review added an independent future-obligation witness:
with one tiny pending record and spare logical slots, two full record budgets of
free bytes are insufficient for existing-record growth, a fresh obligation and
staging; three suffice, with retained bytes unchanged. This does not copy the
implementation formula or claim native workload capacity.

make test/unit/provider-core/admission passed (17: six new preflight cases plus
11 affected store cases); launcher tests passed (7), focused repository conventions
(37), changed-source lint/format (five Python files), shell syntax and whitespace.
Code, authority and provenance/U&A reviewers reached two settled no-signal rounds
after the independent capacity witness was added. No broad/native suite, dependency
change, external network, sibling edit or changed scientific tolerance occurred.

R8b must call this preflight before its host factory; the new store method alone
does not establish service allocation ordering. Observed-empty remote inventory
will also remain an observation, not a cross-process fence: host singleton ownership
and server Attempt admission keep their authority. Service/production allocation,
retention policy and external/API/GUI exits remain open; 003 is not closed.

R8b admission routines implemented locally, 2026-10-20
-----------------------------------------------------
nmrnet_provider.admission now owns two ordinary asynchronous observations:
require_admission_ready and select_pending_start. An explicit AdmissionPolicy
delegates page-size grammar to core and bounds pages. Both calls require the
admitted configuration, the same signing capability/API topology and an explicit
I/O owner before any request. The readiness check also binds store recovery scope,
uses R8a preflight and refuses retained nonconfirmed work. It then requires a
complete empty provider-wide live inventory; the first row of any kind holds
fresh admission, with its original observations retained privately. No collected
inventory registry or reconciliation map is needed for this refusal policy.

Selection starts at cursor=None, follows bounded empty pages and takes the first
server-ordered eligible peaks_from_mol Job without a provider Attempt. It preserves
the exact returned input facts and generates one 16-byte random start key only
after selecting a row. start_body is encoded once into the in-memory StartPending;
the existing controller remains the retention-before-send authority. Complete
empty discovery returns None and creates no key. Cursor cycles and continuing
pagination at the bound raise a safe hold, never partial readiness or idle.
Underlying API/store failures and cancellation propagate unchanged. Calls reserve
nothing, allocate nothing and recover nothing. Their page count combined with the
existing finite whole-exchange/retirement budgets bounds traversal work; no new
timeout/retry mechanism or cross-process exclusion claim is introduced.

Tests first failed on the missing module. Actual installed core/local TLS then
exercised two-page empty inventory, malformed second pages, cycle and exhaustion
on both walks, cross-kind remote work, local pending work/low space, identity/
topology/scope/owner/policy refusal, fresh idle walks and first server-order selection
(job:z before job:a). Independent signatures and bearer absence are checked on
the actual inventory/feed requests. The selected exact input/scope/key/body also
passes through assemble_attempt and the original controller to one complete result.
Recording scientific ports pre-exist in this fixture; these tests do not establish
host allocation-after-admission ordering or native/model readiness.

Review corrected a cancellation test's label: ordinary cancellation proves its
preserved failure evidence and no retry, not necessarily pending cleanup. R7a
already owns the cancellation-resistant transport proof. New overridden API
fixture routes now reuse the base peer's credential-separation check before
returning replies; model/store peers retain their separate credentials. A cycle
witness now allows a third page but requires rejection on the second, so the
independent page-limit guard cannot mask a missing cycle check. The existing
configuration fixture gained an explicit slot-count argument (default unchanged),
allowing a genuine unresolved-record refusal with spare capacity instead of
accidentally proving only saturation. No input tolerance or scientific policy changed.

Sources/rationale are beside admission.py: pinned NMRPeak bounded inventory and
startup ordering, pinned API visible live inventory, and core's existing page/
start authorities. This is the admission part of R8b, not its outer service loop.
The service coordinator must serialize fresh readiness, selection and factory
handoff, reobserve after abandonment, retain interrupted factory/controller tasks,
and enforce stop/retirement before replacement. Continuous Hello, production host
allocation/installation, retention policy and external/API/GUI closure remain open.

Final admission-routine validation: make test/integration/provider-core/admission
passed (10), affected configured runtime (10), launcher (7) and focused repository
conventions (37). Changed Python lint/format (seven files), shell syntax and
whitespace passed. Independent code, authority and provenance/U&A reviewers reached
two settled no-signal rounds after the fixture corrections. No broad/native rerun,
new dependency, external network, sibling or upstream change occurred. Prior native
receipts remain evidence for their recorded source snapshots, not this later helper
addition. The outer service remains the next behavioral allocation-order boundary.

R8c service coordinator: tests-first implementation contract
------------------------------------------------------------
ProviderService owns one retained work task/controller and one independent Hello
task/API, using a fresh configured Hello transport. Explicit ServicePolicy groups
the existing admission policy with finite idle, Hello, drain and settlement waits;
there are no cadence defaults. A synchronous current_announcement callback supplies
the complete current display/description/offerings. Provider identity stays fixed
to configuration. on_started is synchronous and means startup gate plus initial
Hello acceptance, not model/scientific readiness or continuous availability.

run(stop) accepts one invocation: startup gate, initial current Hello, then paced
independent Hello and fresh admission/selection work. A trusted asynchronous
open_attempt factory returns the existing assembled controller. It owns partial
allocations AND interrupted setup I/O until successful return; a clean refusal
must settle both. In particular assemble_attempt's records(owner=None) read belongs
to that factory while setup is outstanding. No service code may adopt arbitrary
owner=None storage I/O as its own. The retained original work task contains the
factory invocation; a late controller is assigned before any stop check, then
settled without running if stop was requested. A task still pending after a bounded
wait remains retained; neither timeout nor cancellation confirms host retirement.

Stop first prevents new allocation, permits a bounded drain, then requests one
cancellation and observes the original task. Controller settlement never overlaps
its run invocation. Observe simultaneous Hello/work failures before claiming clean
stop; preserve primary, independent and cleanup causes with safe outer text.
settle observes original owners only, including service-owned preflight I/O;
caller-owned API/store lifetimes are not closed here. Failed settlement holds the
service/controller and forbids replacement. Startup/publication/discovery outages
stop this first coordinator; blanket retry, stale Hello replay and implicit
recovery are excluded. Explicit outage and retention policy remain 003 work.

Focused local TLS witnesses must allocate the recording scientific worker inside
the trusted factory, prove initial gate/Hello/discovery/allocation/controller order,
zero allocations on holds, refreshed current Hello during blocked execution,
already-stopped and startup/callback failure, stop during late/resistant factory
and active execution, held retirement and independent failures, setup-read
cancellation with original settlement, and lost completion without another run.
This proves coordinator ordering with recording allocations; host provisioning,
native retirement/capacity and actual external/deployed workflow remain separate.
Source rationale is the R8 NMRPeak/SECS ordering/join evidence above and current
core controller.py:81-121,133-166. No new lifecycle implementation belongs here.

R8c implemented locally: service ordering and shutdown, 2026-10-20
----------------------------------------------------------------
ProviderService now uses R8a/R8b and the original core controller. The dedicated
Hello API is constructed from a fresh configured transport, independent of feed/
lifecycle and source/model I/O. Startup gate precedes initial Hello; on_started
means only that these startup observations finished. A serial work task performs
fresh admission/selection before factory handoff, adopting the returned controller
before checking stop. Current empty offerings pause fresh allocation; a withdrawal
during admission/discovery discards the selected in-memory start. Already handed-off
work remains owned until completion or stop. The code makes no scientific-readiness
or cross-process singleton claim, and supplies no engine access or install command.

Stop requests bounded drain, then one cancellation and observation of the original
work task. A resistant factory stays inside that retained task and can later return
a controller which is retired without starting. Controller settlement starts only
after work ends; its own retained task allows bounded observations without issuing
another retirement while the first is pending. Explicit later settlement can retry
a finished failed settlement through that same controller, never its scientific
run or publication command. Store/API cleanup admits only the service's original
I/O owner; setup reads with owner=None remain the factory's responsibility.

ServiceFailed renders owned operation/recovery context and retains an ordered
protected tuple of (operation, original failure). Task callbacks retrieve failures
without letting abandoned waits print private evidence. Mixed cancellation/cleanup
groups stay intact. Factory-owned partial allocation failures remain explicit host/
caller obligations, even after local service tasks and dependencies are settled;
service settlement alone cannot certify their native retirement or safe replacement.
The recording factory retains its allocated ports for that separate cleanup.

Tests first failed on the missing module. Initial five local TLS tests passed;
review then found three defects, each reproduced by a failing focused witness:
withdrawal during discovery still allocated; a BaseExceptionGroup escaped state/
cleanup handling; and cancellation during one cleanup skipped later independent
obligations. Corrections resample intention immediately before handoff, retain the
original group with state transition in finally, and attempt independent cleanup
before re-raising cancellation. This preserves the cancellation object and earlier
failures rather than converting them into clean shutdown or generic strings.

The expanded focused suite passed (18): actual signed inventory/Hello/discovery ->
recording worker created inside factory -> original assembly/controller/result;
current independent Hello during blocked execution; already-stopped/no allocation;
remote/full-confirmed/low-space holds; initial Hello/callback failure; active drain
and forced stop; caller cancellation with original API cause; delayed real factory
setup read retained until its exact I/O settles; resistant late factory; grouped
setup/cleanup failure; Hello plus scientific-retirement failures; pending controller
settlement repeatedly observed without a second host-retirement call; and lost
completion retained byte-for-byte without another allocation, execution or replay.
The store remains open/caller-owned; its entered or pending terminal obligations
still require explicit recovery and confirmed records still consume capacity.

Focused launcher tests passed (7), affected repository conventions passed (37),
and changed Python lint/format, shell syntax and whitespace checks passed. No
broad suite or native/scientific rerun was needed for this recording-only slice.
After the corrections, code, ownership/privacy and proof/science reviewers each
returned no actionable finding in two complete settled rounds on unchanged code.

These are local TLS/recording-allocation witnesses. Host provisioning/retirement,
native service qualification, production installation/network grants, recipient
diagnostic delivery, outage/retention policies and external interpreter/API/GUI
workflow remain open before 003 closure. R5/R7b native receipts retain their original
source identities; the service tests do not silently recertify those receipts.

R9 runnable local service: production workers and post-admission allocation
-------------------------------------------------------------------------
Prioritize the connected local path: production worker entrypoints, host allocation
after admission, then one native Upload service witness. Batch focused validation
and review around changed boundaries; do not repeatedly rebuild or recertify
unchanged science/package boundaries. Optional extraction and general machinery
do not advance this path. Full 003 still requires its other explicit exits.

The production worker command has exactly three host-selected roles: prediction,
reader and smiles. Fixed /ipc endpoints and model paths preserve the qualified
grants. Require allocation and finite accept/I/O budgets; smiles also requires the
existing GenerationSettings and generation/channel relationship. Prediction must
compare both embedded dependency declarations before scientific wiring, then
publish observed runtime metadata. Bind/listen before allocation-bound readiness;
this is channel readiness, not loaded-model or chemical readiness. Never adopt,
overwrite or unlink prior IPC evidence. Host retirement remains the only owner of
exact-container stopping and IPC release. Reuse all existing serve_* routines.

Next the host grants private request, host-written receipt and IPC parent roots
before starting the controller. Running controllers cannot gain new bind mounts.
Requests may select only a closed role and fresh allocation token; fixed trusted
host policy owns image, argv, resources, mounts and network. Preserve create intent
before engine dispatch, byte-exact CID admission and original/late native client
ownership. Service stop or failed factory setup must retire the exact requested
allocation, including late creation. Do not retry uncertain create or replace a
held worker. Source allocation is lazy and retired independently of prediction.
The stable host root must be exclusively held; unresolved prior allocation evidence
blocks restart. Store locking alone does not fence other stores/generations.

Tests first: production listener startup/source transport, each dependency mismatch
before science import/readiness, stale grants, invalid settings and accept timeout;
then allocation refusal/late create/partial setup/exact retirement and root fencing;
then actual ProviderService admission/Hello/discovery -> lazy native prediction and
reader -> released science -> retained terminal bytes/host retirement. The Upload
witness keeps exact source/hash, records (2,1), atom correspondence and H-only versus
H/C expectations. Lose one completion receipt, hold replacement and explicitly
replay the exact retained result without another execution. Existing pasted
binary64 and SMILES oracles stay unchanged; one Upload witness does not recertify
their new launch path. Preserve new manifests/receipts separately from old runs.

Sources/rationale: NMRNet 02a4f77f7a59a6b9db009fda68f3e9fb6bd80508,
tools/worker_qualification.sh:221-264,355-385,478-525 and
tools/worker_retirement.sh:11-41 already own qualified entrypoint composition,
create identity and exact retirement. Replace fixture listeners, not scientific
protocols. SECS 7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/worker.py:159-172 separates exclusive endpoint ownership
from scientific readiness; NMRPeak 1697dc84dd1d76ae25b04efc8183fd80614000e5,
nmrpeak_provider/owner_session_supervisor.py:76-103,188-225 establishes ownership
before spawning. Retain those principles without importing another supervisor.
Local recording/native proof remains distinct from external model qualification,
actual API/GUI delivery and production installation/network enforcement.

Production worker startup implemented locally, 2026-10-20: worker_main delegates
the three roles to unchanged scientific servers. The maintained focused lane
make test/unit/provider/worker-startup passed (7), including an actual reader
process/socket exchange. Its launcher-selection witness passed; changed Python
lint/format, shell syntax and whitespace checks passed. Tests initially failed on
the absent module. Review strengthened the embedded-declaration witness to vary
each file independently; code, ownership/privacy and scientific-proof reviewers
then reported no signal in two complete settled rounds. This is startup/transport
proof, not native prediction, post-admission allocation or a runnable service yet.

R9 connected local service implemented, 2026-10-20
------------------------------------------------
WorkerAllocation publishes only an exact closed role/fresh 32-hex token. A private
staging file is closed before exclusive atomic publication. The original task
retains filesystem work across waiter cancellation. Host acceptance is followed
by allocation-bound channel readiness and bounded prediction runtime metadata;
none of these means loaded-model readiness. Retirement first revokes adoption,
waits for this owner's publication, then uses its original HostRetirement. A failed
exclusive leaf acquisition cannot retire another owner's token. Explicit later
observation can see late host confirmation without another allocation or retirement
publication; earlier failure evidence remains. Local settlement does not itself
confirm native retirement.

provider_workers.sh owns the serial host operations, private-root flock, refusal
of prior evidence, fixed offline role profiles, intent before create, complete
CID-pair admission, observed image/running/isolation/resource posture and exact
stop/inspect/remove through the existing retirement helper. Retirement before or
during create prevents start/handoff. An exact retirement-only leaf fences late
publication without creating a worker or inventing its role. Only known IPC entries
are removed; unexpected grants block confirmation. Caller must stop its controller
before releasing the root. The initial conservative restart policy is a behavioral
refusal until stopped inspection/archive, not automatic recovery or record deletion.

NativeAttemptFactory owns requested allocations/channels and interrupted assembly
reads until returning the existing controller or source pair. Actual metadata,
admitted artifact identities and execution-source identity feed the unchanged
assembly/session. Sources are lazy. Failed setup attempts independent cleanup and
keeps original/private causes, including cancellation's earlier cause. Raw channel
close observation stays in its original bounded task after exact host retirement.
Engine access, scientific dispatch policy and a second Attempt journal do not move
into this factory. Its protected owners must outlive failed cleanup.

Long-running ownership correction: the initial factory kept every allocation and
client after handoff. Reusing it across Jobs therefore retained retired channels,
tasks and results. Successful controller/source transfer now synchronously removes
the original allocation, client and close-task entries. Only unfinished setup or
cleanup stays in those existing tables; no second lifetime registry was added.
An active setup invocation or held obligation refuses fresh setup. Explicit
factory.settle() reobserves the original allocation I/O, channel closure and exact
retirement handles, then drops confirmed entries. It never reconnects or dispatches
science. Interrupted assembly inventory reads use the existing AttemptStore owner
identity (setup_owner=factory), so settlement cannot consume another owner's read.
Confirmed native cleanup releases its entries independently of any held store
read; the existing store owner alone keeps that remaining settlement obligation.
The original failure is retained only while its cleanup is held. Native witness
history lives in the fixture, not the production factory.

Tests initially reproduced absent allocation/factory modules. Review corrections
have explicit witnesses: publication race; pre-publication cancellation; foreign
leaf refusal; adoption after retirement; late retirement read-again; retire-only
late publication; checked host directory/intent failure; and nested cancellation
that previously replaced independent cleanup causes. Focused allocation tests
passed (17), factory transfer/setup/cleanup tests passed (8), and changed-source lint passed.
The focused launcher/convention batch passed (19). No broad suite was run.
The fourth factory witness cancels actual held cleanup after an ordinary setup
failure: the exact interruption propagates while the original setup failure,
earlier interruption cause and every independent cleanup failure remain protected.
The transfer witness reuses one factory for two Attempts, each handing off both
reader and generator roles. All factory tables are empty at each transfer, while
the returned owners retain usable original retirement handles. Separate failure
witnesses retain a timed-out close task until explicit settlement, gate reuse on
factory-owned storage I/O even with no native entries, and leave a foreign pending
read untouched. A storage-only failure releases the retired prediction immediately;
later store settlement does not repeat native retirement. Focused configured-runtime
(10), service (18) and legacy lifecycle cleanup (8, with 3 native cases skipped in
that offline lane) tests also pass.

The new fixed make test/integration/provider-service/uploads lane passed using
actual ProviderService -> NativeAttemptFactory -> host-created production workers
-> released H/C -> retained terminal bytes -> exact replay after storage reopen.
The controller starts first with disjoint request/receipt/IPC grants and no engine.
Host observes admission/selection before accepting creates; local TLS peers verify
actual signed inventory, Hello and feed requests. Five Hello exchanges continued
during the service invocation, alongside one science run; the separate blocked-
execution service test proves independent Hello scheduling. The independent Upload oracle still requires exact bytes,
XYZ records (2,1), water then chloromethane, source positions and exact angstrom
coordinates; water loads only H, chloromethane H/C. Exactly one reader call and
one scientific prepare/execute occurred. Both native retirements confirmed exact
container removal and IPC release. First completion acknowledgement was lost;
replacement held with AdmissionHeld despite a spare record slot, unchanged terminal
bytes, zero new HTTP/allocation, then explicit recovery replayed the same completion.

First joined receipt, before final formatting/documentation and final review:
.work/qualification/provider-service-nmrnet-native-service-qnhBUWF6/
summary.json SHA-256 f42549564bfd1d2fb13e651c7d585d8b0719b64896b22af61782deb1386c38ee;
scientific-result.json 24292 bytes, SHA-256
ca078acc10301ab7f072b34e9006ca6a4b2ca35b1aea532a976c6955410040c2;
sources.sha256 SHA-256 5e5f6b6f949f37d97363932f82c676ed40122df7f517f5e3f613985b67294b76.
This describes that exact executed snapshot, not earlier receipts or external
qualification. Successful retention omits disposable keys, journals, model
transcripts and worker stdout/stderr; failed runs preserve private ownership/cause
evidence until reviewed cleanup. No dependency, sibling, upstream, external endpoint
or routing change occurred.

Final joined receipt after the ownership correction and source formatting:
.work/qualification/provider-service-nmrnet-native-service-llwk0bY2/
summary.json SHA-256 26ce7176b7df63a618e753ad0b26d0248d545dce296545e0826c0ea5c04cd966;
scientific-result.json SHA-256
f8cf4af408719346e7312f332e9e419c1c8693772436a10a6bc6bcff72f06a4d;
sources.sha256 SHA-256 219dd3e3f519717aa1f79a7ec4be56a51747fa972b17fcc2be4cb689370d2705.
This run observed five Hello exchanges, one scientific execution, both confirmed
native retirements, empty factory setup tables after transfer, and two completion
sends (lost acknowledgement followed by exact replay). Scientific-result hashes
bind execution-source/configuration identities as well as predictions; each receipt
describes its own executed snapshot. The fixed independent molecular oracle remains
unchanged. Two settled review rounds across code, ownership and proof/provenance
found no further actionable signal after correcting the focused fake store.

Remaining after R9: installed host/controller composition with explicit network
grants and bypass-denial proof; operation through temporary outages and confirmed-
record retention/archive policy; diagnostics delivered through each actual recipient
channel; native service witnesses for pasted/SMILES; four-reference/population and
real capacity gates; selected external interpreter/model and actual API/GUI delivery.
The local API/store/model peers are scripted. This runnable local service proof
does not qualify those external/deployed boundaries, other format variants or
independent prediction accuracy, and does not close 003.

R10 all three native input routes through the connected service, 2026-10-20
-------------------------------------------------------------------------
The previous pasted/SMILES lifecycle lanes prestarted workers. The maintained
test/integration/provider-service/{uploads,pasted,smiles} targets now each exercise
ProviderService -> NativeAttemptFactory -> lazy host-created prediction and source
worker -> retained terminal record -> exact reopened replay. One plain service
fixture shares this transaction; SuppliedLifecycle and SmilesLifecycle retain their
unchanged route-local scientific/source assertions. No production factory/core,
scientific implementation, package dependency or new fixture changed.

The host accepts exactly one closed fixture selector before creating state. Each
controller receives only its selected read-only fixture files: expected.json for
pasted; expected.json and mixed_records.xyz for Upload; smiles.json for SMILES.
The two-allocation bound, fixed role profiles, source/scientific grant separation,
admission/selection before allocation, exact retirement and source manifest checks
remain unchanged. SMILES uses the already-qualified seed 20261019, 1280 iterations,
one-second embedding budget and five-second generation channel budget. These are
host fixture settings, never Job-controlled allocation fields.

Pasted checks its exact NM_TABLE/UTF-8 byte span, atom order and source positions,
and the independently computed binary64 nm-to-angstrom error bound from R5.
SMILES checks CCCC/N=3, the literal carbon inventory/hydrogen-parent mapping,
three retained conformers and exact downstream native request/coordinate/hash
correspondence. Generated coordinates are not independent golden coordinates or
proof of seed reproducibility across platforms. Upload retains records (2,1),
water/chloromethane and H-only versus H/C checks. All three require exact source
role sequence, one source call, source retirement before prepare/submit, one
scientific prepare/execute, empty factory setup tables, a held replacement despite
spare storage capacity, and identical replay without new model/scientific work.
Non-Upload routes make no membership or capability requests.

Tests first reproduced the missing targets and selector validation (six failing
subcases); the two focused launcher tests then passed. All three separate native
lanes passed sequentially on the final source. Changed-file lint/format, Bash
syntax and whitespace checks passed; no broad suite or unrelated rebuild ran.
Independent review strengthened the Hello/inventory peer's known model-key
rejection: its earlier return had bypassed that base-fixture assertion. This was
a proof gap, not an observed production leak. Code, authority/privacy and
science/provenance reviews then sustained no further actionable signal.

Final compact receipts beneath .work/qualification/ (each has summary.json,
scientific-result.json, sources.sha256 and exact host retirement receipts):
- provider-service-nmrnet-native-service-MlX52i8p (Upload):
  summary SHA-256 61ef61a1a02e795304b4a213ac0766a9dc2ec88ed692abf9fee75c911a2d4466;
  result SHA-256 d433219907617b75eafc41d4eff49a15c6fb6db8462a480f03cccd564f29105b;
  sources SHA-256 baa5df2a37b39f2bd617292f5ddadc75dc302665776e2562c02b258949a035e7.
- provider-service-nmrnet-native-service-ldPjG4UF (pasted):
  summary SHA-256 643d034ce334339ab57db64c2455322f8a61194b19a3fca898472b6064a999ff;
  result SHA-256 6a6394b71523a441762f6ec1e34cdeffa5f13e8f84c344ef336d76f1aa7908e6;
  sources SHA-256 a557a07cb93a9392887ec9932c5623d775bbd6faf9efcaabc32bb9d1c9ab2a28.
- provider-service-nmrnet-native-service-d8Cm7EIa (SMILES):
  summary SHA-256 047c4e6fef998d63d448660158d95f7824b53a14a6dabcdcc7588d2a41c41107;
  result SHA-256 a4a54366225dab83d0ed6b33c7f8808287b30841d442bbafec31385f02f68b97;
  sources SHA-256 0c0c52ba3e62b56e8a18b6ca44f3780b1e5b07d86babb514189878bd51e3a700.
Each observed one start, one science execution, two completion sends, both native
retirements confirmed and reopened exact replay. Hello exchanges were respectively
5, 4 and 7; these counts describe the invocations, not a new timing guarantee.

Sources/rationale: 741d426's service witness and host qualification owner already
join the real service/factory/production workers. Extend these instead of creating
another runner or scheduler. The independent scientific assertions remain in
tests/integration/provider_core/normative/test_nmrnet_{supplied,smiles}_lifecycle.py;
their module hashes and selected fixture bytes are explicit execution inputs,
checked against the host's before/after manifest. Legacy probe entrypoints are not
substituted for the production worker command. Historical receipts keep their own
snapshot meanings; new receipts do not relabel them.

Remaining local 003 work: four-reference exact producer/population and real capacity
proof through the connected path; actual recipient diagnostic delivery; installed
host/controller composition and explicit network/bypass enforcement; temporary-
outage and confirmed-record archive/restart policy. External-model qualification
requires a selected endpoint/model, credential file, trust, disclosure and any paid
use authorization. Actual API/GUI delivery separately needs selected environments,
issued provider/client credentials and receiver access. None is invented or
established by local TLS/scripted peers. These native passes do not close 003 or
prove independent chemical accuracy.

R11 failure recipient and operational-cause proof, 2026-10-20
-----------------------------------------------------------
The previous interpreter report witness called session.prepare and fail_body but
never submitted the failure through ProviderService. The maintained focused
test/integration/provider-core/service lane now observes that complete path:
service -> configured interpreter -> NMRNetSession -> core controller/executor ->
durable FAIL -> actual signed TLS recipient -> matching confirmed failure receipt.
Its deliberately private 1523-character model explanation stays whole in protected
evidence with independently_verified=false. The public request has the exact
interpreter_reported_input_problem code and the existing explicit unverified
attribution; neither private report nor model key is published. At receipt, the
peer checks POST, exact current durable bytes, confirmed recording-host retirement
and completed channel close/observation. No source is acquired or allocated, no
scientific preparation/execution occurs, and API requests carry valid signatures
without model/source authorization headers.

A companion injects an OSError at the recording scientific outcome boundary after
execution entry. The original object remains under ServiceFailed -> ControllerFailed
-> ExecutionFailed -> cause. Safe rendered errors exclude its private canary;
the API receives neither FAIL nor COMPLETE. The original execution-entered record
survives settlement unchanged, source/scientific cleanup confirms, and no replacement
allocation or second execution occurs. This establishes a useful distinction:
an interpreter's attributed input report is publishable; an operational failure
must not be relabelled as invalid input or successful output.

The first new service test reproduced RuntimePeers' missing /fail fixture route.
That peer now echoes the actual received code/message in the normal API failure
receipt; no production behavior changed. Review/run corrected one proof assumption
about the existing ExecutionFailed layer rather than flattening errors. Review
also moved the close/closed assertion to actual submission, where it proves the
retirement barrier instead of merely observing eventual cleanup.
The final focused service lane passed all 20 tests; changed-file lint/format and
whitespace checks passed. Code, authority/privacy and proof/provenance audits
sustained no actionable signal in two settled rounds after those corrections.
No broad suite, scientific rerun, dependency change or external call was needed.

Sources/rationale: e45cdcd tests/integration/provider_core/adversarial/
test_nmrnet_interpreter.py::test_model_report_is_attributed_publishable_and_private_without_fallback
is the existing component proof. Extend its real service lane instead of adding
another diagnostic command or framework. Production authorities remain
nmrnet_provider/interpreter.py::ModelReportedInputProblem, session.py::_failed_preparation,
provider_core/execution.py::_terminal and publication.py. The new actual recipient
checks live in normative/test_nmrnet_service.py; the forbidden-publication/original-
cause checks live in adversarial/test_nmrnet_service.py. RuntimePeers only supplies
the missing fixture response. Scope is local signed TLS plus recording science;
no new native, chemical-accuracy, external-model, GUI or operator-renderer claim.
Historical R10 native receipts still identify their own executed sources.

Next local scientific gate: use the existing contained reference_requests decoder
from tests/test_prediction_release.py to produce a private four-frame XYZ fixture
and source manifest from the exact prepared H/C records. Keep LMDB/pickle/NumPy/
Torch out of the service controller. Match complete original producer identities,
137 indexed outputs (82 H/55 C) against the 002 callable packet, and separately
the exact 64 historical positions against reference-cpu-float32.json. Counts alone
cannot pass. Retain private coordinates because the source licence remains
NOASSERTION; preserve portable identities/numerical evidence and rerun instructions.
Do not claim independent loaded-state equality solely from strict=True, resolved
arguments or numerical overlap; add a focused verified-checkpoint/actual-loaded-
tensor producer proof before claiming that gate. Real 128-atom H/C capacity and
full-process overhead remain separate measured obligations. None of this next
scientific work is claimed implemented by R11.

R12 focused real loaded-state producer gate, 2026-10-20
------------------------------------------------------
Before claiming a loaded-state gate for the connected four-reference work, source
review found that strict=True, argument compatibility and numerical parity did
not independently establish equality of actual loaded tensors. The maintained
prediction/model-parity/state target now selects one real scientific test through
the existing baseline.sh host owner. Its launcher witness first failed on the
missing fixed selector, then passed: every container argv and grant is identical
to model-parity except the fixed test method. It inherits offline/read-only,
nonroot/init/cap-drop/no-new-privileges, two CPUs, 4 GiB/no-swap and 64 PIDs. No
production guard, decoder, model implementation, controller, dependency, generic
framework or new launcher was introduced. The existing scientific test owner is
extended in place; full model-parity discovers the gate without another aggregate
invocation.

The test itself pins the selected dictionary/checkpoint archive and both H/C
members to the reference packet; it does not rely on a separate test having run.
For each head, production constructs the actual released CPU float32/eval model
from the verified immutable bytes. An independent direct torch.load of those same
bytes supplies expected state. All 197 state entries match by exact key set, Tensor
type, CPU placement, dtype, shape and torch.equal values, covering parameters and
persistent buffers. Each head has 47,593,795 parameters. Expected state is not
obtained through the production decoder wrapper. Both branches still use the same
pinned Torch format decoder; this is an independent transfer comparison, not a
second checkpoint-format implementation or bytewise pickle-equivalence claim.

Two actual H-model controls must fail that same comparison: mutate one parameter
to a different zero/one value; then construct the actual model class while its
load_state_dict returns apparent success without copying weights. The gate rejects
both. Model, checkpoint mapping and byte snapshot are released before the next
head. The negative control explicitly clears the mock's recorded checkpoint
arguments before deleting it: deleting a MagicMock alone can leave those tensor
references in a cycle until garbage collection. This review correction makes
cross-head release independent of collection timing. There is no forward
prediction or coordinate fixture in this lane. C/H
numerical population, scalers, connected-service execution and real atom-capacity
proof remain separate obligations.

Review strengthened the observation's portable evidence: existing execution-
identity machinery now binds image/upstream, actual mounted source hashes,
reference packet, dictionary, configuration digests and runtime/thread facts.
Final focused native run passed, including both real negative controls. Its
cgroup memory.peak was 1,788,256,256 bytes against memory.max=4,294,967,296;
memory.swap.max=0, cpu.max="200000 100000", pids.max=64. This measures this
producer check, not service capacity or sustained provider operation.

Private final receipt: .work/qualification/loaded-state-RuGzPhX6/
observation.json SHA-256 1a9e099ff9639bd3a5ca94cda6409569861e55cb4cc7eb2a619ffc3fd52a4a10;
stdout SHA-256 de2e2a08ec73a918361357562d05b58ad2a7635b29a551eeca248950dc56c3b0;
sources-before.sha256 SHA-256
031e695bba98a223c120484269537ac2234088ace8e64335f0366f7454f52687.
Status is zero; all captured source identities still matched after execution.
The compact observation omits tensor values, checkpoint payload and coordinates.
No external endpoint, download, upstream or sibling change occurred.

Validation scope: all four affected model-launcher tests pass, Bash syntax/whitespace checks
pass. A contained parent/current comparison found the same seven preexisting
Ruff diagnostics in the legacy released-model test module, with no new diagnostic;
they were neither suppressed nor called green. The launcher test file passes
Ruff. No broad model-parity/prediction suite was run for this prerequisite.
Code, authority/resource and proof/provenance reviewers sustained no actionable
signal in two settled rounds after the observation and mock-lifetime corrections.
Sources/rationale: 84799f9 tests/test_prediction_release.py::verified_bytes and
assert_observed_container_budget already own verified scientific fixtures and
measured grants; baseline.sh's batch-worker-parity already selects one fixed
dotted test. Extend these owners instead of creating another proof runner.
The actual transfer owner is nmrnet_inference/model.py::load_prediction_model_from_bytes;
the immutable-byte owner is tools/baseline_prepare.py::verified_member_bytes.
The pinned Torch decoder and both selected checkpoint identities remain those
already documented by 001/002. This closes only the independent state-transfer
prerequisite; the connected four-reference/137-output/64-position and 128-atom
capacity gates remain open, as do the other explicit 003 exits.

Bounded input interpreter implemented locally, 2026-10-20
========================================================
provider_core.conversation owns the serial transcript, total attempted-turn
budget, admitted assistant envelope, correction mechanics and ordered endpoint
fallback. nmrnet_provider.interpreter owns NMRNet's six tools and prompt. This is
the concrete implementation of interpreter steps 2/4 below, using the already
installed chat carrier and preparation lifetime owner. It adds no dependency,
scientific transform, reference registry, worker protocol or configuration loader.

SMILES uses the exact verified Job byte span and explicit count. Pasted input
uses the exact span and declared format/unit. Upload input inspects membership
and delegates selected bytes/options to the existing acquisition/reader owner.
The chooser cannot replace source text, coordinates, generation settings or
owned budgets. submit consumes only the current prepared reference; the narrow
PreparedReferenceRejected permits correction without catching other ValueError.
InputRejected supplies its safe owned reason; its private native diagnostic is
never model feedback. Operational reader/generator/source/limit failures stop.

Fallback follows confirmed endpoint retirement, preserves completed tool results
and reasoning, and spends the same remaining turn budget. It never reruns a
completed scientific operation. Unidentifiable carriers are operational; malformed
arguments and multiple identifiable calls receive correction without dispatch.
Rejected argument text is discarded before another request; decoded values/keys
are checked for known endpoint credentials. Job text enters as exact plaintext,
avoiding an extra JSON-escaping layer. These are known-secret checks, not a claim
to classify arbitrary private text. Only admitted assistant fields are replayed.

report_input_problem is terminal, attributed and unverified. Its full bounded
explanation remains in core's existing protected failure evidence. The public
message is an owned attribution, not arbitrary model text that might repeat Job
or Upload content. The actual fail_body witness verifies that even a 1500-character
private report produces a publishable failure within the API limit. No science
or second endpoint starts. Model reports cannot become verified invalid_input.
Transient raw endpoint failures stay ordered and private, including failures
before successful fallback; only safe reason/status summaries enter observations.

Secret-free prompt/tool/configuration hashes, route counts and successful operation
names join the existing immutable interpretation observation, prepared identity
and result. The existing lifetime owner retires the chooser before exposing a
candidate; core rejects late reply/dispatch results after retirement and keeps
the original operation plus independent cleanup failures. There is no new journal.

Tests were written before the missing implementation. Focused local TLS witnesses
reach the actual session/result path for exact CCl/N=2, nonzero nm-to-angstrom
pasted conversion, and unlike uploaded XYZ records requested 2,1. They compare
actual posted tools, prompt hash, endpoint routes, exact reader bytes/options,
ordered worker requests and source mappings. A lost model reply then fallback
retains its prepared reference without generating again. Recording scientific
ports do not establish native RDKit, released-model or external LLM behavior.

Sources and rationale: the pinned SECS and NMRPeak references in the interpreter
plan below support shared transcript ownership, narrow correction and separate
exchange/conversation budgets. Core implements the reusable mechanics; NMRNet
keeps its own report precedence and scientific decisions. No sibling/upstream
change, external model call or new acquisition was performed. The user's final
packaging direction retains full runtime dependencies and drops the minimal
installation proposal; note 017 records the decision and rationale.

Validation: make test/integration/provider-core/chat (22),
test/integration/provider-core/interpreter (17), test/contract/provider-core (5)
and test/repository/provider-core (37) passed in contained offline lanes. Changed
Python lint/format and git diff --check passed. Independent authority/failure,
code/reuse and science/provenance/privacy reviewers challenged the actual code,
tests and documentation; two settled final rounds yielded no further actionable
signal. Corrections included late-reply retirement, primary/earlier failure
retention, decoded-credential checks, model-report publication and exact Upload
order/provenance witnesses. This closes the local chooser slice, not 003 or the
remaining explicit runtime configuration and external qualification exits.

Shared chat adapter ownership corrected, 2026-10-20
==================================================

The Chat Completions adapter now belongs to provider_core.chat, installed from
packages/provider-core. It owns no molecular semantics, so placing it in the
NMRNet binding was the wrong boundary. The old module is removed without an alias.
Its unchanged exchange, limit, failure and retirement behavior uses core's own
container guard; no dependency was added. Exact precedent and adaptation rationale
now also live in the package README beside its public contract.

The eight existing local TLS/recording-port tests move to package-owned
tests/integration/chat/{normative,adversarial}/test_chat.py. The focused target
make test/integration/provider-core/chat builds/installs offline and exposes no
consumer code. The installation contract includes the new module in its exact
wheel payload, imports it without repository/scientific packages, and requires
its package guard. The NMRNet interpreter lane retains its input-owner tests.
Historical carrier qualification below refers to the earlier module location;
the next conversation consumes provider_core.chat. Molecular prompts, tool
implementations and scientific result admission remain binding responsibilities.

Validation: eight installed chat tests, five installation contracts, seven
launcher tests and 37 focused repository-convention checks passed. Changed Python
lint/format and shell syntax passed. Independent code, authority and provenance
reviews found no actionable refactor issue. No model endpoint or native scientific
runtime was used; no sibling, upstream, lock or dependency was changed.

Pasted Job-coordinate binding implemented, 2026-10-19
====================================================

InputPreparation.prepare_pasted now takes primitive start_byte/end_byte offsets,
explicit table/xyz format and source unit. submission.select_job_pasted slices
this owner's VerifiedJobInput itself, preflighting nonempty bounds, UTF-8/source
size and options before allocation. It accepts no replacement source text.
Meaning, span choice, format and units remain chooser decisions; this proves
byte provenance, not interpretation of the instructions or physical unit truth.

SelectedPastedSource retains immutable selection facts with repr-hidden bytes and
a derived digest. Existing PreparedJobInput now has one source field containing
UploadSource, SelectedPastedSource or None; the old source_upload field was renamed
at its sole production consumer, without a compatibility alias. This retains one
supplied-coordinate session/planner/diagnostic path and excludes competing origins
without two optional source fields or another input/session hierarchy.

The shared reader allocation, total worker-call budget, deadline and retirement
owner remain authoritative. Table reading has no record selection; XYZ requests
all records. Only after reader retirement is exactly one geometry accepted. A
second XYZ frame is a correction, never silently discarded; malformed later rows
fail the entire read. Multiple geometries belong in an Upload with instructions.
Invalid replacement revokes the previous reference; cleanup uncertainty remains
operational and retains the original reader rejection. Direct declared coordinate
JSON remains unchanged and malformed JSON has no prose fallback.

ResultPlan joins the selected Job/fingerprint/span/bytes, declared format/unit and
reader source digest to the one supplied geometry. Its existing geometry.source
map and compact prepared identity retain the Job fingerprint, half-open byte span,
selected-byte SHA/length and format. positions_relative_to=selected_byte_span
explicitly scopes existing one-based atom line numbers; no line/atom reordering or
file identity is invented. The reader still owns conversion once and its existing
NIST/CODATA references (input_geometry.coordinate_conversion); the planner does
not repeat unit conversion or chemistry. Supplied-H completeness stays unknown.

Tests first failed because prepare_pasted was absent. Structured normative and
adversarial test_nmrnet_pasted.py cases use actual pure table/XYZ reader and wire
admission, plus recording prediction/retirement ports via pasted_ports.py. They
exercise multibyte-prefix byte offsets, exact values, nm-to-angstrom conversion
once, source/atom/line identity, invalid spans/options before allocation, multiple
or invalid XYZ blocks, stale references, shared budget, planner cross-binding
rejections, safe diagnostics and cleanup precedence. The focused target is
make test/integration/provider-core/pasted; this is not a native worker, actual
host-retirement or external-interpreter qualification. Existing native receipts
below identify their earlier source snapshots, not this later edited checkout.

Validation: seven pasted tests passed, including the planner's Job/fingerprint/
span/bytes/format/unit mismatch matrix. The focused SMILES lane passed 32 tests
(one native-only skip), Upload lane 14 (one native-only skip), and result/launcher/
two relevant repository-convention checks 33. Changed-file lint/formatting and shell
syntax passed. Source-policy inspection introduced no findings; the existing
result-warning ternary and launcher-test ternaries remain unchanged. Three
independent code/ownership, containment/errors and science/provenance reviewers
completed two settled rounds without further actionable findings. Accepted review
refinements included planner cross-binding coverage and explicit selected-span
line-number scope. No native inference, new downloads, external interpreter calls,
sibling/upstream edits or deployment were required for this source-binding slice.

Interpreter lifetime and observation binding, 2026-10-19
========================================================

InputPreparation now requires explicit chooser.run and chooser.retire operations.
It retains one shielded run task, cancels/joins it during retirement, and shares
one pending close task between preparation and concurrent retirement. Closing
attempts both run settlement and model-I/O retirement independently. No candidate
leaves preparation after submit until model cleanup is confirmed; a phase recheck
also blocks a candidate if retirement began while cleanup was being observed.
Full retirement stops/joins the chooser before settling source/worker/transports,
attempting the independent owners even after a failure. Five recording chooser
fixtures explicitly implement retirement; no optional lookup or no-op fallback
was introduced into production.

A completed failed cleanup observation can be rechecked by a later explicit
retire call, as required by the existing owner/core transport contract. Pending
cleanup remains shared. Rearm never reopens choice or scientific work, never
resends a model request, and retains the prior failure observation. This fixes
both duplicate concurrent close and permanently cached failed-cleanup problems.
Original observed operation errors, cancellation and later cleanup causes remain
available; a failed model cleanup cannot produce a scientific handle.

The trusted chooser may return immutable secret-free observation JSON bytes or
None (no recorded external interpretation). InputPreparation attaches those bytes
once to the existing supplied/generated input value. They describe interpretation
and grant no authority. ResultPlan projects the observation into the public result
and existing protected prepared identity. Existing result capacity bounds raw
observation bytes before UTF-8 decoding; existing whole-result/evidence capacity
then blocks oversized combined identity before scientific dispatch. Mutable
observations are wiring failures. Bytes stay excluded from input repr.

The projection records semantic JSON fields, not original JSON byte identity.
A second strict wire parser/duplicate-key hook was declined: the trusted chooser
owns construction with json.dumps, while untrusted model replies already have
strict wire decoding in chat.py. Model tools must not supply these observation
bytes; the upcoming actual chooser must prove this and its secret-free projection.
No raw model transcript, HTTP response or credential belongs in this observation.

Tests first reproduced missing retirement, dropped observations and unguarded
capacity. Review added deterministic concurrent-run and post-submit cleanup races,
explicit late cleanup re-observation, and pre-decode result-byte rejection.
The focused interpreter lane now contains eleven input-owner tests; the eight chat
carrier tests moved to their separate package lane on 2026-10-20. The eleven pass,
including observations retained
through supplied/generated ResultPlan and evidence-size rejection before worker
admission. These recording-chooser cases qualify the lifecycle/projection seam;
they do not qualify an actual chooser's metadata, tool protocol or live model.

Final review found two further causal/privacy gaps. A late chooser exception after
join timeout is now retrieved by a completion observer, retaining its private
cause without asyncio's default traceback report. A real loop-handler/collection
test fails when that observer is removed. Nested worker rejection, cleanup
cancellation and later chooser-cleanup failure retain the exact cancellation,
both cleanup failures and the original rejection: interruption_cause preserves
the old explicit cause before attaching the later aggregate. This regression also
failed before the correction. No duplicate exception graph or diagnostic registry
was introduced. Upload's existing exact-cancellation regression remains unchanged.

Focused checks: 11 interpreter, 14 Upload (one native-only skip), seven pasted,
32 SMILES (one native-only skip), and 24 result tests passed. Changed-file source
checks passed. These checks use the offline contained lanes; no broad suite or
native requalification was required for these conversation-owner changes.

Interpreter HTTPS carrier qualified locally, 2026-10-19
=======================================================

nmrnet_provider/chat.py now supplies ChatEndpointSpec and the thin ChatEndpoint
consumer of installed-core HttpTransport. Composition supplies the complete
canonical HTTPS URL, configuration ID/model/key/optional effort, dedicated TLS
transport, and explicit request/consumed-response byte limits. There is no config
loader, implicit URL/model, environment credential/proxy lookup, HTTP retry, new
dependency or sibling import. The upcoming NMRNet chooser is its specified consumer.

One call serializes/bounds the complete request before I/O and sends one POST.
Core owns actual response consumption, aggregate exchange deadline, cancellation
and retirement. HTTP errors, duplicate/invalid JSON, unsupported completion shape
and interrupted/limited completion remain operational. A limit-stopped reply,
unfinished reply or service filter cannot become a tool choice. Tool-call and
argument admission still belongs to the next conversation owner. Retirement is
explicit, including failure and cancellation, before any endpoint switch.

The immutable endpoint specification hides URL/key in repr. identity contains
safe configuration ID/model and a hash over URL/model/effort/request+response
limits, excluding the key; key rotation does not change it. This is request-
configuration identity, not complete TLS/transport/conversation provenance.
ChatFailed uses safe owned text with the original cause/HTTP response retained
only transiently. Those response bytes may echo secrets or Job text: the chooser
must not serialize them into feedback, result, durable identity or diagnostics.
Record only safe selected reasons/status/route observations through that boundary.

Tests first reproduced the absent adapter. Eight focused structured interpreter
tests now pass through make test/integration/provider-core/interpreter, using actual
loopback TLS for request/auth bytes, complete JSON reply, consumed-response limit,
trickle deadline, cancellation and lost acknowledgement without a second POST.
Recording-port cases cover private error bodies/causes and unresolved retirement;
configuration tests check forbidden URL authority, key-independent hashes and
limit-sensitive identity. These are local wire/ownership tests, not live model
behavior, an implemented chooser or scientific accuracy. Changed-file lint/format,
shell syntax and affected launcher/convention checks pass; no new source-policy
finding or waiver was introduced. Independent source review found no actionable
adapter issue; tool-call admission and full TLS/prompt/tool provenance remain with
the upcoming chooser/composition owner as stated above.

Next interpreter slices: local loop and bounded HTTPS adapter
============================================================

Use nmrnet_provider/interpreter.py for NMRNet tools and provider_core for shared
conversation mechanics and its chat.py carrier. Existing core HttpTransport owns HTTPS,
actual response consumption, aggregate exchange deadlines and retirement. Add no
SDK, generic interpreter framework, ambient proxy/credential discovery or config
file loader. Normal composition will supply explicit ordered endpoint specs,
dedicated transports and TLS trust; no URL/model/key default is authorized here.
No live endpoint selection is inferred from sibling repositories. Local TLS and
scripted behavior tests are independent of later explicitly invoked live calls.

Implement/tests/audit/commit in coherent order:
1. Thin adapter: immutable endpoint facts (keys/URL excluded from repr), explicit
   whole-request and consumed-response bounds, one POST per call, exact tool carrier
   and complete bounded JSON reply. Reuse HttpTransport retirement, including lost
   replies, oversized bodies, trickle deadlines and cleanup uncertainty. Prove the
   actual local TLS wire and safe failure evidence; this is not model behavior.
2. One typed tool loop over existing inspect/prepare_upload/prepare_pasted/
   prepare_smiles plus attributed report_input_problem. Exactly one call per
   turn; malformed arguments and observed InputRejected correct in the same
   transcript. Turn budget spans all endpoints and corrections; InputPreparation's
   existing deadline/work budgets remain authoritative. Successful preparation
   terminally selects immutable owned bytes without another model exchange.
3. Bind retirement and observation: chooser is an explicit retirement obligation,
   including uncertain cancellation cleanup. Attach immutable secret-free
   interpretation bytes once after trusted chooser.run to the existing supplied/
   generated input variants. None means no recorded external interpretation; it
   does not establish a scripted origin. Model tools cannot set this metadata.
   ResultPlan projects it into public result and existing prepared identity before
   scientific dispatch, using existing capacity owners rather than a new journal.
4. Qualify the real chooser with all three input routes, same-transcript correction,
   untrusted instructions, stale/cross-Attempt references and source-backed oracles.
   Real configured-model behavior and deployed API/GUI remain separate exits.

Operational endpoint fallback preserves the transcript, completed tool results,
references and remaining budgets. Confirm failed transport retirement first;
never automatically replay a successful tool effect. A model-authored input-problem
report is terminal and attributed, not verified bad input and not grounds to try
another endpoint. Parser/generator crashes, output limits, aggregate work exhaustion,
source/transport outages and uncertain cleanup are not repairable input failures.
Do not string-match UploadFailed or catch all ValueError: any later correctable
source-choice classification belongs at the existing core source owner. Retain
safe endpoint/model IDs, prompt/tool/config identities and actual route/failures;
never API keys or raw transcripts. Request material/metadata disclosure and live
call authority must be explicit in the eventual invocation lane.

Actual code precedents inspected, clean revisions checked 2026-10-19:
- SECS 7356c354368f2355d3ab5cef00cf48c67cea9c2c,
  src/secs_inference/provider/interpreter.py:40-199, analysis_run.py:174-210,
  chat.py:74-99,151-208 and tests/provider/test_interpreter.py:368-475.
  https://github.com/numpde/secs-repro/blob/7356c354368f2355d3ab5cef00cf48c67cea9c2c/src/secs_inference/provider/interpreter.py
  Rationale: one transcript/feedback owner; narrow expected rejection correction;
  explicit request/response work bounds. Formula/spectrum semantics do not transfer.
- Magnet 600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf,
  magnet_provider/openai_chat_interpreter.py:63-100,164-203,233-357,400-476;
  openai_chat_generation_runtime.py:40-148; interpreter.py:259-467.
  https://github.com/numpde/magnet-deploy/blob/600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf/magnet_provider/openai_chat_interpreter.py
  Rationale: config/HTTP/conversation ownership and explicit response retirement.
  Use existing core's stronger retirement owner; do not copy best-effort cleanup,
  deployment-specific status retries, numeric budgets or fresh-transcript fallback.
- NMRPeak 1697dc84dd1d76ae25b04efc8183fd80614000e5,
  nmrpeak_provider/interpreter_policy.py:13-54, interpreter.py:287-506,
  input_interpreter.py:183-270, tests/unit/test_input_interpreter.py:378-397.
  https://github.com/numpde/nmrpeak-repro/blob/1697dc84dd1d76ae25b04efc8183fd80614000e5/nmrpeak_provider/interpreter_policy.py
  Rationale: separate exchange/conversation budgets and endpoint-route evidence.
  Its one-shot scientific constructor is not a multi-operation input chooser;
  later-endpoint override of a source-problem report conflicts with 003 and is
  deliberately excluded. No sibling implementation is imported or modified.

Joined native lifecycle qualified locally, 2026-10-19
======================================================

make test/integration/provider-scientific-worker/smiles now passes with actual
InputPreparation, native SmilesClient/RDKit and released PredictionClient H/C
inference, installed provider-core, durable AttemptStore and signed loopback TLS.
The structured normative witness is tests/integration/provider_core/normative/
test_nmrnet_smiles_lifecycle.py; its adversarial companion covers cleanup,
cancellation and missing/mismatched source-manifest entries. Installed test names
use tests.integration.nmrnet, as copied by tools/provider_core_tests.py.

The live witness pairs the authored normative.flexible_multiple case in
tests/fixtures/preparation/smiles.json with its own INSTRUCTIONS Job bytes;
the chooser selects [7,11), CCCC, and requests N=3. The generated
batch retains ordered conformer IDs 0,1,2, the four original carbon atoms and the
literal ten added-hydrogen parent pairs. All 42 atom predictions (30 H,12 C)
retain their conformer/atom correspondence and exact request/stereo digests.
No coordinate uniqueness, prediction accuracy or conformer averaging is claimed.
Generation retirement precedes reference acceptance and scientific dispatch;
ordered requests are durable before the first model prepare. Both worker hosts
confirm removal and IPC-grant retirement before terminal publication.

The first completion response is deliberately lost after receipt. Reopening the
store and using existing AttemptRecovery resends identical terminal bytes; a
second reopen observes confirmation. Counts remain one generation, one scientific
prepare and one execution, with two completion submissions. The fixture chooser
is scripted; this is not real interpreter or deployed API/GUI qualification.

Private receipt: .work/qualification/provider-lifecycle-nmrnet-worker-proof-
idlbkkjM/summary.json, SHA-256
2866929e44ccf9e4b96fc6f935792d93b660af50a649b18ef4a43fd9b82b113d.
Its exact scientific-result.json is 33398 bytes, SHA-256
e02f4eeebd8782c35734358a551e710ae94c4794c6ad58d5ccf5ca7b586591a2.
The receipt records all three immutable image IDs, native/model runtimes, exact
released checkpoint/scaler identities, generation settings and ordered requests.
Each role also has observed posture, stopped and removed receipts. Retain these
bounded scientific observations privately; disposable keys/journals are removed.

Review found that image IDs alone did not describe mounted code. The two live
witnesses now share qualification_execution_identity in test_live_worker.py.
The host hashes sources before/after; the generated witness also requires every
public execution.tool_sources entry to match that independently captured manifest
before model dispatch. This caught omitted mounted tools during development.
The final manifest has 129 entries (including duplicates), covering all 109 public
source entries. A contained post-run comparison matched every entry to current
bytes. Git parent revision plus these hashes identifies the executed dirty source
snapshot; a later checkout or documentation edit is not a new runtime proof.

Focused checks: the new native lifecycle lane passed; installed-core SMILES lane
passed 32 cases (31 active, one native-only skip); seven launcher and two relevant
convention checks passed. The existing direct scientific lifecycle and three
worker-retirement scenarios also passed after the shared helper/launcher changes.
Changed-file lint, formatting and shell syntax checks passed; shellcheck is absent
from the pinned checker and was not installed. 003 remains open for the pasted
geometry operation, bounded real interpreter, normal provider composition and
recipient-visible API/GUI qualification.

Independent code/ownership, containment/errors and scientific/provenance reviews
covered the assigned U/A items. Corrections retained both prestarted grants on
early fixture failure, completed mounted-source coverage, clarified the Job-byte
authority and directly checked the public stereo digest against the native bytes.
Two final review rounds on the settled code reported no further actionable issues.

Joined native lifecycle qualification: implementation boundary
==========================================================================

The peer/coordinator agreed to extend tools/worker_qualification.sh with one fixed
scientific-smiles scenario and hierarchical test/integration/provider-scientific-
worker/smiles target. Three contained endpoints retain separate authorities: native
RDKit generation, released H/C prediction and installed-core controller. The two
workers have different allocation IDs, IPC grants, retirement requests/receipts and
host-owned CID/cleanup states. No separate launcher, broker or production allocator
is needed for this fixed qualification. An idle prestarted prediction endpoint is
acceptable; its first prepare still follows the durable execution-entry write.

Use the authored smiles.json normative.flexible_multiple CCCC/N=3 case and literal
H-parent/atom inventory oracle, with existing fixed generation settings. The actual
InputPreparation and native SmilesClient must retire generation before accepting
the reference; the same batch then joins existing NMRNetSession/PredictionClient,
AttemptController/store and signed loopback TLS publication. Compare each ordered
request/provenance/atom/stereo identity through durable candidate and full result.
Lose the first completion reply deliberately, reopen storage and exercise unchanged
AttemptRecovery terminal replay, preserving exact bytes with no generation/model
rerun. Qualify exact host removal/grant cleanup for both worker allocations.

Hash the complete granted/imported source closure before and after. Retain compact
qualification identities, result digests and image/posture/retirement receipts.
Also retain the finite successful scientific-result.json privately: its exact
generated coordinates/provenance and shifts support later scientific review,
with exact hash/size in the summary. Retire keys and disposable successful journals.
Existing core replay logic and scientific
oracles stay unchanged. This proves the joined native local lifecycle, not shift
accuracy, an external interpreter, deployed API/GUI or production allocation.

After this proof, add the missing exact verified Job-span operation for one pasted
table/XYZ geometry, explicit format/unit and existing reader, then wire/qualify the
bounded real interpreter across SMILES, pasted geometry and Upload instructions.

Generation capacity failures become informative Job failures, 2026-10-19
======================================================================

NMRNetSession now maps propagated ConformerShortfall and ConformerOutputLimit to
distinct operational AnalysisFailure codes, using their existing safe messages
with requested/actual counts and the blocked operation. Neither is invalid_input;
neither creates a handle, invokes prediction or submits partial conformers. Only
these typed native outcomes and the existing InputRejected are normalized.
PreparationRetirementFailed and cancellation still propagate unchanged: uncertain
cleanup must not become an ordinary generation outcome. A late failure after
retirement starts cannot select a Job outcome.

smiles_protocol.py::conformer_evidence extracts the existing wire-overflow summary
for reuse by shortfall evidence: exact native provenance text and diagnostic,
ordered actual IDs, request/stereo byte lengths and digests. The terminal binding
adds the original verified Job fingerprint, requested/actual counts and provenance
digest. Output-limit retains coordinates_available=false from its admitted reply;
allocation identity stays with the transport owner. No coordinate requests or
stereo payloads enter protected failure evidence. Failed-Job evidence uses core's
existing capacity owner; an overflow preserves the full document and exact typed
failure in PreparationEvidenceFailed, without clipping or a false terminal success.

Review considered adding a wrapper to carry the selected byte span on failed
generation. This was declined: the failed, nonexecuted operation needs bounded
causal values (Job fingerprint, source SHA, N, settings and actual outcome), and
has no span-dependent consumer or replay path. These facts identify its input
values, not the selected occurrence or independent authorization. Successful
generated input still retains its exact source span through the existing owner.
This decision avoids adding mirrored selection state/error taxonomy solely to
make a failed operation resemble a successful result; no coordinate archive is
promised or introduced. Failed-operation occurrence history is not retained.

Tests first reproduced four missing behaviors. All 27 installed-core SMILES cases,
30 prepared-identity/lifecycle cases and 14 pure wire-protocol cases passed in their
focused offline container lanes. New recording-port cases cover partial and zero
shortfall, complete output overflow, exact private causal evidence, evidence-cap
overflow, combined cleanup failure and failure arriving after retirement. Existing
wire cases still prove exact frame-boundary/compact-summary behavior. These tests
do not claim a native shortfall, native Job prediction or terminal API delivery
of these two new failure codes; their integrated lifecycle qualification follows.
Changed-file lint/formatting passed. Source policy reports one typed-outcome
normalization signal in the existing session exception boundary, now extended
to these two expected operational outcomes. The projection/helper/tests add no
other source-policy findings; no check was weakened or waived.

Generated input joins the existing prediction session, 2026-10-19
================================================================

session.py::NMRNetSession now accepts GeneratedJobInput through the same ResultPlan
and ordered scientific-worker path as supplied input. prepare freezes the complete
plan and exact conformer request order without scientific-worker I/O. execute
consumes the session's exact handle after core's durable execution entry, then
passes that order to worker.prepare/execute. No parsing, H editing, re-embedding,
reordering, count reduction, retry or averaging is added. The small private
_PreparedExecution record names the existing handle/requests/plan association.

Successful reader diagnostics were previously dropped too. The binding now
projects either supplied per-geometry source/record diagnostics or the generated
batch diagnostic with source/provenance digests into the existing protected
prepared identity. This uses provider_core.attempt_record.ProtectedEvidence and
its one capacity limit before scientific dispatch. Keeping this evidence in core's
existing durable entry, rather than an additional local carrier, preserves it
after a crash. The same projection enters protected terminal evidence alongside
model warnings/provenance; public scientific result bytes contain no diagnostics.
The generated diagnostic repeats its provenance digest in this projection so the
terminal evidence remains associated when separated from the prepared identity.
No source bytes, coordinates or stereo payloads are deliberately projected there.

PreparationEvidenceFailed retains the full rejected evidence document and, for an
input rejection, its original typed failure if evidence admission itself fails.
It does not retain the coordinate-bearing prepared candidate or clip diagnostics.
ResultAssemblyFailed now retains the exact already-returned worker outcome and
the exact protected prepared identity, with the assembly/capacity cause chained.
It cannot rerun inference. Combined preparation/model evidence is checked after
the actual model result, without guessing or duplicating the core size policy.

Tests first reproduced four missing behaviors, then the 21 focused installed-core
SMILES cases passed. The 30-case prepared-identity/lifecycle lane also passed; its
signed local TLS/store fixture observes a supplied direct-JSON reader diagnostic
in the real durable EXECUTION_ENTERED record from inside worker.prepare and in
protected terminal evidence. The generated CCl diagnostic is covered separately
by the recording-session identity/terminal test, not a generated TLS/store run.
Authored CCl fixtures preserve IDs (2,0), distinct ordered H/C outcomes, added-H parents and
empty coordinate-derived stereo annotations. A supplied two-record XYZ fixture
preserves source digest and requested record order (2,1) with its diagnostics.
These recording ports qualify binding/lifecycle behavior, not native generation,
bond accuracy, nonempty stereochemistry or model accuracy. Focused tests distinguish
pre-dispatch evidence overflow from post-result combined overflow and preserve the
whole private evidence in both cases. Changed-file lint passed. The source-policy
check still reports the pre-existing InputRejected-to-AnalysisFailure normalization;
the check was not weakened or waived for this slice.

Typed generation shortfall/output-limit terminal projection is implemented in the
newer record above. Native generated Job prediction/publication, external interpreter and normal
provider composition remain unqualified; this session connection does not close 003.
Earlier receipt manifests below identify their executed source snapshots, rather
than the source bytes changed by this later session slice.

One chooser owns Upload reading and conformer generation, 2026-10-19
===================================================================

UploadPreparation moved to input_preparation.py::InputPreparation. The existing
conversation, current opaque reference, Upload cache/acquisition tasks, dedicated
source transports and cleanup owner remain together. Required generator allocation,
frozen GenerationSettings and channel-deadline ports extend that owner; there is
no second chooser or optional mode framework. Earlier receipt paths referring to
upload_preparation.py describe their historical executed source snapshots.

prepare_smiles accepts only primitive byte offsets and N. The owner calls
select_job_smiles on its stored VerifiedJobInput, passes the exact slice/count to
the one-use client, and returns GeneratedJobInput/reference only after channel
closure, confirmed host retirement and local close observation. submit consumes
the current reference without generation or parsing. Operator settings are never
chooser fields. Cooperative timeout must be below channel deadline before any
allocation; hard stop still belongs to the host. No automatic N reduction,
reseed, retry or coordinate rewrite is introduced.

Reader and generator use one shielded allocation task and one worker scope.
max_worker_calls bounds allocation/operation attempts across both routes; it is
debited before allocation, including failed factories and worker input rejections.
Local invalid spans/options use no worker call. JobUploads retains its distinct
source-acquisition budget and cached verified bytes. Chooser waits and corrections
share one conversation deadline; cleanup remains independently bounded and required.
Failed replacement revokes the previous reference. Unconfirmed worker retirement
blocks every source operation before route validation, so malformed follow-up input
cannot mask operational cleanup uncertainty as invalid_input. A tests-first audit
regression reproduced that precedence bug on SMILES and Upload choices, then passed.

Operation failure and all exact cleanup stages remain private and ordered. Known
retirement failures retain their original causes directly rather than nesting
another identical wrapper; cancellation remains cancellation. Shortfall propagates
as its existing operational type, never a partial candidate or invalid-chemistry
claim. Protected terminal projection and successful generation diagnostic retention
belong to the next session-binding slice; no partial-coordinate archive is added.

Seventeen structured installed-core SMILES source/owner tests passed, including
mixed source selection, fixed settings, revoked references, pending host retirement,
allocation cancellation, cancellation during generation, shortfall, combined parse/
cleanup failures and work/deadline bounds. The new helper documents that its payloads
are wiring fixtures, not native/schema/scientific qualification. Its tests.integration.
nmrnet import path is intentional: tools/provider_core_tests.py copies the consumer
test tree into that installed-runtime package. Existing Upload tests passed with
13 active cases; the actual-reader case is separate from that pure-port lane.
Pinned changed-file lint, source-policy and relevant repository guards passed.

The real isolated Upload/TLS/store/publication fixture was rerun through the same
host owner after migration. Private receipt:
  .work/qualification/provider-geometry-nmrnet-worker-proof-f5zXqc0F/summary.json
  SHA-256 6c4a881a25df476b3b265a2aa430e902acc9101bfe01330737fb8b0da5e29ab8
Its 107-entry sources.sha256 manifest matches current source bytes. The launcher
compared pre/post hashes before preserving it; stop/remove, image and posture
receipts remain alongside the summary. Newly imported structured-package markers
are explicitly included. This proves the migrated Upload path, not native generated
Job prediction. NMRNetSession still rejects GeneratedJobInput pending the next
slice's shared scientific dispatch and private-evidence binding. 003 remains open.

Join selected Job source to generation provenance, 2026-10-19
============================================================

GeneratedJobInput now carries SelectedSmilesSource alongside GeneratedConformers.
This adds a real association missing from native output: the Job fingerprint,
selected source span and requested N. It is a plain frozen pair, not a credential,
constructor validator or second result planner. ResultPlan is the single join
admission owner. It requires this generated variant rather than a bare producer
collection, checks Job/fingerprint, local immutable-source/span-width consistency,
selected digest/N against producer provenance and complete ordered conformer count.
Protocol admission still owns graph/settings/atom/stereo evidence; no chemistry or
source parser is repeated here. Existing supplied-coordinate admission is unchanged.

The public generation section and compact prepared identity retain the same
selection facts plus producer-provenance digest. Actual source bytes stay local;
prepared identity also excludes coordinates and stereo objects. The full public
selection and existing provenance/geometry/stereo remain under the common result
capacity reservation. Tests first reproduced acceptance of an unbound batch; new
adversarial witnesses reject unbound output, other Jobs/fingerprints, digest/count
mismatch, mutable bytes and inconsistent spans. Normative tests preserve the exact
selection in both envelopes alongside existing atom-origin evidence. These are
planner tests with authored data, not interpreter/native-generation execution.

Review considered adding original input length to this record. That would not
authenticate a span: the same constructed record could invent its copied length.
Actual bounds and byte origin belong to submission.py::select_job_smiles, which
has VerifiedJobInput. ResultPlan checks local coherence and pair association only.
The future input owner must itself call that selector on its verified instructions
before generation, receiving only primitive span/count choices from the interpreter;
it cannot accept a model-created source/pair as authorization. The reviewer withdrew
the extra-length-carrier suggestion after this ownership clarification.

NMRNetSession still refuses generated input. The next runtime slice must retain
one source-selection conversation, retire generation before returning/submitting a
prepared reference, preserve private diagnostics and use the same session's ordered
prediction path. This source association enables no new Job route by itself.

Exact Job selection for SMILES, 2026-10-19
=========================================

submission.py::select_job_smiles requires provider_core.job_input.VerifiedJobInput
and explicit start_byte/end_byte/requested_count. It slices the original immutable
specification using a half-open UTF-8 byte span, then uses the existing pure
smiles.py::require_smiles_source token/count admission. No replacement source text,
default N, number-word parser, native parser or allocation is accepted here.
SelectedSmilesSource freezes Job ref, original input fingerprint, offsets, N and
the exact slice; its digest is derived from those bytes and source is absent from
repr. It is ordinary data, not a credential or independent proof of prose intent.
The conversation owner must construct it from the verified input in its own flow;
a later consumer cannot treat a freely constructed instance as authorization.

This deliberately separates provenance from interpretation. The interpreter owns
which SMILES/count the instructions request, including missing/ambiguous N and
authorized corrections. Byte offsets establish where text came from, not what the
commissioner meant. The normative fixture says "three" and supplies selected N=3;
there is no new restriction to decimal-number prose. The generation owner must
not silently reduce N, reseed, or generate again when a reference is submitted.

Tests first reproduced the absent selector. Six structured installed-core tests
now cover multibyte prefixes, exact whitespace/source digest, repeated-token
selection, frozen counts, unverified input, offset/count type and range rejection,
split UTF-8 and private-text-safe diagnostics. New test/integration/provider-core/
smiles is a focused child of the existing offline installed-package lane; its
launcher checks retain the same read-only/no-network/no-engine grants. No new
fixture mount, image or dependency is needed. Generation retirement, selected-batch
binding, diagnostic retention and submission remain the next implementation work.

Generated conformer result admission, 2026-10-19
===============================================

ResultPlan now accepts either the supplied PreparedJobInput value or the existing
frozen GeneratedConformers directly. PreparedJobInput moved to prepared_input.py
so result admission remains independent of provider_core; direct Job verification
stays in submission.py. There is no additional generated wrapper or second result
planner. Supplied callers were migrated together. Their result bytes, prepared
identity and capacity reservation matched 81b7929 in direct, file and Upload
comparison cases; the existing supplied-result tests also passed.

Generated envelopes retain producer provenance once, with its byte digest: source
atoms/bonds, isotope/charge/stereo metadata, added-H parents, parser/H settings,
embedding settings/seed/runtime and failure counts. Each geometry retains its real
RDKit ID, exact request digest, prepared numeric coordinates, float32 admission and
coordinate-derived stereo plus digest. File record/row and conversion fields are
absent. Generation chemistry is admitted by smiles_protocol.py::prepared_conformers;
the result planner does not parse SMILES or reconstruct that admission. Scientific
references and their rationale remain in requirements/preparation.md and beside
tests/fixtures/preparation/smiles.json.

Generated coverage distinguishes source explicit H, added H, coordinate H and
predicted H; completeness is not independently validated. Limits state estimated
geometry, no independence claim for stereo annotations, isotope/charge/stereo as
provenance rather than model features, no uniqueness promise and no averaging.
The common result reservation includes all provenance, stereo and coordinates
before inference. Prepared identity binds shared-provenance and stereo digests,
source IDs and ordered request digests without coordinates or raw annotations.
The existing warning reservation and whole-batch finish owner remain unchanged.

Tests first reproduced the missing generated variant. Focused normative and
adversarial tests cover origin/ID separation, metadata and private-diagnostic
placement, hydrogen coverage, compact identity, complete-count rejection,
provenance capacity, required heads and ordered all-or-nothing outcomes. Installed
core and Upload consumers passed after migration. The existing real-model H/C,
C-only and O-only batch lane still matches the direct callable; this is supplied
batch parity, not generated-geometry prediction qualification or accuracy proof.
Its explicit manifest now includes the new pure imports and provider initializer.

The Job session still rejects GeneratedConformers. Binding an authorized selection
from verified Job bytes, retiring generation before submission, protected diagnostic
retention and generated batch execution/publication are the next slice. This
planner admission alone enables no new Job route and does not close 003.

Retain input identity before any prediction-worker exchange, 2026-10-19
======================================================================

The generated-input binding review found an ordering gap in the supplied path:
NMRNetSession.prepare called PredictionClient.prepare before returning the
PreparedAnalysis whose identity core subsequently writes. Model execution was
already after that write, but the first scientific-worker dispatch was not.
The source authority for ordering is packages/provider-core/src/provider_core/
execution.py::AttemptExecutor.run: mark_execution_entered, running progress,
_write_entry and current-server observation precede session.execute. The session
now freezes admitted request bytes and the ResultPlan without prediction-worker
I/O; execute consumes its exact handle before awaiting worker.prepare, then
checks concurrent retirement before calling worker.execute. An uncertain worker
preparation failure is operational and cannot reuse that handle. No core,
scientific algorithm, model selection or result schema change is required.

Tests first reproduced early dispatch and missing durable identity. The existing
installed-core TLS/store consumer now reads the actual AttemptStore record from
inside the recording worker's prepare method, requires EXECUTION_ENTERED and
compares all ordered request digests. Focused cancellation, late preparation after
retirement and original operational-cause tests also prohibit model execution or
handle reuse. This proves lifecycle ordering with recording science; actual model
and exact-host retirement evidence remains in its separately scoped qualification.

Native generation with exact host retirement, 2026-10-19
=======================================================

make test/integration/provider-geometry-worker/smiles now runs geometry-smiles and
geometry-smiles-timeout through the existing tools/worker_qualification.sh owner.
No new launcher, retirement framework, frame limit or payload archive is added.
The actual observed profiles are RDKit worker 512 MiB/no swap, two CPUs, 64 PIDs;
checker controller 128 MiB/no swap, one CPU, 32 PIDs; both nonroot, read-only,
network none, cap-drop ALL and no-new-privileges. The worker receives no fixture,
model, API, engine or host receipt authority. Only the controller reads smiles.json;
it cannot forge the read-only host receipt or import RDKit/Torch.

Success generates the authored butane source (CCCC), N=3, with seed 20261019,
maxIterations 1280 and cooperative timeout 1 second inside a 5-second exchange.
The controller holds the exact generated values, retires the worker through
retire_worker_channel / HostRetirement, requires socket removal, and only then
checks source SHA, atom inventory/prefix and independently authored H-parent pairs.
It preserves exact requests/stereo/native provenance as a private generated-data
observation; these are not an experimental geometry reference or predicted shifts.

The timeout case uses CCl, N=1. After actual generation returns, a deliberate wrapper
publishes the exact allocation marker and blocks while ignoring TERM. The controller
must observe that marker during a separate 3-second wait while its 5-second exchange
is still live, then observe timeout and confirmed exact host retirement. Missing,
foreign or late markers fail qualification; owned tasks are cancelled/observed and
simultaneous private generation causes remain visible. Its receipt has source/config
and retirement evidence only, with no coordinates. This proves cleanup after an
injected post-generation hold, not an RDKit hang or native-timeout stop guarantee.

Both actual host scenarios passed. Source manifests (25 exact inputs each) still
matched after execution; receipts retain exact image/profile/stop/remove records.
Private successful observation:
  .work/qualification/provider-geometry-nmrnet-worker-proof-cuDJNPdE/summary.json
  SHA-256 f1e329b6a720b906acfc9beecdecde65c7e91a339276942e58a8a22734f0ba47
  Actual conformer IDs: 0, 1, 2; exact request/stereo bytes and digests are in receipt.
Private controlled-stall observation:
  .work/qualification/provider-geometry-nmrnet-worker-proof-h6frOLyq/summary.json
  SHA-256 37eaaff1bb9d9f236f8b826f44c8582a28a6ff55d0d59590e7166e14ce40067c
  No generated coordinate payload was retained or admitted.
Pinned native worker image:
  sha256:be4358dd385b280723831950e527e44a87de4ee49afa9020ef8e7e8929bd3bb3
Each directory includes sources.sha256; check it from repository root using
sha256sum --check. Source changes invalidate that current-source claim until rerun.

Five focused negative helper checks and all 11 native producer checks passed.
Every authored SMILES case now specifies exact added-H parents, not merely a non-H
parent. Independent literal valence/order expectations catch CCl H attached to Cl,
mixed [H]CCl H attached to the wrong source index, or all butane H assigned to C0.
Fixture rationale and pinned AddHs source pointers are documented beside the corpus.
The existing silent-defaults checker also passed on all 14 generation source/test
files after adding plain explanations for intentional absent CIP labels, outcome
selection and authored fixture defaults. Malformed stereo objects now fail their
shape check directly rather than receiving a missing-index stand-in. Both host
scenarios were rerun on these final bytes; all three successful request hashes
matched the earlier same-runtime observation exactly. This is bounded repeatability
for one fixed seed/source/runtime, not a portable coordinate identity guarantee.

Correction to an earlier working estimate: this launch's Bash uses 1024-byte blocks
for ulimit -f. A contained query in the same pinned RDKit image, after ulimit -f 64,
reported resource.getrlimit(resource.RLIMIT_FSIZE) == (65536, 65536). The capture
limit is 64 KiB, not the initially recorded 32 KiB. This does not change the bounded
failure-summary decision or confer coordinate-archive authority.

Production allocation/composition, generated ResultPlan/interpreter binding and
the full API/GUI workflow remain open; these fixed fixtures do not close 003.
Changed lint/format, guard/Make checks and focused source-policy checks passed.
Code, operations/error/privacy and science reviewers each completed two final
unchanged clear passes after correcting stale current-status/fixture wording.

One-use native generation channel, 2026-10-19
===========================================

SmilesClient and serve_smiles_connection now share WorkerClient/worker_protocol's
existing allocation, strict frame, deadline and retained-close owners. GeometryClient
and the supplied-file worker remain unchanged. The request contains exact SMILES
and N; work budgets are never request/interpreter options. Trusted composition
passes frozen GenerationSettings, now useful across the asynchronous connection.
The shared pure preflight can run before allocation; both endpoints require its
cooperative timeout strictly below their channel deadline before I/O. Native timeout
is still cooperative; host-confirmed exact retirement remains necessary.

The client consumes one use before validating input and closes after every outcome,
including local rejection, cancellation, timeout and malformed replies. A second
request cannot regenerate a successful candidate or retry failed work. The worker
returns whole success, full-payload shortfall or the bounded output-limit failure.
Expected source rejection and unexpected native exceptions remain distinct, with
private diagnostics. A failed final send cannot produce a second frame; if error
delivery also fails, the original native cause stays in its exception context.

make test/unit/smiles-worker passes ten focused normative/adversarial checks.
make test/integration/native-smiles-worker passes four actual process/socket checks
in the pinned offline RDKit runtime: generation, invalid syntax, controlled subset
after real embedding (IDs 0 and 2), and injected unexpected worker failure.
The controller loads neither RDKit nor Torch. Controlled faults are not natural
ETKDG failure rates, accuracy evidence, maximum chemistry capacity or observed hangs.
Protocol tests remain separate from native witnesses and host retirement proof.

The fixed cross-container generation qualification is recorded above. Generated-
input ResultPlan/interpreter binding remains next. No source/API acquisition,
prediction route or provider deployment is implied by these process-channel checks.
Validation also passed all 14 protocol tests, changed lint/format and the two
container-guard/Make checks. Independent code, science and operations/error reviewers
each completed two unchanged final rounds without actionable findings.

Bounded evidence for generated output limits, 2026-10-19
=======================================================

The previous protocol progress identified a presumed need for durable oversized
failed coordinates. Rechecking this plan's retention contract (Prepared bytes are
Attempt-local; Failed Attempts retain safe causal evidence) rejected that extra
requirement. It would add storage/transport machinery without an accepted result
or recovery consumer. No larger frame, arbitrary smaller N limit or payload archive
is needed to carry this failure honestly.

The complete 2 MiB frame limit remains unchanged. A collection that fits returns
exact requests/stereo/provenance, including a typed full partial on native shortfall.
If that envelope overflows, conformer_reply instead returns conformer_output_limit
with exact native provenance and diagnostics plus ordered actual conformer IDs,
request/stereo byte lengths and SHA-256 digests. It explicitly marks coordinates
unavailable. The receiver raises operational ConformerOutputLimit, never source
rejection, successful input or a shortfall that pretends to retain coordinates.
No automatic smaller N, prefix publication, inference or hash-based replay follows.
The existing Attempt private-evidence owner will retain this bounded diagnostic;
there is no separate coordinate archive. Transport failure remains uncertain and
does not guarantee even this summary reached its receiver.

Fourteen focused protocol cases cover exact frame fit/+1 overflow, independent
digests/lengths, incomplete native generation that also exceeds output capacity,
and tampered summary fields. Large whitespace-padded JSON requests are authored
transport fixtures, not native ETKDG observations or scientific capacity proof.
The native success roundtrip stays the independent ordinary-path witness.
All 14 protocol and 11 native checks passed; changed lint/format passed. Code,
science and operations/error review sustained two unchanged clear passes after
correcting historical wording. The full native provenance stays private alongside
the existing failure evidence, avoiding a second selectively copied metadata schema.

Make assertion test scope corrected, 2026-10-19
==============================================

The launcher module exposed an existing assertion that invoked make inside the
ordinary Python unit image, which intentionally lacks make. Its exact dry-run
recipe assertion now lives in RepositoryConventionTests, using the existing
checker image. All command selection, mount/resource and read-only checks remain
in the launcher unit. No image authority, dependency or assertion was weakened.
All 19 launcher tests and the moved real-Make repository check passed in their
respective contained lanes. Three independent reviewers completed two unchanged
passes without actionable findings. This corrects test ownership, not science.

Initial SMILES protocol admission, 2026-10-19 (historical e256ed6)
================================================================

nmrnet_provider/smiles_protocol.py now encodes the exact UTF-8 source/count and
frozen native collection. UTF-8 JSON text preserves original bytes without base64
expansion. No work-budget fields are accepted from a request. The receiver checks
caller-owned source SHA/count/settings, ordered unique actual IDs, executable
angstrom requests and complete source/runtime/stereo evidence with valid atom
references. It does not reparse SMILES, add H or recompute stereochemistry.
Source correspondence is a producer qualification obligation; internal reference
checks do not prove that the source was chemically interpreted correctly.

The encoder derives success/shortfall from the one requested/returned count pair;
there is no independently supplied disposition flag. A valid shortfall reconstructs
ConformerShortfall with the exact full private partial, never successful input.
Malformed replies preserve their decoded contents privately in WorkerResultRejected.
The complete frame, including escaped metadata and diagnostics, was admitted before
returning an encodable reply. That revision retained overflow only in process.
The bounded operational evidence policy above supersedes this initial behavior;
the current receiver gets counts, provenance, diagnostics and payload digests,
with coordinates explicitly unavailable and no successful prefix.

The explicit make test/unit/smiles-protocol lane uses the established
tests/unit/normative and tests/unit/adversarial split. Its authored protocol data
are not a native scientific reference. The pinned native generator lane separately
checks that a real generated collection survives framing/admission unchanged and
that decoding cannot regenerate it.

At e256ed6, no generation client/server operation was exposed. Its frame-overflow
exception retained data only in process; it did not provide durable capture after
worker exit. Review of tools/worker_qualification.sh / tools/inference_native.sh found the
existing 64-block output file limit (64 KiB in the actual Bash launch) cannot retain a >2 MiB generated
collection in stderr, and geometry qualification does not preserve that capture
as payload evidence. Do not silently repurpose retirement-control directories.
This initially suggested a separate full-output evidence owner or pre-generation
capacity proof. The retention-contract review above rejected that extra failed-
coordinate preservation requirement. The existing 2 MiB frame remains authoritative;
the current operational failure summary fits that channel without a new archive.

Validation: 12 focused normative/adversarial unit cases and 11 pinned native cases
passed, including exact frame fit/+1 overflow, omitted isotope/bond/runtime/stereo
evidence and contradictory SDK seed. Changed lint/format and two guard/Make checks
passed. Independent code, science and operations/error reviewers each completed
two final unchanged rounds with no actionable findings. Required scalar settings
remain consistent with the synchronous producer API; a speculative immutable
configuration wrapper was rejected because this owner has no mutation or async
configuration lifetime to protect. The separately run launcher module exposed an
older Make assertion in its make-less unit image; correction belongs to the next
small test-scope slice, with its assertion preserved in the repository-check lane.

Native SMILES producer, 2026-10-19
================================

nmrnet_provider/smiles.py now parses plain SMILES with explicit source H retained,
adds missing H with parent mapping, and calls ETKDGv3 once for the requested N.
It freezes actual returned IDs, angstrom requests, settings/runtime, source graph
identity and separately labelled generated-coordinate stereo annotations. No
additional UFF/MMFF optimization, pruning, reseeding or ensemble averaging occurs.
Shortfall is an operational failure (budget exhaustion is possible), with the
complete partial collection and aggregate native failure counts retained privately.
Isotopes/charges/source stereo remain provenance, not extra model input features.

The new explicit make test/integration/smiles-generator lane runs the actual pinned
RDKit runtime offline. Ten tests cover all nine authored normative fixture cases,
H/atom mapping, specified/unspecified and E/Z stereo, isotope retention, invalid
source/count/budgets, expanded atom bounds and injected zero/noncontiguous IDs.
A regression first exposed RDKit accepting only the first line of a source;
plain single-token validation now rejects that source before native parsing.
Source research, precise links and rationale are in requirements/preparation.md.

Native execution is currently a library qualification, not a worker-channel or
public prediction route. Required work budgets belong to trusted composition;
the next worker binding must admit fixed budgets against its hard deadline.
Generated values deliberately have no invented supplied-file record/row identity.
ResultPlan still rejects the unsupported SMILES method. Worker transport, full
generated-provenance result admission and interpreter binding remain required.

Focused validation passed: 10 native generator, 40 geometry protocol, seven real
MOL/SDF worker-channel and two guard/Make-convention checks; changed Python lint
and new-file formatting passed. Independent code, operations/errors and science
reviewers each completed two final unchanged rounds without actionable findings.
Accepted corrections preserved generated stereo/isotopes, classified shortfall
honestly and fixed stale README status. Native integer bounds are representation
checks; operator budget admission stays with the next worker composition owner.

Verified Upload through the actual isolated reader, 2026-10-19
============================================================

make test/integration/provider-geometry-worker/uploads now runs the same Upload
TLS/acquisition/ordered-selection/durable-publication fixture with GeometryClient
connected to a separate pure XYZ reader and real HostRetirement. Its host owner
is the existing tools/worker_qualification.sh geometry-upload scenario, with the
same exact CID/image admission, worker retirement, grant cleanup and request/receipt
barriers. No parallel engine lifecycle was introduced. The ordinary
test/integration/provider-core/uploads lane keeps its recording reader/retirement
ports and skips the separately enabled real-reader test.

The installed-core controller profile (512 MiB, two CPUs, 64 PIDs) reuses the same
offline package/wheelhouse setup as the scientific lifecycle lane. The pure reader
keeps 128 MiB, one CPU and 32 PIDs; both memory-swap ceilings equal their memory
ceilings. Actual observed image, isolation and resource values are admitted and
retained. Only the controller receives authored fixture data and core/API/store
authority. The reader has no fixture, package/wheelhouse, credential, network or
engine grant. Its startup timeout accommodates offline core installation; the
unchanged channel deadline still bounds parsing. The completed source-to-reader
selection confirms local channel closure and exact host/IPC retirement before
recording scientific dispatch, then checks one whole terminal publication/reopen.
Chooser and predictions remain scripted; this is not real-model, external
interpreter or deployed API evidence, nor a production allocation service.

The maintained target first failed as missing in a focused real-Make check.
Final source-matched host run passed; compact private evidence:
.work/qualification/provider-geometry-nmrnet-worker-proof-JROnKY7K.
All 98 source-manifest entries rehash unchanged. The receipt includes both actual
container profiles, image identity, stopped/removed worker and stopped controller
observations, selected [2,1] records, one parser allocation, two membership reads,
one grant, one complete result and confirmed terminal reopen. The executed fixture
also asserts one store transfer with bearer authorization and no API signature;
the receipt does not record that transfer count separately.
Original XYZ SHA-256:
8434b7c79dab72ce2b4c1a9bea5ec491af13896bdc31eb7277aa6b04e160cefb.
Ordered prepared requests:
8406a26bd3a05c56d819ed392e264b5b3b4261990e51ebb9ae58bb2981f5174c,
78efddefa44ba73505118dbbd8dbc638896762f1beeb542083a79ca48ca1e522.
The 4,884-byte recording result hashes to
24041884fdb58e21668155d25e6cdbbe44879316a44e6ed97268ba03b36608e4.
The actual worker/controller image is the pinned checker image
sha256:9164d380c00bf0e013d44357cafb03d4b1f64570a93105f74ac4b85b66cf1b49;
the controller installs provider-core 0.1.0 into its private runtime.

Focused launcher/geometry/convention checks pass all 47 cases; the routine Upload
lane passes 13 active cases and skips the separately enabled live case. Changed
consumer/launcher lint, shell syntax and whitespace pass. Since common installed-core
controller grants were shared with the existing scientific lane, its real-model
test/integration/provider-scientific-worker was also rerun successfully. Receipt:
.work/qualification/provider-lifecycle-nmrnet-worker-proof-L26EVJrl.
Its 94 executed-source identities rehash unchanged; it reports one scientific
execution, confirmed host retirement and confirmed terminal reopen. The
17,666-byte result hashes to
ad9a30581ae51bbc0dd3909e09ba2ca61a1d75c1da3b46c4ba034309e02a26ad.
That remains the direct singleton/local API qualification, not an Upload-to-model
or deployed-service proof. No full suite, new acquisition or external model call
was needed for this slice.
Review caught three omitted unittest package initializers in source provenance.
Both owners now include those exact imported files; both real container lanes were
rerun for the final receipts above. No runtime behavior changed with that correction.

Verified Upload selection through one retained batch result, 2026-10-19
====================================================================

UploadPreparation now owns one chooser conversation, the current verified source,
one reader allocation and its dedicated source API/store transports. It exposes
the existing membership inspection, explicit format/unit/record preparation and
consume-once submission of its current opaque reference. Submission reuses frozen
coordinates; it does not fetch, parse or generate again. A failed replacement
revokes the old reference. Correcting a selection on the current Upload reuses its
exact verified bytes. Switching sources invokes JobUploads under its existing
cumulative HTTP request/byte/deadline limits. A separate explicit read budget is
charged at parser entry, including rejected records, rather than on acquisition.
The overall preparation timeout includes chooser waits. No external model is called.

The complete inspect/acquire coroutine is retained across cancellation, because
acquisition spans membership refresh, grant issuance and store transfer. Retirement
cancels and settles it before closing its reusable transports. A phase check before
handoff prevents late bytes from being cached after retirement. Reader allocation
is likewise retained as a shielded task: cancellation cannot discard a late client
and exact host-retirement handle. The factory remains responsible for partially
created resources before returning that pair. Every reader closes, confirms host
retirement and observes local closure before a reference is issued or replacement
is allowed. Uncertain cleanup keeps the owner and blocks replacement/submission.
The narrow shared retire_worker_channel sequence serves both this reader and the
existing scientific session; it does not grant engine authority or declare states.

PreparedJobInput now carries immutable UploadSource facts without source bytes or
access grants. ResultPlan checks source Job identity and every geometry's whole-file
digest. Public and retained prepared sources include Upload ref/length alongside
the existing source SHA, selected record, atom locations, explicit units and scale.
No same-molecule check, reordering, deduplication or averaging was introduced.

Cleanup uncertainty is operational, even when parsing also rejected input. Its
exception explicitly retains the original failure/diagnostic and every cleanup
cause; cancellation stays cancellation. An expected InputRejected reaching the
session retains its full diagnostic privately, with only the existing safe reason
public. If that diagnostic cannot fit core's protected-evidence allowance, explicit
PreparationEvidenceFailed retains the original rejection whole; there is no clipped
evidence or false invalid-input terminal result.

Maintained focused lane: make test/integration/provider-core/uploads. It builds and
installs the actual local core offline and grants only the existing authored
normative/mixed_records.xyz and expected.json fixtures read-only, in addition to
the existing consumer sources. Paths and parents reject symlink substitution.
The scripted chooser selects water record 2 then chloromethane record 1. Actual
JobUploads verifies local TLS membership/grant/store transfer; the real pure XYZ
reader preserves independently checked atoms/coordinates and source lines
[10,11,12], [3,4,5,6,7]. At scientific dispatch the actual AttemptStore must already
contain EXECUTION_ENTERED and both prepared identities. Before one complete signed
publication, the exact terminal body is retained and all cleanup ports confirmed.
A new store instance reopens the confirmed record. The fixture checks two membership
reads, one grant, one store transfer, one parser allocation and one batch execution.

This proves acquisition/binding/storage control flow with real pure parsing;
choice, shifts and reader/scientific host retirement are recording ports. Existing
separate-container reader and released-model qualifications remain distinct.
Production reader allocation, external interpreter, pasted-text spans, SMILES
conformer generation and normal deployed provider composition still remain open.
No dependency acquisition, external interpreter call, sibling edit or deployment
was performed. These tests first failed without UploadPreparation. Review exposed
and corrected stale references, pre-parse budget charging, simultaneous read/cleanup
evidence loss, dropped reader diagnostics and the between-HTTP-calls retirement race.
Final focused checks pass: 13 Upload preparation/lifecycle cases, 28 installed
session/store cases, 40 geometry-worker cases and 31 planner/launcher/convention
cases. Changed-file lint, shell syntax and whitespace checks pass. The first
integrated review pass after those corrections returned no actionable signal.

Input preparation joins the existing session owner, 2026-10-19
============================================================

NMRNetSession now accepts one optional input_preparation owner. After exact
Attempt/verified-Job admission, that owner returns PreparedJobInput: the ordered
geometry tuple and its preparation method. The existing ResultPlan freezes the
same values before one batch worker dispatch. Direct JSON remains the default
and preserves its original bytes; no text classifier or fallback was added.
Session retirement also retires the input owner, attempting scientific channel
closure, host retirement and closure observation even when input cleanup fails.
All independent cleanup causes remain private and cancellation stays cancellation.

Review found that late InputRejected could overwrite an already retired phase.
Both late successful input preparation and late rejection now block Job outcomes
and scientific dispatch. Focused installed-core tests cover ordered batch dispatch,
cleanup failure aggregation and both retirement races, alongside existing direct
and durable-lifecycle cases. Changed-file lint and the container-guard/hierarchical
Make convention checks pass. This establishes the binding seam, not authenticated
Upload selection, interpreter behavior or reader retirement in that consumer.
Those are the next integration slice; no new scientific qualification is claimed.

One scientific worker execution for an ordered batch, 2026-10-19
================================================================

PredictionSession, ReleasedPredictionSession, PredictionClient and the private
worker now carry one ordered tuple/list of requests and outcomes under one live
preparation handle. The standalone predict_request calculation is unchanged.
Every request parses before dictionary I/O; one verified dictionary admits every
atom, and all H/C tensors compose before any checkpoint/scaler load. Failed
replacement revokes the old handle. Execution consumes its exact handle eagerly,
then a private iterator produces each complete geometry for the release owner.
The release owner exhausts that iterator before returning a whole outcome tuple.

Each geometry retains the original H-then-C calculation and model/scaler release.
The existing loader resets only its observation scope between geometries, keeping
the verified dictionary. Snapshots describe actual successful loads and actual
warning emissions. Python warning filters/registries are unchanged; a suppressed
warning is not fabricated for a later geometry. Per-head caching across geometries
would change warning applicability and resource observations, so it is a separate
qualified optimization rather than a prerequisite for this migration.

The one framed request is bounded by 128 geometries, the existing per-request
1 MiB/128-atom limits and the existing complete 2 MiB frame cap. A necessary raw
aggregate bound runs before base64 allocation; exact frame admission still owns
all base64 expansion and JSON overhead. Replies must contain exactly the prepared
number of outcomes. No per-geometry RPC, reconnect, pool or alternate lifecycle
owner was introduced. The direct Job binding now passes singleton tuples; it
still does not prepare multiple geometries from an Upload or interpreter.

Expected batch admission errors retain their original cause plus the geometry
ordinal and failed parsing/dictionary/tensor phase. A later execution failure
keeps prior complete outcomes, failed geometry and current loader observations
in a protected exception note. Malformed/count-mismatched result replies retain
their decoded private reply on WorkerResultRejected. A failed success-frame send
retains completed outcomes on the original failure, without a second frame or
retry. An unsendable diagnostic still requires the existing host's protected
stderr; recording failure preserves the original scientific/transport exception
and the recording cause. These paths establish no public partial success.

The controller's single exchange deadline covers waiting for the whole response;
it does not interrupt synchronous native execution. Session closure and existing
exact-allocation HostRetirement remain necessary on timeout/cancellation. Public
result and durable identity limits remain independently enforced by their owners.
Aggregate success-evidence capacity and real source-to-batch retirement still
need their consumer witnesses when the Upload/interpreter binding is connected.

Five initial scientific-batch tests failed before implementation, then passed.
The aggregate pre-base64 allocation finding also failed first. Focused tests now
exercise original handle replacement/one-use behavior, bad later input before
models, different/repeated ordered wire values, later scientific failure and
protected prefix/cause, actual warning suppression, head isolation, frame overflow,
and malformed reply retention. A new fixed prediction/worker-parity/batch lane
reuses the same admitted image, read-only grants and host lifecycle as the full
worker parity lane; its launcher test first refused the unknown action.

Actual tensor checks in the admitted image passed all 27 cases. The synthetic
maximum 128 geometries x 128 atoms (both heads) retained 57,794,560 tensor bytes
in 256 prepared head sets. The final source-matched measurement took 0.341 s and
observed 450,351,104 process peak RSS bytes under the 1 GiB container limit, without
checkpoint/scaler loads. This is allocation evidence, not whole-model capacity
or physically plausible geometry. Image:
sha256:cabb4fe3e36541b0fefe54ca7c16fb21f9a60112a1e3d47992d4aa18343ecd08.

The initial full worker-parity run passed three cases in 55.720 s, including the
four historical released reference records and a real ordered H/C, C-only, O-only
batch exactly matching the direct callable. These synthetic batch inputs prove
composition/parity and per-geometry provenance, not experimental accuracy. Final
source-matched focused batch run passed in 12.515 s through the new maintained
target. Its manifest and private output are retained at
.work/qualification/scientific-batch-SLYiEpcP; the manifest rehashes unchanged.
Its final tensor.stdout/tensor.stderr retain all 27 passing native tensor tests
and the resource measurement above (0.866 s total test execution).
The three ordered request digests are 804d798e...376c49, 67c8fb5d...876f2b and
0e7ffc9e...121d2c (full values in its bounded stdout qualification record).

The real separate-container scientific lifecycle initially failed: a local TLS
qualification callback still expected top-level provenance in retained private
evidence instead of evidence.geometries. Scientific execution and exact retirement
had completed, but KeyError prevented the final proof observation. Private failed
receipts remain at /tmp/nmrnet-worker-proof-ZDRdDRmz. The assertion now unpacks the
singleton evidence geometry, checks its request hash against the public geometry,
and retains both runtime/artifact comparisons. The rerun passes with real models,
installed core, durable retention, host-confirmed retirement, signed local TLS
publication and store reopen. Receipt:
.work/qualification/provider-lifecycle-nmrnet-worker-proof-HVFCIBEO/summary.json.
All 90 recorded source identities rehash against the final working tree.
This is still a singleton Job lifecycle, not an interpreted Upload or deployed API.

Final focused unit/process/helper checks pass (138), as do 22 installed consumer
integration checks. Production code and the formatted worker tests pass changed-file
lint/format; shell syntax and whitespace pass. Two legacy touched test files have
28 pre-existing lint findings at parent 78f49e3 (10 in test_prediction_input.py,
18 in test_prediction_model.py); a contained HEAD/current comparison found no
introduced findings. Unrelated formatting was restored and no lint policy was
weakened. No full suite, new dependencies, external interpreter call, sibling edit
or deployment was performed. Final code, science/provenance and operations/error
reviews returned no actionable signal in two final consecutive rounds on the
unchanged implementation before commit.

Whole-result planning for ordered geometries, 2026-10-19
========================================================

ResultPlan is the existing scientific result owner, now generalized to a nonempty
ordered tuple of PreparedGeometry and an equally ordered tuple of worker outcomes.
It freezes one reproduction envelope and reserves its complete JSON capacity
before execution. There is no second batch planner or per-entry publication.
Each entry retains its selection-order geometry ID, original source record/atom
mapping, request hash, explicit conversion, coordinates and supplied-H coverage.
Repeated geometries stay separate; no equivalence check or averaging is added.

Completion checks each outcome against that geometry's request hash, required
H/C artifact subset, runtime and ordered eligible atom rows. Later failure returns
no bytes. Protected raw outcomes remain caller-owned; the planner does not execute
or retain partial successes. The compact identity projects ordered source/request
facts and required_elements from the same frozen envelope, excluding coordinates
and raw text. Required does not claim that a model has already loaded.

The existing v1 envelope already contains a geometries collection. Warning records
gain an additive geometry_id, including singleton results; their existing fields
and top-level location remain. Each actual observation is associated with its
outcome, never merged into a claim about independent loads. The API treats this
product as opaque; no closed warning schema or deployed client contract was found.
Stored terminal bytes still replay exactly, without rebuilding the result. No
conditional singleton compatibility path or new schema is introduced.

The direct NMRNetSession and real-worker parity caller use singleton tuples with
the same planner; the scientific worker still handles one geometry. This slice
does not enable batch execution, Upload acquisition or an interpreter. Next extend
the existing worker's one-use preparation handle to the whole collection: admit
every request before any checkpoint/scaler load, execute sequentially, and retain
prior outcomes privately if later inference fails. Then connect actual JobUploads
and the binding-owned interpreter to this same result and lifecycle owner.

Five initial batch witnesses were authored first; four failed because only a
single PreparedGeometry was accepted. The extended suite covers different and
repeated XYZ records (2,1,3), original line mapping, missing/extra/reordered or bad
later outcomes, head/warning isolation, aggregate-only overflow, and a complete
escaped envelope at capacity with extreme finite shifts and both warning kinds.
The missing-model-selection audit finding was reproduced in three failing cases
and fixed at plan construction, before scientific dispatch.

The core evidence limit remains owned by ProtectedEvidence, constructed by the
session before worker.prepare. A synthetic 112-geometry, 128-O-atom-per-geometry
MOL2-mapping witness fits the complete result budget but exceeds the compact
identity budget; the installed consumer test confirms zero dispatch and subsequent
retirement. The first 128-geometry witness exceeded both budgets, so contained
byte measurements established the distinct-limit case. No scientific tolerance
or published capacity was inferred from these synthetic bookkeeping tests.

Focused checks pass: 22 result-admission tests plus one source-guard check, and
22 installed-core consumer/store/retirement integration tests. Changed-file lint,
format and whitespace pass. The real-model parity caller was migrated, but that
costly lane was not rerun; no claim about real batch execution or numerical parity
comes from these fixtures. No full suite, dependency acquisition, interpreter call,
sibling edit or deployment was performed. Two final independent code,
science/provenance and operations/error review passes returned no actionable
signal after corrections. Accepted findings restored early selected-model checks
and made required heads explicit in retained identity. The identity-capacity guard
was tested at its existing owner instead of duplicated in this planner.

MOL2 reader-process and container binding, 2026-10-19
====================================================

The existing private reader now carries MOL2 with the same bounded source and
ordered-selection request used by XYZ/SDF. Reply admission preserves original
positive, unique atom IDs through 2^53-1 rather than imposing contiguous MOL rows.
Whole-source hash, units and conversion facts come from the caller's exact bytes
and options. The reader owns correspondence; the receiver does not parse again.

Three process witnesses first failed without MOL2 routing, then passed: different
records in requested order, nonconsecutive IDs with explicit nm conversion, and
selected-later unsupported types rejecting without a successful prefix. Additional
receiver tests reject duplicate, zero, oversized or boolean atom IDs, false position
kinds and changed selected record order. The fixed host lane
test/integration/provider-geometry-worker/mol2 selects water record 2 then
chloromethane record 1 against the existing independent expected.json. A negative
oracle witness substitutes record 1's coordinates into record 2 and must fail.

The lane reuses the existing CID/image/profile admission, HostRetirement and IPC
cleanup. Only the controller mounts the source and expected data. The pure worker
has no RDKit/Torch, input-file mount, network, engine, checkpoints or credentials.
The source manifest includes mol2.py for every geometry case now importing it,
and includes the MOL2 fixture only for its actual case. These are fixed reader
and retirement witnesses, not Upload/interpreter, batch inference or deployment
qualification. The direct-reader limits below describe commit b087ba1; this
follow-up supersedes its then-pending private-worker connection.

Focused evidence: 40 structure-worker unit/process/helper checks, one Make target
regression and two guard/hierarchy checks pass. The separate MOL2 and PDB container
lanes pass, as do seven actual native MOL/SDF wire compatibility checks. Final
source receipts are .work/qualification/provider-geometry-nmrnet-worker-proof-JWphg8gy
(MOL2) and provider-geometry-nmrnet-worker-proof-6rRweA0Z (PDB) in the same directory.
Both manifests rehash against the final sources. Changed Python lint/format,
shell syntax and whitespace pass. No full suite, model run, download, interpreter
call, sibling edit or deployment was performed. Two final code, science and
operations/error review passes found no actionable issue; their earlier findings
added the imported module to source closure and updated stale reader-only claims.

MOL2 coordinate projection, 2026-10-19
=====================================

The selected implementation is pure nmrnet_provider/mol2.py, sharing existing
decode_source/prepare_rows/unit admission with other readers. NMRNet consumes
elements and XYZ; no native graph/charge perception is needed to obtain those
fields. This supersedes the tentative RDKit-MOL2 path in 015/016 without weakening
source preservation or worker/container qualification. The source is retained by
whole-file digest, original record ordinal and original integer ATOM IDs in file
order. No bond, charge, isotope/stereo or alternate-attribute interpretation,
molecular-equivalence check, atom reordering or H completion is performed.

Tripos, Tripos Mol2 File Format, SYBYL 7.1 (Mid-2005), printed/PDF pp. 3, 12 and
53-54 owns section framing, ATOM rows and concrete SYBYL type interpretation:
https://zhanggroup.org/DockRMSD/mol2.pdf#page=3
https://zhanggroup.org/DockRMSD/mol2.pdf#page=12
https://zhanggroup.org/DockRMSD/mol2.pdf#page=53
The complete concrete dotted vocabulary has 27 entries, represented by small
per-element suffix sets; unknown suffixes never become elements by prefix guessing.
Two real sulfur spelling aliases, S.o/S.o2, are explicit extensions supported by
MDAnalysis 2.9.0 SYBYL2SYMB and Open Babel 3.1.1 MOL2Format::ReadMolecule:
https://docs.mdanalysis.org/2.9.0/_modules/MDAnalysis/guesser/tables.html
https://github.com/openbabel/openbabel/blob/openbabel-3-1-1/src/formats/mol2format.cpp#L269-L272
The manual's extracted text uses uppercase O; no rendered-image verification was
possible. The independent published mappings agree with uppercase forms and also
support the two lowercase aliases. This is not general case folding. Bare element
spellings beyond the table are a declared extension; the existing request parser
and later model dictionary own usable element admission. Pseudo/query types and
D/T labels request correction rather than creating/removing a supplied nucleus.

requirements/preparation.md retains the complete reference pages/sections and
precise native research chain (RDKit issue 9421 -> PR 9417 -> released changelog),
with unavailable advisory, older-source and binary/source identity limits. It does
not mistake Open Babel advisories for RDKit issues or clear the separate V3000
block. Avoiding the native MOL2 graph parser is a product-boundary choice, not
evidence that the retained toolkit is safe or unsafe for that path.

Framing covers the whole bounded source; section markers start with @ in column 1.
Only selected ATOM rows/types/counts are parsed. BOND/SUBSTRUCTURE/attribute content
is opaque. Selected ATOM rows must occupy one physical line; unsupported wrapped
rows request correction. A failed selected record returns no successful prefix;
unselected unsupported chemistry does not block an otherwise readable selection.
Bounds reuse 1 MiB source bytes, 128 records and 128 selected atoms/record. Source
IDs are positive integers through 2^53-1 so JSON consumers preserve their exact
identity; this is an explicit transport bound, not a Tripos integer-width claim.
Significant digit count is checked before integer conversion. Source units remain
the caller's explicit assertion; conversion uses the shared scientific constants.

Tests were authored and failed before the module existed. The maintained offline
test/unit/provider/mol2 lane includes normative/adversarial groups and independent
expectations for all 27 dotted types plus two aliases, original corpus order/H and
different/repeated records, arbitrary nonconsecutive IDs, conversion, metadata and
LF/CRLF hashes, selected suffix failure, section/count/ID/coordinate errors and
resource limits. Existing fixture expectations were not regenerated. This direct
reader is not yet the private-worker, Upload/interpreter or deployed offering.
Focused evidence: all 14 direct-reader checks pass, plus the pure-reader launcher
regression (both PDB/MOL2) and two guard/hierarchical-Make checks. The full declared
dotted vocabulary and two observed aliases are exercised without importing RDKit
or Torch in the lightweight checker. Changed Python lint/format, shell
syntax and whitespace checks pass. No native/model run, package acquisition,
upstream/sibling edit, interpreter call or deployment was performed in this slice.
Code, science/provenance and operations/error auditors each returned no actionable
signal in two final unchanged passes. Accepted findings enforce RTI column 1,
document and test the two actual sulfur aliases, and refuse Python-only numeric
digit separators. The underscore witness first reproduced 1_0 becoming 10.0;
the reader now requires decimal/exponent tokens before shared finite admission.
Expected input errors identify record and ATOM row without echoing source values.

PDB reader-process and container binding, 2026-10-19
===================================================

The private GeometryClient/protocol now carries PDB through the existing one-read
worker. Only PDB requests carry an explicit alternate_location field; other format
request shapes remain unchanged. Selection count stays capped at 128, while actual
MODEL serials may be 1-9999. Explicit selections must return the exact requested
order. For all, the reader owns source population/order; the controller checks
bounded unique actual IDs without reparsing the file. Atom positions use the
distinct atom_serial kind with unique positive 1-99999 values, not source line
numbers or contiguous MOL rows. Source hash/unit/conversion stay caller-owned.

Three real-process witnesses were written and failed before PDB protocol support:
explicit B, unlike model serials 900/7000 in all/requested order, and corrective
alternate-choice rejection. Additional wire tests reject missing/inapplicable
options, out-of-range/duplicate model IDs, false position kinds and invalid serials.
They do not prove arbitrary worker correspondence; the reader's independent
fixtures own that scientific claim.

The maintained test/integration/provider-geometry-worker/pdb lane reuses the existing
CID admission, worker profile, HostRetirement and IPC cleanup owners. Both roles
use the admitted lightweight checker image; neither imports RDKit or Torch. Only
the controller mounts the authored alternate-location source and independent
expected.json; exact bytes cross IPC. The worker has no input-file mount, engine,
network, model artifacts or credentials. Existing image/posture/retirement/source
receipts retain actual closure, including pdb.py now imported by the protocol.

First live run failed before reading: the probe's scenario allowlist omitted PDB.
Its exact worker was retired/removed and private failure evidence retained at
/tmp/nmrnet-worker-proof-Wkik66R9. Adding that missing scenario fixed the real run;
no success was inferred from process or codec-only checks. Native MOL/SDF request
semantics, retirement ownership and scientific prediction code were unchanged.
This qualification does not establish authenticated Upload acquisition, interpreter
selection, whole-batch inference, production orchestration or provider deployment.

Final focused evidence: 35 structure-worker unit/process/helper checks, two Make
scenario regressions and two guard/hierarchy checks pass; seven real MOL/SDF wire
checks also pass in the admitted RDKit image. Source-matched separate-container
PDB, existing XYZ success and deliberately stalled XYZ retirement all pass after
narrowing XYZ fixture grants to its actual scenarios. PDB's retained receipt is
.work/qualification/provider-geometry-nmrnet-worker-proof-UQUrcPOE; its source
manifest was independently rehashed against the final working sources. Changed-file
lint/format, shell syntax and whitespace checks pass. No full suite, scientific
model invocation, dependency acquisition, sibling edit or deployment was performed.
Two final independent code, science/provenance and operations/error review passes
returned no actionable signal. Accepted findings added the missing probe scenario,
narrowed unrelated fixture grants, and described PDB wire identifiers accurately
as declared MODEL serials or a sole-block ordinal. Existing lifecycle owners and
independent expected data remain the authorities.

PDB coordinate reader, 2026-10-19
=================================================

The actual reader nmrnet_provider/pdb.py extracts fixed-column coordinates without
RDKit. NMRNet needs no PDB graph; a native projection would require qualifying a
second parser's filtering, graph handling and atom correspondence. This replaces
the prospective native-PDB implementation wording in 016, while retaining its
source-preservation and real worker/container proof requirements. No present-version
RDKit behavior is asserted from older source code. Real native evidence remains
required for MOL/MOL2 and SMILES where those implementations use RDKit.

Primary authorities, verified 2026-10-19 by the independent format investigator:
https://www.wwpdb.org/documentation/file-format-content/format33/sect9.html#MODEL
  Serial columns 11-14 and paired ENDMDL delimit explicit models.
https://www.wwpdb.org/documentation/file-format-content/format33/sect9.html#ATOM
https://www.wwpdb.org/documentation/file-format-content/format33/sect9.html#HETATM
  Atom serial 7-11, atom name 13-16, altLoc 17, residue 18-27, X/Y/Z 31-54,
  element 77-78. Element columns own identity; atom names do not guess elements.
https://www.wwpdb.org/documentation/file-format-content/format33/sect9.html#ENDMDL
https://www.wwpdb.org/documentation/file-format-content/format33/sect11.html#END
  A complete END-terminated entry is the supported subset. No hidden trailing
  records, nested/duplicate/unclosed models, mixed implicit/explicit atom regions
  or nonblank unused framing fields are accepted.

Selection keeps source order for all, caller order for explicit model serials, and
independent source atom serials in original row order. Without MODEL, record 1 is
the sole source-block ordinal, not a claimed declared model serial. No cross-model
equivalence, alignment, H completion, isotope conversion or connectivity parsing
is performed. Explicit element fields are required. Atom serials must be unique
across all alternatives in a selected model: source references use serials, not
ambiguous occurrences. Identity/site metadata is therefore admitted for those rows;
coordinate/element values are parsed only for the selected alternate. All atom
semantics of unselected models remain opaque; framing is always checked.

One explicit printable nonblank ASCII altLoc label must resolve every alternate
site; common blank-location sites survive once. Missing labels, duplicate labels,
blank/alternate conflicts at one site and conflicting residue/record naming request
correction. Uniform label selection is our supported subset, not a wwPDB mandate;
independent per-residue choices need a separately selected structure. Occupancy
never selects. Source site identity is chain/residue number/insertion code/atom
name; conflicting residue names or record kinds cannot create duplicate sites.

PDB's documented convention is angstrom. The required source_unit argument follows
MOL/SDF/XYZ and permits a user-stated nonstandard-unit assertion, retaining its
factor/reference. It never estimates units from bond size. The future interpreter
must carry evidence for overriding the format convention. A proposal to forbid
all overrides was declined against the maintainer's explicit-rescaling direction;
a second optional MODEL identity was declined in favor of the documented ordinal.

Tests were written and failed before the module existed. The maintained offline
test/unit/provider/pdb lane exercises original corpus serial/element/H order, A/B
selection with perturbed occupancy, independent nonconsecutive models with different
coordinates/atom sets, explicit units, whole-source LF/CRLF hashes, unselected values,
private-safe selected failures, framing and byte/model/atom bounds. The existing
repeated-model fixture is preserved; the new unlike-model witness is independently
authored in the test instead of regenerating expected data with this parser.
At 1b2ba0c this direct-reader evidence did not advertise PDB Uploads or prove a
private-worker/host-retirement binding; the dated follow-up above supersedes that
worker gap. MOL2, SMILES and the Upload/interpreter binding remain open.
Final focused evidence: 14 reader tests pass through the maintained offline lane;
two launcher regressions and two relevant guard/hierarchical-Make checks pass.
Changed Python lint/format, shell syntax and whitespace checks pass. Sources and
existing expected fixtures were preserved. No RDKit/model run, acquisition, sibling
edit, external interpreter request or deployment was performed in this slice.
Code, science/provenance and operations/error auditors each completed two final
passes without actionable signal. Accepted corrections reject nonblank framing
tails and DEL in inspected columns, admit printable alternate labels, and leave
unselected alternate coordinate/element values opaque. The request to permit
ambiguous duplicate source serials was declined for the correspondence reason
above. No unrelated expected-fixture regeneration or molecular validation was added.

Retain selected input before inference, 2026-10-19
=================================================

The original Job fingerprint cannot identify the geometry chosen by an interpreter.
Core now requires analysis.PreparedAnalysis on successful session preparation. This
instance is the one-use live handle, with binding-owned ProtectedEvidence identity;
it does not contain or recreate the worker handle. AttemptExecutor retains its
identity in the existing AttemptStore execution-entry replacement before science.
Missing identity, a refused/uncertain write or a changed active state prevents
dispatch. Existing write settlement, claim ownership and retirement remain the
owners; no journal, cache or new recovery executor was added.

ResultPlan.prepared_identity projects the frozen admitted envelope into ordered
request hashes, whole-source digest/record/atom mapping, method/unit/factor/reference,
execution identity and admitted model/runtime facts. Coordinates, Job prose and
private warnings are excluded. This records the candidate selected before dispatch,
not proof that the worker consumed it or loaded those artifacts; returned worker
evidence still supplies that later proof. NMRNetSession returns the exact handle it
will consume. A copied handle with identical evidence cannot execute.

Identity-bearing acknowledgements use strict acknowledged.v2. Historical v1 records
retain their exact field set and original byte bound; entered v1 records still have
unknown candidate identity and cannot rerun. Terminal-v1 envelopes retain either
acknowledgement version without changing exact publication bytes. The existing
262144-byte evidence bound is reused, rather than inventing a smaller unmeasured
batch cap. Store admission reserves both input identity and independent terminal
evidence before effects. Maximum-record witnesses combine both maximum payloads
and worst-case escaped identity-schema text; neither payload is truncated.

Tests first exposed absent identity/mandatory dispatch enforcement. Maintained
offline lanes test/unit/provider-core/prepared-identity and
test/integration/provider-core/prepared-identity build/install the package and run
only the affected execution, persistence, transition, terminal, recovery and consumer
cases. Each selected pattern must contain tests. The direct NMRNet signed-TLS test
compares the retained candidate request hash with the published result; scripted
Magnet/child fixtures preserve their existing proof limits. This completes the
pre-dispatch identity prerequisite, not authenticated Upload/interpreter binding,
whole-batch inference, startup service orchestration or deployed qualification.

Focused evidence: 65 installed-core unit checks and 21 installed-core integration
checks passed after the final boundary/capacity corrections. Another 21 offline
checker checks cover result projection, all core launcher choices and the relevant
container-guard/hierarchical-Make conventions. Changed-file lint, formatting, shell
syntax and whitespace checks pass. No full suite, model run, package acquisition,
sibling/upstream edit, external interpreter request or deployment was performed.
Independent code, science/provenance and operations/error reviewers each returned
no actionable signal in two final unchanged passes. Accepted review corrections
preserved the v1 byte ceiling, typed the execute handle, tested simultaneous maximum
identity/terminal evidence, and narrowed the projection docstring to raw input text.

Current architecture decision, 2026-10-18
========================================
The maintainer selected a local standalone provider-core package, intended for
future adoption by sibling providers. Do not depend on or extend Magnet's package.
017_provider_core_plan_20261018.txt owns the proposed package boundary, sequence
and individual U/A acceptance ledger. The maintainer authorized tests-first package
implementation; its first installed input slice is recorded there. This supersedes shared-Magnet integration
proposals below, while preserving this note's scientific and API/GUI contract.

Download proxy image review, 2026-10-19
=====================================

The acquisition proxy now uses pinned Python 3.12.12 on Alpine 3.22.
Scientific workers retain their Debian base.
README prerequisites and tools/docker.sh preserve the size sources, exact image
identity and rationale. This does not solve initial image provisioning.

Coordinator and three context-isolated Luna-low reviewers challenged provenance
(U16/U19/U22), actual boundaries/failure/cleanup (U07/U08/U11/U14/U23/A01/A03/A04),
and clarity/necessity (U09/U15/U17/U25/A05/A10). Two unchanged-revision rounds
returned no actionable findings. Scientific semantics and reference fixtures are
unchanged. Evidence: 46 focused proxy/launcher checks passed in the cached checker;
the final pin assertion was rerun after simplifying its construction. Changed-file
lint/format, shell syntax and whitespace checks passed. No full suite was run.
The pinned Alpine image has not been executed here: live import, interface binding
and readiness qualification remain pending provisioning. Existing startup probes
must succeed before the launcher creates the acquisition worker; no fallback image
or weaker interface policy was added.

Proxy image bootstrap follow-up, 2026-10-19
------------------------------------------
The maintainer subsequently requested a default-network bootstrap command.
make packages/base-images/proxy/download now downloads the exact declared proxy
image into local Docker without requiring a pre-existing proxy or checker image.
This supersedes the provisioning gap recorded above for the proxy only. The
Debian worker base still needs separate provisioning. The explicit bootstrap uses
daemon network settings/default routing, not forced device binding; package and
artifact acquisition retain their explicit WLAN_INTERFACE policy. Docker digest
pull and daemon proxy sources and rationale are beside the operation and in README.

The improve-user-facing-text workshop compared download and bootstrap names.
A context-isolated operator reader understood the final download name/help as
loading only the pinned proxy image into local Docker, with routing owned by its
daemon. The daemon must already be running and accessible. Existing native-client
and cleanup owners are reused; interruption does not prove daemon work stopped,
and no image deletion or rollback is attempted. U/A review corrected stale missing-
proxy recovery instructions to name the new target. The three initial bootstrap
tests failed before implementation; 30 focused bootstrap/Make/engine-fixture checks
then passed in the cached offline checker. Actual image acquisition and live proxy
qualification have not yet been run at this commit.

Pre-download advisory review: Python 3.12.12 has later security patch releases.
The 3.12.15 urllib fix concerns urllib.request.HTTPPasswordMgr, whereas this proxy
uses urllib.parse.urlsplit without HTTP credential handling. That scoped distinction
supports retaining the declared pin for this operation, not an image-wide safety
claim. Sources consulted for exact scope and rationale (2026-10-19):
https://www.python.org/downloads/release/python-31215/
https://github.com/python/cpython/issues/155694
https://github.com/advisories/GHSA-2v69-2w5x-455j
The pinned image's Alpine base also predates security maintenance in 3.22.6:
https://alpinelinux.org/posts/Alpine-3.21.8-3.22.6-3.23.6-3.24.2-released.html
This bootstrap does not refresh that base or establish that every image advisory
is inapplicable; a runtime refresh needs its own reviewed pin and qualification.

Live bootstrap evidence, 2026-10-19
---------------------------------
The target was committed as 41aa8f4 before the maintainer-authorized download.
make packages/base-images/proxy/download returned zero. Local Docker inspection
reported linux/amd64, registry index 848ba4413eb897e225159b8fc1b02094576cbae4aa73fc13142608ae2c8c0e32,
image ID sha256:beb80cc3d3e4d4900185b5396b31094434bbac0b08637e6dd187533f025b36ff,
and 48,765,033 bytes of image size. The bootstrap uses daemon routing, not an
observed or enforced device binding for Docker's registry transfer.

The maintained tools/docker.sh run then started the Alpine proxy plus an Alpine
stdlib client, with the machine's observed default interface explicitly selected
for this separate acquisition check. The launcher configured read-only roots,
non-root UID/GID, no capabilities, no-new-privileges and bounded resources, with
no writable source or engine-socket mounts. An HTTPS request to
https://pypi.org/pypi/rdkit/2026.9.1/json returned HTTP 200 and bounded JSON with
the expected rdkit/2026.9.1 identity. This existing dependency metadata endpoint
was chosen to exercise interface-bound DNS, CONNECT and TLS without acquiring
another package. The launcher returned zero after its normal container cleanup.
This demonstrates startup and one HTTPS transfer through the configured proxy.
It does not qualify an egress firewall, RDKit execution, the Debian worker image
or scientific predictions; no independent packet or final mount inspection ran.

RDKit dependency import evidence, 2026-10-19
==========================================
The focused test/integration/rdkit-runtime lane reuses the existing container,
wheelhouse and lock owners. It captures the three retained wheels before hash
verification, installs offline into a pip-free temporary environment, and checks
the exact locked distribution set plus actual native extension origins. Tests
run with isolated Python outside the checkout; source and dependency mounts are
read-only, network is none, and only bounded container scratch is writable.
The ordinary /tmp stays noexec; native mappings use the separate /runtime tmpfs.
No image builder, dependency version map or bootstrap-package waiver was added.
Pip's documented --python/--without-pip relationship is cited beside installation.

Tests-first: all three runtime checks failed before installation, then passed
using the explicitly selected cached checker image recorded in
requirements/preparation.md (Python 3.12.12, linux-x86_64). Four focused guard/launcher
checks and changed-file lint/format/silent-default checks passed. An actual call
to the maintained target stopped because its pinned Debian Python base is absent;
no implicit alternate image or network acquisition followed. These observations
qualify the isolated alternate-image imports, not the planned minimal worker
image, native file readers, SMILES generation or public submission. Advisory
rechecks and their precise primary sources are recorded in the dependency note.

Debian Python bootstrap target, 2026-10-19
-----------------------------------------
The maintainer explicitly authorized the same daemon-default bootstrap for the
Debian Python base and requested a Make target. make packages/base-images/python/download
uses tools/container.sh's existing immutable image pin, private Docker client and
native lifetime/cleanup owners. This extends the proxy-only exception above; it
does not change package/artifact interface selection, dependency versions or
scientific worker execution. The default daemon route is not device-bound by us.
README and the operation cite Docker's digest-pull and daemon-proxy documentation.

Rationale for keeping the daemon pull rather than adding a containerized registry
client: current workers require the original registry index-digest reference.
Docker's classic image loader accepts tagged RepoTags and calls AddTag; loading an
exported archive would not restore that digest reference. Primary source checked
by the delegated precedent reviewer:
https://github.com/moby/moby/blob/docker-v29.8.1/daemon/internal/image/tarexport/load.go#L1047-L1067
https://github.com/moby/moby/blob/docker-v29.8.1/daemon/internal/image/tarexport/load.go#L1211-L1219
This is a bounded provisioning exception, not a new image transfer framework.

Tests-first: the three new checks failed before implementation. Thirty focused
Python/proxy bootstrap and strict engine-fixture checks passed in the offline
checker, covering
the actual Make target, inert preview, exact pinned argv, success/failure status,
empty private client configuration and its removal. Review covers U05/U07/U08/U11/
U13/U14/A03/A04 (boundary/errors), U09/U15/U17/U25/U26/A05/A10 (clarity/necessity),
and U16/U19/U22 (provenance/privacy). A proposed content-trust concern was withdrawn:
Docker permits explicit-digest pulls without tag-signature lookup; no shared helper
change was justified. Source: https://docs.docker.com/engine/security/trust/
The README now says rerun to ensure availability, since a failed client can leave
a complete image. Two subsequent source-review rounds found no new actionable
signal. Changed-file lint/format, shell syntax and whitespace checks passed.
At that pre-download commit, actual Debian provisioning and canonical RDKit
target execution were still pending; the following section records their results.

Live Debian bootstrap and canonical import evidence, 2026-10-19
--------------------------------------------------------------
The bootstrap target was committed as 5062cf3 before execution.
make packages/base-images/python/download returned zero and reported the declared
registry index digest 593bd06efe90efa80dc4eee3948be7c0fde4134606dd40d8dd8dbcade98e669c.
Local image inspection reported linux/amd64, image ID
sha256:9cb180cb36bd45dc786105b834d3cb5f3b1d69a6a63c79ca10fc64f108aa649a,
124,298,432 bytes and the same RepoDigest. All four layers already existed; this
establishes successful registry pull/provisioning, not a fresh transfer-size measurement
or an observed device binding for Docker's registry traffic.

make test/integration/rdkit-runtime then returned zero on the canonical Debian
base: Python 3.12.12, linux-x86_64, all three checks passed, no broken requirements.
The earlier missing-base observation above is superseded for this maintained lane.
requirements/preparation.md owns the corresponding dependency evidence and limits.
No molecular file reader, SMILES path, model or public Upload route was exercised.

Geometry worker image prerequisite, 2026-10-19
---------------------------------------------
Source review confirmed that 003/016 require an admitted offline native-worker
image before real molecular-reader tests. Temporary-venv import evidence alone
does not meet that prerequisite. geometry/image/build now owns that image;
test/integration/rdkit-worker checks its installed lock, interpreter isolation and
native extension origins. The maintainer challenged vague "preparation" naming;
new image code is tools/geometry_image.sh and containers/geometry. Existing
dependency lock/wheelhouse paths retain their established identity.

The sourced geometry-image helper reuses container.sh's Docker client, native
lifetime and cleanup owners. Build inputs are copied from committed Git blobs
with byte/mode checks, and wheels are frozen before hash verification/installation.
The same pip-free, offline installer now serves the temporary runtime check and
the image build; its existing pip --python reference remains beside that owner.
The build uses the declared Debian base, network none and pull=false. Its private
capture is retained if native retirement cannot be confirmed. No qualified
inference dependencies, upstream or sibling sources change.

Independent source review found stale-image admission possible when only an image
ID was retained. The image now carries the SHA-256 of its captured Git-tree input
inventory, including object IDs, paths and modes. Runtime admission compares that
label with the current committed input closure and rejects changed build inputs.
No second receipt or commit-wide freshness marker was introduced. An unrelated
commit leaves the identity unchanged. This is dependency-image admission; native
reader code, Upload access and submission remain separate unfinished slices.

Focused evidence before first build: six guard/printed-launch checks and five
real-Git/finite-engine checks passed. The latter cover frozen committed bytes,
dirty-input rejection before engine dispatch, previous-record preservation on
build failure, rejection after a committed lock change with unchanged package
versions, and refusal to publish an image with a wrong input label. The initial
new launch check failed before the owner existed. At commit 2bab418, actual
image construction and installed-image qualification were still pending; the
following section records their execution.
Two convention and 24 affected engine-fixture checks also passed; changed-file lint/format, shell syntax and
whitespace checks passed. Three independent Luna-low auditors covered containment/
lifecycle/failure (U05/U07/U08/U11/U14/A04), science/source/privacy (U03/U16/U19/
U22/A02/A07/A08), and clear errors/necessity (U09/U13/U15/U23/U25/A03/A05/A10).
After the accepted stale-image and before-publication label corrections, two
unchanged-behavior source-review rounds returned no actionable signal. Hashing
the trusted host launcher itself was rejected: this label identifies the delivered
Docker build inputs, not an attestation of the live host's orchestration code.

Live geometry image and first MOL reader, 2026-10-19
--------------------------------------------------
After commit 2bab418, make geometry/image/build returned zero. Local inspection
reported linux/amd64, 370,977,650 bytes, immutable image ID
sha256:be4358dd385b280723831950e527e44a87de4ee49afa9020ef8e7e8929bd3bb3
and input label sha256:821eb1a070de3c92a996e004a2353d1e43974e76754ed6113ff98d44bd395e96.
make test/integration/rdkit-worker passed all three installed-runtime checks.
requirements/preparation.md owns these dependency/image results and limits.

The next bounded 2b increment is nmrnet_provider/mol.py, qualified through
make test/integration/mol-reader in that admitted image. Source/header/count/
single-record checks precede native import; LF and CRLF follow native framing
rather than Python's wider Unicode line separators. Explicit 3D/3d headers admit
planar supplied geometry; 2D, missing dimensions, V3000 and unknown versions reject.
V2000 identity is the one-based source atom row, not an arbitrary atom-map label.
Native parsing disables sanitization and H removal; no atoms or coordinates are
generated, optimized or reordered. Units remain an explicit caller decision,
converted once by the existing common owner. Pinned RDKit source references and
the unresolved V3000-advisory rationale are beside the implementation.
The science reviewer rechecked the exact Release_2026_09_1 parser/wrapper sources
and rdBase API on 2026-10-19; the separate counts-field source range was added.
GitHub blob pages were unavailable to that browser, so the exact-tag raw source
was consulted instead. RDKit's wrapper can swallow internal native exceptions
and return None; this outcome now raises an inconclusive RuntimeError, retaining
any bounded native diagnostic privately, rather than blaming the input. Only
deterministic source/admission failures use InputRejected.

The independently authored normative/adversarial tests were drafted before the
reader. First native execution exposed a test's wrong per-record nesting index;
that lookup was corrected without changing fixture expectations. Fourteen native
checks then passed, including fixed supplied coordinates, H/order, planar 3D,
CRLF, unit conversion, native call settings, private success warnings, parse
attempts with an inconclusive native result, bounded/truncated causes, malformed
counts/framing, extra records,
and V3000 rejection in a fresh interpreter without importing RDKit. The original
fixture provenance is tests/fixtures/preparation/README.txt; expected.json SHA-256
is da4280affa4b4aebcb66d74976b8f6a9e994f91d4975662d00577a2502b2fb87.
These are source-preservation fixtures, not experimental geometries or prediction
accuracy evidence. Thirty-five affected table/XYZ/wire/launcher checks passed.

Native causes are bounded during capture and kept outside public exception text
and repr. Warnings survive success; on unexpected failure a protected exception
note retains preceding native messages without changing exception type or str.
Diagnostics do not change scientific geometry equality. Pure admission rejection
also retains captured native context. The existing worker failure renderer owns
protected tracebacks; no generic public exception rendering is introduced.
Changed-file lint/format, shell syntax, shared guard/hierarchical-target checks
and the existing silent-default scanners on changed production modules passed.
Three Luna-low reviewers challenged science/provenance (U03/U11/U16/U19/U22/
A02/A07/A08), boundary/work/lifecycle (U05/U07/U08/U14/U25/A04/A05), and helpful
errors/privacy/necessity (U09/U13/U15/U23/A03/A10). Accepted corrections retained
diagnostics outside geometry equality, tested lowercase 3d, supplied the precise
counts-field reference, preserved warnings before operational failure, and made
the native wrapper's unclassified None outcome an inconclusive failure in code.
After those corrections, two unchanged-behavior review rounds returned no new
actionable signal.

At that revision MOL remained behaviorally rejected by the geometry protocol: expected private
causes and successful warnings must cross its wire before that dispatch is enabled.
SDF, Upload acquisition, other native formats, conformer generation and public
submission remain unfinished. This direct reader evidence does not close 003 2b.

Hydrogen scope and recipient guidance, 2026-10-19
------------------------------------------------
The supplied-coordinate result owner now reports supplied/predicted H counts and
explicitly leaves molecular H completeness unestablished from coordinates.
No H-count threshold labels input incomplete or rejects genuinely H-free species.
The serialized result explains no automatic H addition, ambiguity between omitted/
partial/genuinely absent H, possible context effects on other shifts, and the
separate authorization required to complete or regenerate geometry. README gives
the same input guidance. This is coverage of supplied atoms, not a full molecular
or proton coverage claim. Result byte reservation includes the added fields/text.

Tests first: a four-case recipient witness (supplied, partial, omitted and H-free)
failed for missing coverage before implementation. The result module then passed
its existing admission/capacity checks and that witness. Two authored V2000 files
extend the native corpus: partial_hydrogens.mol retains H,Cl,C and their bonds
from the existing chloromethane fixture; hydrogen_free.mol is synthetic CO2 with
O,C,O and two double bonds. The fourteen native reader checks passed, including
preservation of all five examples. These witnesses do not qualify NMR accuracy for incomplete
input. The updated expected.json SHA-256 is
1686803ac341e8502fbc9eaba71dccc1a6ebc04f121af4b0ba513e11e312d5b7;
earlier corpus hashes above identify their historical revisions.

The SMILES producer is still absent, and ResultPlan behaviorally rejects a SMILES
preparation method instead of applying supplied-coordinate coverage to generation.
Its required H behavior is specified below and in smiles.json; existing implicit/
explicit cases now have mixed explicit+implicit H and genuinely H-free companions.
Those are future producer obligations, not executed SMILES-generation evidence.
Final focused evidence: 22 result/pure-fixture checks and 14 native reader checks
passed; three changed Python files passed lint/format and SMILES fixture JSON
parsing passed. Independent science/provenance and recipient audits found no new
signal in repeated unchanged-behavior passes. Ordinary code review corrected a
stale SMILES fixture count. An isolated reader correctly taught back zero-H
coverage as unknown molecular completeness, not rejection of H-free input.

Result reservation follow-up, 2026-10-19
--------------------------------------
The H-coverage code audit found a pre-existing writable public result-size limit:
a caller could replace maximum_result_bytes after planning. The reservation now
has one private owner with a read-only public property; finish enforces the same
fixed value checked before inference. No second ceiling calculation or freezing
framework was added. A focused caller-widening regression failed before the fix;
all fourteen result-admission tests and both changed-file lint/format checks then
passed in the offline checker. Independent source review found no new issue.

Protected structure-reader diagnostics, 2026-10-19
------------------------------------------------
The private geometry wire now carries optional reader diagnostics on successful
records and expected input rejections. The receiver admits exactly text or null;
private content stays outside geometry/error repr and safe exception text. Caller
allocation checks still precede accepting a reply. Operational native exceptions
remain operational failures, including the MOL wrapper's inconclusive outcome.
Sources and owners: geometry_protocol.py, geometry_client.py, geometry_worker.py;
the prediction worker's existing send-inside-except pattern preserves the active
cause when failure framing or transport also fails. No second retention framework
was added; native formats remained disabled in that revision's wire dispatch.

The complete 2 MiB frame limit includes diagnostics and all selected records.
An oversized result returns no partial population. Its normal size rejection
includes an ordered private reader summary: first 8192 characters, with an explicit
batch truncation marker when evidence is omitted. This separate rejection budget
keeps even JSON-escaped Unicode well below the frame cap; ordinary successful
and expected-rejection diagnostics remain verbatim. Independent review caught the
earlier loss of reader reasons on this oversize path; the new regression failed
before correction. Unsendable failure/rejection frames retain their original
exception context, with rejection diagnostics attached as a protected note for
the host's existing capture owner. A broken successful send also adds the bounded
reader summary to its unchanged transport exception, without attempting another
frame. That is worker-channel evidence, not proof of
delivery through the unfinished public Upload/interpreter workflow.

Focused evidence: 23 geometry-wire tests and one molecular-reader launcher test
passed in the offline checker. Coverage includes real process/socket transport,
null/empty/Unicode/private text, malformed diagnostic types and wrong allocation,
exact frame boundary plus one byte, whole-selection rejection, bounded marked
summary, single-send transport failure and retained original failure context.
No full repository/model suite ran.
Changed-file lint/format and whitespace checks passed. Independent error/privacy
and ordinary code reviewers found no actionable issue in two unchanged final
passes; science/U/A review also confirmed the private-channel scope.

Supplied SDF record selection, 2026-10-19
--------------------------------------
The direct SDF reader now accepts all records or an ordered unique tuple of
positive existing record numbers. It preserves supplied atoms/H/order/coordinates
through the qualified V2000 MOL reader, including its explicit unit conversion.
Source correspondence uses original record numbers and one-based MOL atom rows;
source_sha256 names the complete original SDF bytes, including unselected records
and associated data. Records are not checked for molecular equivalence. No atoms
are generated, added or reordered; selected records follow the requested order
and are never combined into an inferred molecular ensemble.
Selected failure returns no partial tuple. Input rejections retain safe record
context and private native diagnostics; operational exceptions keep their original
identity/type/chain, with a record-context note.

The shared 1 MiB original-source bound, UTF-8 admission and 128-record cap precede
native parsing. Global record framing is checked; unselected structure blocks and
data items are not sent through a native reader. Selected data headers/blank
terminators are framed, while data values stay opaque and outside prediction.
Selected V3000 and non-3D records remain blocked by the MOL owner. Each record
requires a closing delimiter; unframed trailing structure/data is rejected.

Primary format reference and rationale are in sdf.py:
MDL CTFile Formats, October 2003, chapter 6, printed pp. 39-41, original-spec mirror
https://www.daylight.com/meetings/mug05/Kappler/ctfile.pdf#page=40
The helper inspected printed p. 40 to adjudicate two independent reviewers'
exact-delimiter proposal: the specification says a line beginning with four dollar
signs terminates a record. Prefix recognition is therefore retained; exact-line-only
recognition would change the cited grammar. A focused witness covers annotated
delimiters and leading-space data values, preserving selection order and digest.

Tests first: the maintained SDF lane failed on the absent module before reader
implementation. make test/integration/sdf-reader now passes 17 checks in the
admitted RDKit image, offline/nonroot/read-only with bounded scratch and no engine
socket. The launcher regression covers both MOL/SDF read-only source/fixture
grants. Existing independent expected.json and authored mixed-record, supplied
butane-conformer and invalid-suffix fixtures are consumed without regenerating
expected outputs. Reader checks cover different/repeated molecules, supplied H
and carbon-only records, units, source identity, ordered selection, invalid selected
suffix, unselected malformed/V3000 records, inclusive 1 MiB/128-record boundaries
and over-limit rejection. Successful geometry cases exercise real native parsing;
diagnostics and operational failures are injected to check their boundary handling,
not claimed as observed native failure outcomes. Boundary checks demonstrate reader
admission/work bounds, not scientific prediction capacity.

The named hierarchical lane uses the same admitted immutable geometry image as
MOL; a missing requested test module now fails instead of silently discovering
zero tests. Changed-file lint/format, shell syntax and whitespace checks passed.
Independent science/U/A and ordinary code/containment review found no remaining
actionable issue in repeated unchanged-behavior passes. README distinguishes direct
reader qualification from public submission. At that revision SDF/MOL dispatch
through the geometry wire remained unfinished, alongside authenticated Upload
acquisition, other native formats and SMILES conformer generation. Neither that
slice nor the diagnostic slice closed 003.

MOL/SDF through the private worker channel, 2026-10-19
----------------------------------------------------
This supersedes the disabled-MOL/SDF-dispatch residuals in the earlier reader and
diagnostic sections. The explicit format options now include mol and sdf. MOL
requires no record selection and returns record 1; SDF requires all or an ordered
unique tuple of positive record numbers. Only the existing qualified V2000 reader
is called; V3000 remains blocked. Other native formats and SMILES generation
remain unavailable. Native parsing stays in the worker, without controller reparsing.

Receiver admission now distinguishes native atom-row IDs from JSON atom indices
and text/XYZ line numbers. Native source positions must be exactly 1 through the
returned atom count, within each selected record; atom-map fields are not source
IDs. It checks selected source record numbers/order, reconstructs the whole-source
SHA and conversion provenance from caller bytes/options, and retains private
diagnostics through the already qualified wire. This does not independently prove
native parsing correspondence: the reader owns that scientific interpretation.
MOL/SDF source formats, limits and rationale remain at mol.py/sdf.py; unit factors
remain at coordinate_conversion, using its precise NIST/CODATA references.
For all-record requests, completeness is qualified at the reader, which expands
the actual source population before parsing/returning a batch. The receiver checks
contiguous returned IDs; explicit selections additionally have a caller-known
count/order. Review declined a worker-declared total (same authority, no independent
proof) and a second controller framer (duplicated source parsing). A consistently
wrong reader's source interpretation is not established by wire-shape checks.

Tests first: injected-reader protocol tests failed before dispatch and atom-ID
admission were added; the focused unit lane now passes 27 checks, without RDKit
or model dependencies. The new native launcher regression failed before its lane
was added, then passed. make test/integration/native-geometry-worker passes seven
real process/socket cases in the admitted RDKit image. Independent expected.json
values establish supplied atom/coordinate correspondence; cases cover MOL units,
SDF all/requested order, original source identity, invalid selected suffix,
unselected invalid records and V3000 rejection. Malformed V2000 coordinates also
exercise actual RDKit failure through MOL and a later SDF record: captured native
line context reaches WorkerReportedFailure.diagnostic, stays outside public error
text/repr and retains the SDF record note. The wrapper's inconclusive failure stays
operational rather than being relabeled an input rejection. This uses real native
output, not a mocked parse failure. The controller process stays free
of RDKit/Torch imports. The new lane shares the molecular-reader offline/read-only/
nonroot/resource-bounded grants and adds no engine socket, credentials or models.

The native socket tests spawn child processes inside one container. They do not
qualify a native worker running in its own container with host-owned retirement.
The existing separate-container success/stuck-reader retirement lane was rerun
successfully after adding mol.py/sdf.py to its source-receipt closure; it still
exercises XYZ in the lightweight checker image. Both observations are retained
as their respective evidence, without substituting one for the other. Authenticated
Upload acquisition, interpreter/binding integration, native container composition
and complete public submission remain open. This slice does not close 003.
Changed-file lint/format, shell syntax/whitespace and the focused shared-guard and
hierarchical-Make repo checks passed. No dependency acquisition, upstream/sibling
edit, full repository suite or model execution was needed.
Final source-matched host receipts are retained under .work/qualification/:
provider-geometry-nmrnet-worker-proof-tmPcsoH2 (XYZ success) and
provider-geometry-nmrnet-worker-proof-nbzAQRRh (stuck reader), with source hashes,
immutable image identity, observed worker posture and retirement/removal evidence.
Independent ordinary-code, scientific/provenance and operations/error reviewers
returned no actionable signal in two unchanged final passes. Accepted refinements
added a real native failure witness and clarified explicit units and historical
scope; no second source framer or host lifecycle framework was added.

Native reader containers and host retirement, 2026-10-19
-------------------------------------------------------
This supersedes the separate-native-container proof gap in the private-channel
section above. make test/integration/provider-native-geometry-worker now exercises
five fixed scenarios through the existing worker_qualification.sh/HostRetirement
composition. The host admits the immutable RDKit image with geometry_image.sh's
existing recorded-ID/committed-build-input checks. Only the reader uses that image
and its absolute environment interpreter. The controller stays in the recorded
checker image, receives source fixtures read-only, and passes their exact bytes
through IPC. Neither endpoint receives engine access, credentials or model files.

The host inspects both actual container image IDs. It checks the native reader's
read-only/network-none/nonprivileged/nonroot/cap-drop/no-new-privileges posture,
512 MiB memory with no added swap, 2 CPU and 64 PID limits; /tmp is a bounded noexec tmpfs.
The worker checks input/control/engine/model paths are absent and verifies RDKit was loaded
after real native work while Torch stayed absent. The controller verifies its
receipt is read-only and never imports RDKit/Torch. Source/image records, reader
code, admission helpers and selected fixtures are hashed before/after execution.

MOL and selected SDF success use the independent expected.json literal angstrom
coordinates, supplied atom-row IDs, original record order and whole-source digest.
No new unit-conversion accuracy, molecule-equivalence, H-completion or ensemble
claim is made. The source-rejection case selects all invalid_last.sdf records and
gets record 4 rejection with no returned prefix. The operational-failure case
reuses the exact deterministic malformed-coordinate construction documented in
tests/integration/rdkit_runtime/test_geometry_worker.py: a valid MOL followed by
a malformed V2000 record. Actual RDKit line context and SDF record 2 survive in
WorkerReportedFailure.diagnostic, outside public exception text/repr, and are
retained in the protected receipt. Unexpected native failures also save their
private cause before propagating; they cannot create a successful observation.

The stall case completes a real MOL read, verifies RDKit loaded, publishes the
allocation marker and deliberately waits while ignoring TERM. It demonstrates
host retirement of an admitted native worker after a controlled post-parse stall,
not a measured native-parser hang. Review caught a timing flaw in the first pass:
the short XYZ deadline plus a late marker wait could accept slow native startup.
The native case now uses its normal 5-second read budget and reads the exact marker
immediately on TimeoutError; missing/foreign markers reject qualification without
a post-timeout grace. The claim is marker presence at timeout handling, not a
timestamped observation before the deadline. Two focused regressions failed before
the correction and now cover absent, matching and foreign allocation markers.

All read outcomes retain the same finally-owned retirement request and channel
close. Host confirmation follows exact worker stop/removal and IPC release; no
new lifecycle framework or source parser was introduced. Evidence retains checker
and native worker image IDs separately, observed posture, source hashes and the
existing stop/removal receipts. Failed qualifications retain their private scratch
instead of inventing a success receipt. The Make regression proves the five fixed
scenario invocations only; the engine inspections and runtime grant/import checks
provide the actual container evidence, rather than a parallel fake profile model.

First live run passed all five cases. The corrected native timeout was rerun and
passed; both existing XYZ container cases also passed after the shared probe
refactor. The focused geometry unit lane passes 29 checks, including the new
marker regressions. This is fixed container-composition qualification, not a
production supervisor, authenticated Upload/interpreter submission or deployed
provider. Those integration steps, other formats and SMILES remain open; 003 is
not closed.

Final source-matched run passed all five corrected native scenarios. Private
receipts under .work/qualification/provider-geometry-nmrnet-worker-proof-:
9PbKEVc1 (MOL), JZ5OCXvy (SDF), Gxaq8TJJ (source rejection), aOfA7qxh
(native failure), PKJkbqwe (post-parse stall). Each retains source/image identity
and observed cleanup; native failure additionally retains reader-diagnostic.txt.
The Make-scenario regression and two relevant guard/hierarchical-target repo
checks passed; changed-file lint/format, shell syntax and whitespace checks passed.
Independent ordinary-code, science/provenance and operations/error audits returned
no actionable findings in two unchanged final passes after the timing correction.
No full suite, model run, dependency download, upstream/sibling edit or deployment
was performed.

Code clarity review, 2026-10-19
===============================

Reviewed implementation and callers, not only documentation. The scientific-code
slice (66777d8) renames validate_model to require_cpu_float32_model: it checks
device/dtype and counts parameters, without claiming prediction qualification.
Pasted XYZ now says "one XYZ frame", rather than asserting a conformer relationship
or directing callers to an unfinished Upload route. Worker comments describe
replacement inputs and token invalidation; ResultPlan.finish describes returning
validated bytes, leaving API publication to its caller.

The core slice (c1ecd12) distinguishes observation from repair and session retirement,
and a held terminal conflict from confirmed publication. Closed storage reports
that the instance cannot reopen; pending storage instead directs the caller to
settle its original I/O. The existing cancellation/settlement/close regression
checks both messages. No ownership, recovery or publication policy was changed.

Tool help explains absolute ppm label/prediction tolerances and the separate
relative prediction tolerance. Checker errors identify the changed declared
artifact or count missing/unexpected files without dumping arbitrary filenames.
Scientific-worker errors distinguish repository, submodule-index and image-ID
failures. Make help names the comparisons actually run, not a claim of complete
provider qualification. Acquisition/identity checks and numeric tolerances remain
unchanged; original scientific citations and historical evidence remain in place.

Focused evidence: 25 reader/model-check/worker-token/checker/label-limit tests and
nine installed-package adversarial storage tests passed in the cached offline
checker image identified in the fixture section below. The package was built and
installed with the existing locked offline dependencies. CLI --help was inspected;
bash syntax and git whitespace checks passed. No full repository or real-model
suite was run. These checks do not refresh earlier source-bound scientific
qualification receipts or qualify the planned native structure readers.

Source-aware and context-isolated wording reviews corrected two proposed promises:
not every publication failure leaves an operation available to settle, and invalid
download directories cannot be reused for acquisition. Individual U08/U16/U17/U23,
A03/A05 reviewers challenged effects, provenance, clarity, safe causes and machinery.
Retained directory membership and admitted package identity already constrain the
checker artifact name; no parallel filename validator or compatibility alias was
added. Remaining pre-existing lint/format findings are outside the edited logic:
seven lint findings in tests/test_prediction_release.py and formatting in
result.py, attempt_record.py and controller.py. Do not treat this review as a
passing full repository gate.

Structure-reading process boundary, 2026-10-19
============================================

Slice 2a now has a one-source geometry protocol/client/server for existing direct
JSON, contiguous coordinate tables and explicitly selected plain XYZ records.
It returns frozen PreparedGeometry objects to the existing prediction admission
path. No native reader, SMILES generation or public offering is enabled here.
The separate-container host retirement composition has also passed the bounded
success and stuck-reader probes described below.

The existing prediction frame I/O and asynchronous exchange/close owner are shared
with geometry reading, preserving whole-exchange deadlines, allocation identity,
single prediction execution and retained close observation. Geometry consumes one
source per allocation. Local close/cancellation still does not prove stopped work.
The source limit is 1 MiB; source/selected XYZ records are capped at 128, atom count
at 128, and frames at 2 MiB. These are internal bounds, not measured batch capacity.
Full selection precedes serialization; an oversized result is rejected completely.
Expected source errors remain distinct from private operational failure causes.

Source identity and conversion provenance derive from the caller's exact bytes and
options. Only executable request bytes and source locations return over the wire;
the controller checks their shape/order and the existing coordinate admission.
The reader owns scientific parsing/correspondence and needs format fixtures for
qualification. Independently re-parsing native input in the controller would
duplicate that authority and defeat the intended process boundary. No conversion
table was duplicated: coordinate_conversion owns the existing cited NIST/CODATA
factors. Review also moved line counting outside per-atom reply validation and
added an early table atom limit before parsing/serializing excess rows.

Tests-first evidence: the new contained test module initially failed because
geometry_client was absent. Thirteen new geometry process/wire tests, fifteen
shared prediction transport cases, eight input cases, the new launcher selector
and two guard/Make conventions now pass: 39 focused tests in the cached checker
image named below. Changed-file Ruff lint passes. The maintained focused target is
make test/unit/provider-geometry-worker; its printed grant is tested. Actual tests
used the explicit cached alternate image because the normal pinned Python base is
still absent. This is not a passing normal-image lane or RDKit/runtime qualification.
Independent code/transport and U05/U08/U14/U23/A03/A05/A08 reviews found no remaining
actionable issues after the bounded-work correction. Scientific references stay
beside coordinate_conversion and the XYZ reader; framing/lifecycle precedents
remain beside worker_protocol and retirement.py. No upstream/sibling edits.

Host-boundary evidence, 2026-10-19
---------------------------------
make test/integration/provider-geometry-worker owns geometry-success and
geometry-timeout through the existing tools/worker_qualification.sh. Both scenario
commands passed. They use the recorded immutable checker image, with no build,
download, network, native package installation, model access or engine socket
inside either container. The worker's inspected profile is read-only root, network
none, unprivileged UID/GID, cap-drop ALL, no-new-privileges, 1 CPU, 128 MiB/no swap,
32 PIDs. Launch code declares bounded private scratch and the input/control mounts;
the worker checks for forbidden control, engine and model paths. The controller
proves that the host receipt mount rejects writes. The posture receipt does not
inventory the complete engine-observed mount set.

Success checks selected XYZ records 3,1 against the authored fixture's atoms,
coordinates and original line positions. Timeout injects a synchronous blocking
read that records entry and ignores TERM; client timeout alone supplies no stopped-
work evidence. The existing host owner stops, inspects and removes the exact CID,
releases the IPC socket/grant, then publishes the receipt. The controller accepts
that receipt before reporting success. Both worker and controller are retired.
This is evidence for retirement of a stuck call, not a claim that a native parser
was exercised or that every failure/recovery branch is qualified.

Successful raw scratch/diagnostics are removed. Two compact receipt directories
(5,658 bytes total at this run) remain under .work/qualification/:
  provider-geometry-nmrnet-worker-proof-04JoA9uq (success)
  provider-geometry-nmrnet-worker-proof-tvW4MqeY (timeout)
They retain summary, image ID, selected source hashes, worker posture, worker
stop/removal and controller stop observations. Both source manifests have SHA-256
f04cb32787ac4038b96bb8922d8f7553d4a16a1599493bc77ad8f3e80d0d3f4f.
Scientific input SHA-256 is
8434b7c79dab72ce2b4c1a9bea5ec491af13896bdc31eb7277aa6b04e160cefb;
each selected geometry's executable request SHA-256 is
78efddefa44ba73505118dbbd8dbc638896762f1beeb542083a79ca48ca1e522.
The timeout returns no geometry. Source manifests match before and after both
containers stop. These are trusted live-source bind probes, not immutable source-
build proof. The existing original fixture/source references remain authoritative.
Existing silent-default checks also pass for the changed Python files. Scenario
deadlines and empty timeout output are explicit states, without fallback values
or scanner waivers. Both container scenarios were rerun on those final bytes;
superseded successful receipts were removed, preserving these current summaries.

Independent host-code and U07/U14/U05/U23/A03/A05 audits found no remaining
actionable issue. Source review added the executed package marker to the manifest;
the live run resolved the proposed mount-parent concern without granting another
directory. Native RDKit dependency/import/reader qualification, Upload/interpreter
wiring and the complete provider remain open. The next sub-slice builds and tests
the isolated native runtime before enabling MOL/SDF or SMILES operations.

Implementation progress, 2026-10-18
===================================

Coordinator implemented the independent input foundation while the shared-provider
integration seam is investigated. No provider offering, worker or upload route is
enabled. Stage 1 and full 2a are not complete.

The first foundation (d386d50) in nmrnet_provider/input_geometry.py reuses parse_request for structural admission,
keeps direct angstrom JSON bytes, and converts one contiguous element/X/Y/Z table
from explicit angstrom/nm to angstrom. Immutable bytes/tuples retain source digest,
source positions and their kind (JSON atom index versus table line number). It
does not admit dictionary vocabulary, load models, infer units, generate geometry
or, at that commit, provide bohr/XYZ/file readers. NIST SP811 Appendix B.8 is
cited beside the exact nm conversion with its rationale. Provider modules enter
existing guard/lint/cache/semantic inventories and read-only checker mounts.

Tests-first evidence: eight provider tests failed on absent preparation functions,
then passed through make test/unit/provider in the pinned offline Python image.
Focused review also ran 16 guard/inventory convention tests, 16 launcher tests and
32 existing prediction-input tests successfully. The latter caught no regression
from moving model.py's shared guard before standard-library imports; the existing
guard check had exposed that preexisting ordering violation. A focused lint probe
also exposed 14 preexisting import-policy findings in model.py/predict.py. Pure
shared imports moved to module scope; necessary lazy scientific imports retain
their admission ordering with narrow explained exceptions. Changed files pass
pinned Ruff lint/format. Two real-Make target ownership tests also pass. No full repository or real-model suite
was run for this foundation. The test runner's old two-mount assertion was stale;
it now checks all four exact authored roots and the focused provider selector.

Independent input/science and inventory/containment reviews corrected H/C unit
guidance, row-location naming, independent package-mount fixtures and optional
source admission before engine inspection. A proposed second validation layer on
the internal prepared dataclass was declined: current builders already admit exact
bytes and construct immutable tuples; this record is not a wire admission token.

Second internal reader slice, 2026-10-18: plain XYZ now accepts explicitly selected
records (or all), preserving their requested order, original record numbers and
atom line positions. Different molecules are accepted; there is no same-molecule
check. Pasted XYZ requires one frame. Selected malformed records reject the entire
selection. Unselected records require readable framing, not valid coordinates.
The reader caps original bytes at 1 MiB and source frames at 128; the latter is an
internal work bound, not a measured or advertised service batch capacity. Extended
XYZ metadata is rejected, not interpreted as plain coordinates. No bonds inferred.

Bohr conversion uses the CODATA 2022 central value 0.529177210544 angstrom/bohr,
retaining factor, reference and source unit with each prepared geometry. It is not
an exact physical constant: standard uncertainty is 8.2e-11 angstrom/bohr. Sources
and rationale are beside prepare_rows and the XYZ reader: CODATA 2022 table XXXII,
https://physics.nist.gov/cuu/pdf/JPCRD2022CODATA.pdf ; plain XYZ count/comment/rows,
https://openbabel.org/docs/FileFormats/XYZ_cartesian_coordinates_format.html .
Plain XYZ needs no graph interpretation or RDKit dependency; a bounded strict
reader avoids changing the qualified inference environment for this route.

Focused evidence: 19 provider tests pass in the offline container, including
ordered selections, record identity, malformed selected/unselected coordinates,
nonfinite/overflow rejection, record limits, private-source-safe errors and bohr
conversion provenance. The changed launcher-selector regression and changed-file
Ruff lint pass. This does not qualify a worker, native readers, Upload access,
model execution or the end-to-end provider. Those remain required by this plan.
Review removed a test that would have implied silently accepting contradictory
unit evidence. XYZ comments are opaque to this deterministic reader; resolving
such evidence belongs to the interpreter before it selects an explicit unit.
Independent preparation/science and inventory/containment reviews found no further
actionable issues after these corrections. This is reader-slice review only.

Integration finding: M's pinned ProviderHttpClient has no Job Upload-list or
read-capability operations; AnalysisRequest carries only VerifiedJobInput text.
Do not treat an Upload ID in that text as authority. S already demonstrates the
needed server-listed-membership -> capability -> bounded verified-download flow.
Exact sources using 014's pins: M:magnet_provider/{analysis_contract,job_input,
provider_http,provider_protocol}.py; S:src/secs_inference/provider/{job_api,
job_upload,analysis_run,upload_download,source_access}.py. API authority is
I:nmr_api/provider/routes.py, operations/provider_job_upload_set_read_service.py
and operations/provider_job_upload_read_capability.py. Rationale: reuse must
include actual authenticated Upload authority, not just the Job/Attempt lifecycle.
The maintainer requested continued orthogonal work and a plain-English discussion
when this dependency is required; no sibling edit is authorized or performed.

Historical shared-Magnet proposal (not implemented; superseded by 017):
- Extend M:magnet_provider/provider_http.py through its existing signing/transport
  owner with GET /provider/v1/jobs/{job_ref}/uploads and bodyless
  POST /provider/v1/jobs/{job_ref}/uploads/{upload_ref}/read-capability.
  The API already implements them; no API-server change is proposed.
- Supply the NMRNet analysis processor a narrow Job-bound attachment-access port
  connected to that authenticated client. Client methods alone are insufficient:
  M:controller.py currently creates AnalysisRequest without attachment access,
  and analysis_execution.py passes only that request plus progress. Keep this an
  additive composition seam rather than mandatory new lifecycle-protocol methods.
- The first operation lists this Job's attachments; the second asks the API for
  temporary permission to download a selected attachment. The API rechecks current
  membership and provider access. The interpreter cannot grant itself access by
  inventing an Upload reference.
- Keep bounded store transfer, exact byte/hash verification, source selection and
  geometry readers local to nmrnet_provider. Do not duplicate signing or turn the
  shared core into a chemistry/file-format layer.
- Focused core tests must prove exact signed method/path, empty query/body, bounded
  responses and honest 404/409/unavailable outcomes; local tests must reject a
  reference outside the Job, mismatched capability metadata, unauthorized store
  origins, changed/truncated/oversized bytes and redirects before parsing.
Precise API owners at I's 014 pin: nmr_api/provider/routes.py (Upload GET cap 2 MiB;
capability POST cap 65,536 bytes), provider/job_upload_set_read.py (up to 64 entries),
operations/provider_job_upload_set_read_service.py (authorized membership snapshot),
operations/provider_job_upload_read_capability.py (locked membership/grant checks),
wire/upload_read_capability_response.py (short-lived bearer, URL, size, digest).
Rationale for the shared addition: the processor currently receives only verified
request text. Attachment access cannot be truthfully implemented as a thin local
binding without connecting it to the already authenticated transport. User approval
is required before changing that sibling, under the standing sibling-edit boundary.

Preparation dependencies need a separate reviewed lock/image: existing package
and wheelhouse tools initially selected only inference inputs. Do not modify the
qualified inference closure merely to install RDKit. Explicit default-route
interface selection was authorized for acquisition; host-specific values stay
outside public notes. No acquisition or external model calls ran in the initial
input-foundation slice; the later preparation acquisition is recorded below.

Preparation lock slice, 2026-10-18: packages/preparation/lock/{stage,apply} now
selects a fixed preparation profile through the existing package owner. It
captures only preparation.in, stages preparation.lock plus
preparation-advisories.json, and applies that pair through the existing offline
hash checks and rollback. Existing inference commands keep their three inputs,
Torch normalization and output pair. Exact input filenames/hashes and fixed
output names bind each profile; an extra profile marker would duplicate them.
requirements/preparation.md records the RDKit candidate, precise advisory sources
and unresolved V3000 native-parser exposure. No lock/image/wheelhouse qualification
or public native-reader admission follows from this infrastructure change.

Tests-first: the new lock worker tests failed on absent profile arguments, then
passed with all 24 focused lock tests. Copied-launcher tests prove preparation
captures exact bytes/modes despite later live mutation and rejects changed intent
on apply, then applies its exact pair without changing inference outputs. Existing
inference capture/apply tests also pass. Real-Make tests check literal preparation
targets; operator tests reject ambient/hostile STAGE and missing/linked inputs,
and inspect the preparation-only mounts. Two targeted lifecycle tests preserve
retirement/cleanup behavior after the shared launcher's command text changed.
An initially failing fixture correctly encountered dirty execution on its next
invocation; restoring the deliberately mutated worker lets the intended later
dependency-drift check run. No production admission rule was relaxed.
Independent boundary and convention reviews ended without actionable findings.
Changed-file Ruff and Python default-input scans pass; the shell-default repository
check passes. A broader Python-default probe also reported 14 existing findings in
unchanged prediction tests and baseline_prepare.py; those are not fixed or claimed
green by this slice. Only focused tests were run; no package was installed.

Preparation acquisition slice, 2026-10-18: the real interface-bound resolver staged
RDKit 2026.9.1, NumPy 2.5.4 and Pillow 13.0.0. The reviewed pair was applied offline;
its exact receipt and primary advisory rationale are requirements/preparation.lock,
preparation-advisories.json and preparation.md. PyPI empty advisory arrays are not
a native-code safety claim. No package installation has run.

The existing wheelhouse owner now admits a preparation profile containing only
locked wheels, with source_declaration_sha256 explicitly null. It rejects Uni-Core
archives in that profile and does not contact the CPU Torch wheel index. Static
Make targets select it; the CLI rejects missing inference source and supplied
preparation source before work. Acquisition can write only .work/preparation and
publishes its wheelhouse beneath it; verification is offline and read-only.
Inference's existing wheelhouse path, dependency inputs and receipt stay the same.
The shared tool is an inference build input, so its source closure changes for
future builds; historical numerical qualification is not relabelled as proof of
the new image. The preparation image and runtime tests are still required.

Tests-first evidence: the new wheel-only test failed before implementation, then
passed with all 18 existing/new wheelhouse cases; the additional profile/source
CLI test also passes. Five focused launcher/Make tests verify separate writable
authority, exact preparation inputs, no source mount, preserved inference grants,
and literal targets. Review requested an explicit profile argv witness and CLI
mismatch witnesses; these were added and pass. Changed-file Ruff checks pass.
The worker requires an explicit profile; both existing inference call sites now
pass inference literally. The actual captured inference-verifier regression and
private-client argv regression pass. Final independent boundary and inventory
reviews found no further actionable issue.

Acquisition completion, 2026-10-18: all three preparation wheels downloaded through
the explicit interface-bound lane; packages/preparation/wheelhouse/check then
independently passed offline. About 54 MiB is retained at
.work/preparation/wheelhouse. Exact wheel/receipt hashes are documented in
requirements/preparation.md; retain these reusable inputs for offline preparation
development. No install, native parser execution, model run or deployment occurred.
The focused inference-Dockerfile verification-before-install check also passed.

Fixtures for structure readers and conformer generation, 2026-10-19
-------------------------------------------------------------------
The next requested step prepares fixtures for 2a-2f, not the native worker itself.
tests/fixtures/preparation/ contains 21 original authored structure files, literal
expected geometries/source IDs, seven valid-intent and nine rejected SMILES
declarations, three injected embedding outcomes, and eight batch/limit scenarios.
The adjacent README records precise consulted format/unit references, authorship,
selection semantics and qualification boundaries. Existing archive/NIST
chloromethane fixtures and production scientific code remain unchanged.

The cross-format geometry deliberately orders H,Cl,C,H,H. Candidate files cover
XYZ, V2000/V3000 MOL, SDF, PDB and MOL2; repeated/different molecules, retained H,
missing H, distinct supplied carbon-chain conformers, planar 3D versus declared 2D,
PDB models/alternate locations, explicit
nm/bohr conversion, selected/unselected malformed suffixes and unsupported dialects.
No generated-coordinate golden or native shortfall was fabricated. Exact generated
observations still require the pinned admitted RDKit worker; V3000's unresolved
native-parser evidence remains in requirements/preparation.md.

Nine new tests exercise actual fixture files through the existing pure XYZ owner;
the earlier eleven XYZ cases are retained. The normal make test/unit/provider
invocation was blocked before Python by a missing pinned base image, not a red
behavior test. The repository's already cached checker image instead ran these
20 focused tests successfully (Python 3.12.12, offline/read-only/nonroot/cap-drop/
no-new-privileges, bounded resources, only tools/tests/inference/provider mounts).
Its immutable image ID is
sha256:9164d380c00bf0e013d44357cafb03d4b1f64570a93105f74ac4b85b66cf1b49.
This is explicit alternate-container pure-reader evidence, not a passing standard
lane, RDKit/native-reader/embedding proof, Upload integration or batch publication.
Source review corrected PDB connections to sorted reciprocal CONECT entries,
fixed the SDfile chapter citation, and put independent expectations first in the
new test assertions. The 20 XYZ tests passed after those corrections and addition
of the distinct supplied conformer pair. Two
repository-wide checks in
repository_checks/quality/test_assert_equal_argument_order_posture.py still fail
in unchanged files; their
detectors reported no finding in the new fixture test. This slice does not claim
the broader repository checks pass. Focused contained Ruff passed for the new test.
No dependency acquisition, package installation, native execution, model run,
upstream or sibling edits were needed.

Individual U01-U26 and A01-A10 reviewers inspected this fixture-only delta against
their recorded concerns. Ordinary format/science/test reviews corrected the PDB
connectivity, reference and assertion-order issues; final rechecks found no
residual actionable issue. The distinct supplied-conformer addition was separately
reviewed for scientific meaning, literal correspondence, source mapping and
population counts. This review closes fixture preparation only, not 2a-2f or 003.

Purpose and completion
======================

Call this stage "Read supplied 3D structures or generate conformers
from SMILES." Read one pasted geometry or selected records from an uploaded
structure file, converting established units to angstroms. Generate estimated
coordinates with RDKit from a SMILES molecular description. Keep each supplied
atom linked to its original source record, and retain the generated coordinates
and settings for SMILES. Both paths use the existing NMRNet input checks before
prediction. The umbrella word
"preparation" alone does not tell readers which operation is involved.
Source review and context-isolated reader teach-backs distinguished these two
operations; a misleading suggestion of record selection within pasted input was
corrected. This is a terminology change, not new runtime qualification.

A commissioner selects the NMRNet offering and submits an analysis request. The
provider interprets it, reads supplied geometries or generates conformers from
SMILES, checks NMRNet's input requirements, and predicts atom-associated H/C shifts
for publication through the API. Developers, operators,
commissioners and receivers must receive useful safe causes when this fails.

003 closes when the agreed user workflow and failure/restart recovery work through
a real contained local API deployment and its actual GUI surfaces, with portable
evidence and operating instructions. Startup, scripted peers or existing scientific
tests alone cannot close it. Production activation is separate.

Starting science is closed 002 at revision
7e320505fdbee228e312778032b144cc14ef38b9. Its packet is
artifacts/prediction-cpu-float32.json, SHA-256
3054ace5fb17b824e114c65c25e24389eca7551e38a0aece7f347f5b98f5fa75.
It qualifies CPU float32, the selected fold-0 pair, four fixtures, 137 outputs,
64 historical positions and real 128-atom capacity. It does not establish general
chemical accuracy, ensemble accuracy, inferred bonds or archive-wide unit provenance.

Why the plan changed and sources
===============================

The earlier coordinate-JSON-only plan wrongly removed interpretation. Its U/A
reviews checked constraints inside that scope without adequately challenging the
product workflow. Interpretation of supplied input and generation of missing
geometry are different responsibilities. An interpreter belongs in this offering;
geometry generation needs its own scientific qualification if the product needs it.

notes/014_provider_workflow_comparison_20261018.txt records the actual sibling-code
comparison, pinned revisions, source paths/sections, rationale and rejected findings.
Its W01-W12 findings govern this revision. Aliases M/P/S/I/G below refer to that
source register. Earlier plan/review records remain historical in commits
5e836c3247d1d7705d2b070c19cdada7530be706 and
bfaa5a85fa73fe72e4dc836212ee3942483001b5; they do not certify this revised workflow.

Use these as behavioral precedents for the local package in 017; do not import
the sibling package as the active runtime owner:
- M:pyproject.toml, magnet_provider/analysis_contract.py and
  analysis_implementation.py: packaged core owns lifecycle; binding owns analysis.
- M:magnet_provider/job_input.py and runner_session.py: verified source identity,
  bounded exchange and determinate versus unobserved outcomes.
- M:G01 processor/binding and P:attempt_lifecycle.py/input_interpreter.py, at the
  full paths in 014 W01-W03: interpreted and structured routes converge at admission.
- S:src/secs_inference/provider/{analysis_run,execution,diagnostics}.py and
  M:magnet_provider/{journal_inspect,journal_archive}.py: distinct scientific,
  lifecycle, diagnostics and held-work recovery owners.
- I:nmr_api/public/job_create_request.py, job_specification.py,
  provider/execution_attempt_outcome.py and provider/http_contract.py: exact source
  text, the 65,536 UTF-8 byte specification bound, terminal bytes and server expiry.
- G:app/src/features/workspace/ColumnExecutionAttempt.tsx,
  result-presentation/ResultPresentation.tsx and generic-result-preview.ts:
  actual status/failure and JSON/text preview/download consumers. Offering text
  in ProgressiveText.tsx does not promise clickable Markdown.

Keep precise references and non-obvious adaptation rationale at the owning code
or declaration. Full history belongs in notes/evidence, not repeated comments.

Commissioner-to-receiver workflow
=================================

1. Publish a truthful offering and let an authorized project select it.
   Choose an existing active analysis kind when its semantics fit; a different
   implementation does not automatically need a new kind. Freeze implementation,
   runner and result identities. Use a dedicated provider identity or publish its
   complete offering set: hello replaces that provider's snapshot (014 W05).

2. Admit the authenticated Job and interpret the commissioner's request.
   Preserve exact original text and identity. Direct structured coordinate JSON
   may bypass language interpretation through a declared deterministic route.
   Recognizable malformed structured input must not fall through to prose.

   Three routes are required: SMILES plus requested conformer count N; plain-text
   coordinates for one conformer; attached Uploads plus interpreter instructions.
   Uploaded records need not be checked for molecular equivalence. The detailed
   preparation contract below governs these routes. Demonstrate all three, with
   representative requests, scientific inputs and rejection guidance.

3. Produce a bounded collection of source-backed geometries through deterministic
   preparation, then one scientific request per geometry.
   For supplied geometry, extract/select explicit atoms, order, coordinates and
   unit. Prefer selecting an exact representation for parsing over language-model
   transcription of numbers. Prove correspondence to the source, not just schema
   validity. Missing or ambiguous data must produce useful guidance; the language
   model must not invent coordinates, units, atoms or chemical facts.

   SMILES preparation is required and separately qualified. Record conformer count,
   seed, hydrogen policy, source-to-model atom map and actual generated geometry.
   Do not describe it as supplied or experimental geometry. Names/resolvers and
   force-field optimization are outside this slice; no inferred extra services.

4. Execute the admitted coordinate bytes through unchanged predict_request and
   SelectedReleaseModels. Original Job identity and executed-input identity are
   distinct. Direct coordinate JSON retains its bytes; extracted/prepared input
   has a separately identified output, passed unchanged after admission.

   Preserve 002's 1-128 atoms, finite float32 coordinates, dictionary vocabulary,
   duplicate/extra-field rejection, paired artifacts and verified-byte decoding.
   Require exact angstrom even for no-H/C input (002 checks present heads only).
   Conversion to angstroms happens explicitly before admission, with source-unit
   evidence and recorded factor. No hidden scientific repair. Keep original indices; skip
   absent heads; no-H/C input retains explicitly described successful empty output.
   H then C run sequentially and release each head.

5. Publish a validated all-or-nothing result through the existing API owner.
   Preserve unit=ppm and atom_index/element/shift_ppm in each geometry's order. Check full
   eligible coverage, index/element agreement and finite output; no partial H
   success after C failure. Link Job and executed-input identities, atom convention,
   fixed model/runtime and preparation provenance once. Retain safe interpreter
   model/prompt/config identity with the outcome, without secrets or raw prose.
   Freeze envelope/size against API and actual GUI preview/download: recipients
   must see correspondence, units, provenance and limits. No new renderer is needed.
   Return a separate identified prediction per geometry, never an implicit average.
   Predictions are not measurements, simulated spectra or confidence estimates.

Input preparation contract and interpreter loop
===============================================

Evidence and ownership
----------------------
015 records precise RDKit references and M/P/S source pins with rationale. SECS's
InterpretationSession owns inspection, selection and same-conversation correction;
Magnet's InterpretationCapability/interpret and NMRPeak's runner admission provide
typed construction and deterministic rejection feedback. Reuse compatible owners;
do not transplant SECS spectrum/formula rules or build a universal tool framework.
Reader API availability is source evidence, not accepted-format qualification.

Representative requests for the guide and end-to-end fixtures:
- "Predict H/C shifts for SMILES CCl; generate 3 conformers."
- "Coordinates in angstroms, columns element x y z:" followed by the retained
  CH3Cl fixture's actual coordinate table (reuse it, do not invent reference data).
- "Use all records in the attached conformers.sdf; report each separately."
- "Use frame 2 of the attached XYZ; its coordinates are in nm."
The final guide includes complete rights-cleared runnable inputs, actual outputs
and visible correction examples. No implicit default N or selection on ambiguity.

Keep four responsibilities explicit: source access owns authenticated bounded bytes;
format readers/generation own preparation; admission owns executable geometry;
the existing inference callable owns shifts. The interpreter chooses from declared
operations and sees bounded facts/errors. It cannot supply executable code, host
paths, arbitrary URLs, parsers or invented coordinates for uploaded structures.

The shared prepared value is a nonempty ordered collection of geometries. Each
entry has a stable geometry ID, ordered element symbols, coordinates in angstroms,
source identity (Job span or Upload digest and record/frame), source atom identities,
and preparation provenance. Optional bonds support diagnostics only. Do not require
a shared atom array, shared graph, cross-record alignment or molecular-equivalence
test. Each entry must satisfy 002 independently. Use named immutable records at
module boundaries; do not add a separate schema registry or proof-token hierarchy.
Freeze nested values or exact serialized bytes too; a frozen record around mutable
coordinate lists is insufficient. Caller mutation must not change admitted science.

The preparation owner serializes one exact request per geometry for existing
parse_request and dictionary admission; the provider adds the explicit angstrom
requirement even for empty H/C output. Preserve exact source and executed identities
separately. Avoid a second implementation of 002 validation in tools or schemas.
Exception to serialization: the direct coordinate-JSON shortcut retains original
request bytes unchanged and wraps them as one prepared entry. Both cases then use
the same admission and execution path, not separate scientific implementations.
That shortcut requires coordinate_unit exactly "angstrom". Other units receive
explicit correction guidance; conversion belongs to the declared preparation routes,
which create distinct executed bytes and identities, never mutate the shortcut.

Routes and supported formats
----------------------------
SMILES + N: require a source-backed SMILES and positive integer N within configured
limits. Parse in contained RDKit, add explicit H before embedding, then generate
N conformers with a fixed recorded ETKDG configuration and seed. Freeze the actual
RDKit version/algorithm parameters during qualification, not an ambient default.
Set SmilesParserParams.removeHs=False before parsing: the pinned default removes
H and would lose explicit source-H identities before AddHs. Record the original
atom-index/element inventory, then call AddHs with explicitOnly=False and
addCoords=False before embedding. Original atoms remain the leading index range;
record each newly added H's parent from its bond, without inventing source IDs or
assuming arbitrary atom properties survive. Existing explicit H must not be
duplicated. Mixed explicit/implicit H must preserve the source H and add only the
missing H; genuinely H-free molecular graphs must add none. Qualify these cases
through the actual producer, not a standalone RDKit demonstration. Preserve the
settings, mapping and generated geometry in the result provenance.
Pinned primary references, checked 2026-10-19, and rationale:
https://github.com/rdkit/rdkit/blob/Release_2026_09_1/Code/GraphMol/SmilesParse/SmilesParse.h#L86-L94
  removeHs defaults true; preserving explicit source H requires false.
https://rdkit.org/docs/source/rdkit.Chem.rdmolops.html#rdkit.Chem.rdmolops.AddHs
  AddHs creates a new molecule; explicitOnly/addCoords govern H addition/coordinates.
https://github.com/rdkit/rdkit/blob/Release_2026_09_1/Code/GraphMol/AddHs.cpp#L526-L551
https://github.com/rdkit/rdkit/blob/Release_2026_09_1/Code/GraphMol/AddHs.cpp#L562-L596
  Original atom count is frozen before iteration; new H append and bond to their
  original parent. Mapping must be explicitly retained and tested by the producer.
No additional UFF/MMFF post-embedding optimization or energy/population weighting
in this slice; ETKDG itself includes distance-geometry optimization. Record
generated atom order and which H were added. Unspecified stereochemistry is not
resolved as an asserted experimental fact: disclose RDKit's generated choice and
preserve input stereochemical specification. N requests successful conformers:
if fewer are generated, return a concrete shortfall to the interpreter; never
silently reduce N or repeatedly reseed until success. A changed N requires source
authorization. Bound embedding attempts and CPU time; requested count is not a
guarantee of distinct conformers, and the guide must say so.

Plain text: accept an element/X/Y/Z table or one XYZ block with explicit units or
an explicitly documented input convention. Interpreter supplies source_text,
format and unit; deterministic code bounds and parses received text. Provenance
must say interpreter-supplied, not exact extraction from the Job. Require exactly
one geometry. Ambiguous columns,
unknown units or multiple geometries return actionable correction/request guidance.
The existing declared coordinate-JSON route remains a one-geometry shortcut with
the same admission; malformed declared JSON cannot fall through to interpretation.

Uploads: authenticated source references select exact immutable bytes, not host
paths. Instructions may select records or all records. Ambiguous selection requests
guidance rather than silently taking the first. Preserve original record/frame IDs,
including gaps after explicit selection. No molecular-equivalence check. Parse
every selected record before inference; a failed selected record fails preparation
with its identity and reason, never silently disappears from a successful batch.
Source access rejects Upload IDs outside this Job's authenticated grants regardless
of interpreter arguments. Bind inspected/selected record identities to the admitted
Upload digest; later fetching must not silently substitute changed source bytes.

Target acceptance catalogue (each row needs contained fixtures before advertising):
The offering advertises only the qualified allowlist and supported variants below,
never arbitrary structure formats by extension. All listed rows are 003 targets.
- XYZ: one block or a concatenated frame stream. Own strict frame splitting/counts;
  RDKit's single-block reader alone does not establish multi-frame support.
- MOL and SDF: single MOL or SDF record stream, V2000/V3000 variants qualified
  separately. Preserve supplied H and atom order; reject missing usable coordinates.
- PDB: explicit MODEL selection or all models; preserve serial/record mapping.
  Never silently merge alternate locations. Require an explicit supported alternate-
  location choice when present; reject unsupported ambiguity with precise guidance.
  Qualify element extraction and missing-H behavior rather than guessing from names.
- MOL2: documented concrete SYBYL atom types, two explicit sulfur aliases and the
  declared bare-element extension; coordinate-only projection, no custom type sets
  or graph/charge/attribute interpretation. Preserve the limitations in the guide.
  Split multiple molecule records explicitly and qualify each selected record.
Do not promise generic archives, trajectories or every dialect by file extension.
Unrecognized formats report supported alternatives. Do not add an Open Babel or
other fallback dependency without a concrete unsupported-format requirement.

For uploaded/pasted geometries preserve supplied atoms and coordinates: disable
implicit H removal, reordering and coordinate generation. A missing-H or 2D drawing
does not authorize inventing geometry. Explain which H predictions cannot be made;
if generation is wanted, require the explicit SMILES generation route. Planarity
alone is not evidence of a 2D drawing. Reader sanitization/bond perception must not
silently change the scientific input; qualify actual reader settings and mapping.
Supplied geometry is predicted as supplied; neither its coordinates nor predicted
shifts independently verify stereochemical identity/configuration. State this in
the guide and result limits, alongside generated-geometry uncertainty.

Units and plausibility
-----------------------
Normalize using a small declared unit vocabulary (angstrom, nm, bohr), with aliases
handled explicitly. Source declarations or documented format conventions establish
units; contradictory evidence returns feedback. Record original unit, evidence,
conversion constant/reference and factor. Obtain precise unit references before
implementing constants. Apply conversion once from original coordinates; validate
finite float32 values after conversion. Never rescale an already converted candidate.

Bond-length plausibility is diagnostic, not proof of units or correct chemistry.
Use supplied bonds where available, marking any inferred bonds separately; no graph
is required for coordinate-only input. Report implicated record/atom pair, observed
distance and rule/reference. Do not silently optimize, change atoms or infer a unit
from the best-fitting length. Qualify a small documented set of diagnostic rules;
unknown bond types remain unchecked, not invalid. Existing CH3Cl/CH2Cl2 NIST tests
are regression evidence, not universal bond-length acceptance thresholds. Warnings
accompany admitted results unless an independently justified structural rule fails.

Conversation and effects
------------------------
Expose a small set of typed operations: inspect a source; prepare supplied geometry
with format/selection/units; generate from SMILES + N; report a source problem.
Conversion is a preparation option, not an arbitrary scale-factor tool. Successful
preparation terminally selects the internally retained candidate in that model
turn. No model-facing submit, opaque token echo or stale-reference state exists.
The actual PreparedAnalysis handle remains internal to the Attempt lifecycle.

State flow: authenticated source -> inspect/select -> deterministic preparation ->
admission -> retained execution identity -> sequential inference -> terminal result.
An expected parse/admission rejection returns structured location/cause/correction
feedback to the same conversation. The model may change source selection or options
only within the commissioner's instructions. Repeated failures consume the same
turn/time/work budget. No retry resets the budget or silently drops records.
Do not rerun successful embedding merely to confirm input selection.

Budget exhaustion reports the last useful failure and what remains unresolved.
Missing source data cannot be repaired by inventing it. Endpoint, storage, parser
crash, resource exhaustion and inference failures retain operational causes; only
expected input failures invite conversational correction. Errors, not secrets,
reach the appropriate API/GUI/operator surfaces. Do not claim model-authored source
problems are independently verified. Protect against instructions embedded in files.

Bound source bytes, selected and discovered records, atoms, generated conformers,
embedding attempts, parser work, model turns, prepared output and total wall time.
Publish concrete limits from measured fixtures before offering admission. Reject
over-limit work before expensive effects where possible; streaming consumption must
also enforce limits. Preparation is a contained worker with no external egress and
no engine socket. Host orchestration must terminate and confirm retirement of stuck
reader/embedding work, as for inference; cancelling a Python await is insufficient.
One active Attempt owns preparation and inference; no implicit parallel worker pool.
Apply the inference privilege profile to preparation: nonroot, read-only root and
exact input mounts, cap-drop ALL/no-new-privileges, no credentials/network/engine
socket, bounded private scratch and explicit measured CPU/memory/PID/no-swap limits.
Its host-owned retirement seam exists before runtime reader integration.
Qualify the installed worker's actual RDKit/native dependency closure and import
origins with no ambient workspace/system fallback. A changed reference version
blocks qualification until its version-matched fixtures are deliberately reviewed.

Batch results, reproducibility and recovery
------------------------------------------
Admit the complete selected batch before loading checkpoints/scalers; dictionary
admission may read the verified dictionary. Execute geometries
sequentially through unchanged predict_request; no ensemble or conformer averaging.
Publication is all-or-nothing across the batch. A later geometry failure yields an
honest failure, not a truncated success; protected diagnostics can retain earlier
progress, solely as diagnostics, not published per-geometry successes. Recovery
reconciles one exact Attempt and terminal result. Estimate result-size bounds before dispatch and qualify the final envelope
against API and GUI. Each result identifies its geometry and original atom mapping.

Retain actual generated/prepared coordinates, producer/settings/seed, conversion
and selection evidence in the scientific result envelope, published through the
existing core terminal-result owner. Access follows that Job's result authorization;
these values are not hello text, public logs or raw interpreter transcripts. Bound
the whole envelope before inference and verify actual API/GUI limits in slice 1.
If it cannot fit, revise the supported batch limit before enabling the offering;
do not invent a new artifact service or silently omit reproduction evidence.
A seed alone is not sufficient reproduction evidence. Bind all executed request
digests and collection order before dispatch through the existing Attempt owner.
Freeze admitted prepared bytes for the Attempt. Do not regenerate after uncertain
execution or rerun earlier conformers to recover a partially executed batch. Exact
terminal publication replay remains the existing owner's job. State retention and
authorization must cover scientific sources without exposing them in public logs.
Prepared bytes are Attempt-local until a terminal result is prepared. Exact terminal
bytes then use the core's existing durable replay retention. Before dispatch, retain
digests and producer/selection identities as already required; there is no promise
to resume partially executed science after a crash, so no separate durable input
cache is required. Successful result retention follows the API's existing result
lifetime; private temporary sources are retired with owned Attempt work. Failed
Attempts retain safe causal evidence, not an unbounded archive of source coordinates.

Focused qualification matrix
-----------------------------
For each route: source -> exact prepared atoms/coordinates -> admission -> per-atom
result correspondence. Use licensed/self-authored small fixtures with pinned hashes
and expected numerical observations; do not regenerate expectations from new readers.
For each file variant: single/multiple records, selected/all, preserved H/order,
malformed/truncated later record, units, unsupported syntax and actual read bounds.
PDB additionally exercises model/alternate-location choice; MOL2 unsupported atom
types; SDF V2000/V3000; XYZ trailing/missing rows and multiple-frame boundaries.
SMILES covers explicit/implicit H, specified/unspecified stereochemistry, invalid
SMILES, N bounds, shortfall, seed/config recording and worker timeout/retirement.
Conversion covers identity/nm/bohr, contradictory evidence, no cumulative scaling,
overflow and diagnostic-only bond warnings. Compare distances with independent
expected values, including the existing two NIST cases where applicable.
Loop cases cover correctable reader feedback, unsupported source, prompt injection,
budget exhaustion, failed prepared-reference lookup, operational failure and no
duplicate generation on submission. No raw source/secret leakage in error surfaces.
Retain 002 scientific regression witnesses separately; new geometry qualification
does not establish NMR accuracy. Scripted interpreter tests prove control flow;
an explicitly invoked real-model lane must prove actual selection/conversion behavior.

Interpreter, failure and recovery policy
========================================

Use the existing core interpreter seam if compatible, with a NMRNet capability.
Do not borrow G01 solvent or SECS spectrum semantics. Configure ordered endpoints,
bounded requests/repairs and an overall deadline. Fix and qualify budgets rather
than copying unrelated timings/counts. Bound actual response consumption and
trickle duration; complete interrupted I/O before connection reuse (014 W03/W08).

Repairs may fix format/source selection, not invent scientific content. Operational
endpoint/protocol failure may permit bounded fallback; a terminal model-reported
source problem must not be overruled by another endpoint. Attribute such a report
to its producer, distinct from verified input rejection, outage and inference failure.
Explain what request material reaches the configured interpreter (014 W04).

Before inference, repeat interpretation only under the declared Attempt policy;
retain the executed-coordinate digest and preparation/interpreter identity through
the selected Attempt recovery owner before dispatch. This identifies the submitted
candidate even if no terminal result becomes available; inability to retain this
identity blocks dispatch. Establish that seam in slice 1, not a second journal.
Once inference may have begun,
do not reinterpret/recompute to recover an unobserved outcome. Replay exact prepared
terminal bytes on publication retry. Persist intermediate input only for a concrete
recovery promise, using the existing owner, not a new sidecar journal (014 W02).

The core owns start/complete/fail uncertainty and exact Attempt reconciliation.
Never infer commit from transport success or timeout. Storage failure blocks unsafe
advancement. Expiry is server-owned and not renewed by progress. On confirmed expiry,
stop owned work, preserve evidence, and neither resend nor manufacture a replacement
Attempt. If completion committed before response loss, recover that success.
The GUI shows Expired without per-expiry recovery advice: offering/guide text must
explain this Attempt has no published result and direct users to resolve outstanding
work with the operator before deliberately creating another Job. Preserve other
Attempts' results; promise no automatic resubmission.

Errors, but not secrets, must maximally inform the actual recipient. Developers
need phase/cause/source evidence; operators need Attempt/service effect and recovery
actions in bounded protected diagnostics and inspection. Commissioners need safe
specific rejection/unavailable/unresolved/failure reasons through API/GUI. Receivers
need results with limits or honest status. Stderr alone is not an acceptance surface.
Freeze each surface's owner, authorization, safe fields, bounds and retention.

Preserve primary/secondary causes, effect state and visible truncation. Do not map
all ValueError to input error. Bounding an oversized reason must preserve ordinary
rejection through API/GUI. Exercise model reports, tool history, nested exceptions,
captured output and storage/cleanup failures with private sentinels. Retain the
known scaler-version warning in protected diagnostics and disclose its compatibility
limit appropriately; no silent dependency refresh or tolerance relaxation.

Stopped inspection is one recovery step, not resolution. Use authenticated API
reconciliation and the existing owner's closed-record archive operation, bound to
the exact Attempt/record and reason. Preserve original evidence; closure does not
prove delivery. Unavailable API/in-progress Attempt remains held. Document restart
after archival and confirmed worker retirement; never delete journals to clear a hold.

Contained deployment and normal service
=======================================

All Python, package work, fixtures, tests and science run in containers. Host
shell/Make/Git orchestrate. Acquisition follows existing explicit-interface,
advisory-review and lock workflows; builds consume reviewed offline inputs. Lock
refresh reviews the whole package-set diff, not index freshness. No upstream or
sibling changes without prior discussion.
Deployment orchestration remains host shell. Python configuration, credential and
state validation runs in contained helpers with only its required mounts; the host
shell invokes admitted engine operations. SECS/NMRPeak host-Python deployment
controllers are workflow precedents, not an exception to this containment rule.

Named workflow: initialize private config/state; install API-issued signing artifact
and separate interpreter credentials; build admitted images; preview configuration;
start; status/logs; stop/restart. API authority owns registration/issuance. Provider
installation must not obtain API runtime secrets or silently replace identity.
Use disposable local qualification credentials (014 W06/W07).

Bind retained state to API origin/provider identity and exclude competing owners.
Keep admitted configuration stable for a run; record config/image identity and make
rotation/edits/redeployment explicit. Reuse suitable snapshot/locking mechanisms,
not every sibling confirmation scheme. Down removes only owned runtime resources;
configuration, artifacts and retained work survive. No blanket clean operation.

Provider grants cover API/interpreter, and source access only if required. Admit
per-destination TLS trust: normal roots or explicit private CA, never verification
bypass. External access requires an explicit host interface, enforced sole route
and direct-bypass-denial proof; the existing host-network acquisition proxy alone
is insufficient. Local API/GUI uses a named internal network with tested external-
egress denial. Live model calls use a separate explicit external grant.
For API, interpreter, runner and any admitted source exchanges, prove whole-operation
deadlines and byte/work bounds, including trickling or failed responses, plus
completed interruption and transport release before reuse. Per-read timeout alone
is insufficient; reuse the actual transport owner's mechanism (013 X04), including
M:magnet_provider/provider_http.py and runner_session.py as behavioral precedents.
Slice 1 must prove the binding uses the local provider-core owners from 017 and
identify missing behavior there; it must not import the Magnet package.

Inference stays offline/read-only/nonroot, cap-drop ALL/no-new-privileges, 2 CPUs,
4 GiB/no swap, 64 PIDs and bounded scratch. Provider CPU/memory/PID/scratch/storage
also get measured bounds. Mount only needed sources/socket/state; no service engine
socket, home or whole workspace. Bound actual reads, including partial/failing
ones and source growth; preserve existing same-buffer artifact consumption.

One active inference; reject concurrent admission. Host orchestration owns startup
and retirement. Cancellation or uncertain in-flight execution retires the exact
runner container; confirm engine termination before replacement/new inference.
If confirmation fails, admission stays blocked. Name and prove the bounded host
control route early; helper death/socket loss alone is insufficient. Successful
requests and determinate rejections may reuse the runner.
Cleanup of shared names/markers/handles requires matching owned identity; preserve
replacement objects. Private exclusive scratch needs no extra identity ceremony.

Normal operation publishes complete hello periodically, discovers eligible work,
reports progress and recovers temporary outages under bounded policy. Configuration
rejection stays visible. Container health, accepted hello, API availability,
interpreter reachability and scientific readiness are different facts. Define
truthful readiness for sequential model loading, without forcing resident H/C heads.
Keep offering descriptions within 1,024 Unicode scalars: concise input/limits and
full copyable guide URL; complete rights-cleared examples live in the guide.
Test the delivered text, not just its template (014 W09/W12).

Implementation slices and acceptance
====================================

The active remaining-work sequence and completion criteria are now at the start
of this note, "Active roadmap: useful, reproducible NMR predictions, 2026-10-21".
The original sequence is preserved in this file's history at c0bb2eb; completed
reader/core/scientific work must not be scheduled as if it were still unimplemented.
notes/016_provider_tests_first_20261018.txt remains the module/test reference,
with per-U/A obligations. Its planned witnesses are not claims of qualification.

Retention follows purpose: offline inputs while needed; reviewed evidence while
claims remain published; debug captures/helpers until resolution or accepted
replacement. Check unique evidence/rationale/active work before cleanup. Attempt
retention must not erase the only published-claim evidence. CI remains deferred.
No new public prediction CLI, training, ensemble/GPU work or upstream edits enter
implicitly. SMILES preparation and multi-format Uploads are explicit requirements;
they cannot be deferred while declaring 003 complete.

Individual U/A carry-forward
============================

013 defines each rule. These are acceptance obligations, not completed proof;
reuse 002 owners/tests instead of adding duplicate provider-specific gates.
U01 Shared scientific callable; interpretation/preparation does not fork H/C science.
U02 Preserve ordered cast/centering/tokens/selection/distances/padding checks.
U03 One mask/index owner; any generated-geometry mapping needs explicit proof.
U04 Existing NMRNet settings/dictionary/scaler/state/device/dtype checks; no invented
    E02-specific configured normalization buffers.
U05 Immutable verified bytes actually decoded, not hashed-path reopen.
U06 Exact producer/population gates and portable observations, not counts alone.
U07 Real input/runner/API/GUI boundaries and 128->130->136 capacity.
U08 Distinguish computation, uncertain delivery, committed effects and cleanup failures.
U09 Separate description/interpretation, admission, preparation, acquisition and effects.
U10 Named cross-module records; empty/unavailable/unresolved differ; private repr safe.
U11 Prove lightweight imports/installed origins and forbidden effects; set actual
    permission modes in fixtures rather than relying on ambient umask.
U12 Extend existing protected literal Make capture and real-Make regression.
U13 Bound consumed work including failed reads and actual multi-companion paths.
U14 Own cleanup handles/shared names; prove exact-container retirement before admission.
U15 Preserve requirement intent and applicable gates without proof-token ceremony.
U16 Precise sources/rationale at owners; distinguish inspection from runtime evidence.
U17 Usable requests, plain guidance and actual recipient-visible next actions.
U18 Reviewed path-limited commits, progress and truthful status; no new push authority.
U19 Purposeful scientific evidence and scoped private working-state retention.
U20 Review full lock changes; write/no-write lanes only for actual generated artifacts.
U21 Missing version-matched reference fixtures block qualification; no silent expected-
    output regeneration after producer/runtime/preparation changes.
U22 Update active guidance with implementation; retain dated superseded observations.
U23 Safe causes reach each authorized recipient through their actual channel/renderer.
U24 Exercise scaler-warning delivery and existing unit/distance evidence; unknown
    archive-wide provenance stays unknown rather than receiving an invented test.
U25 Cheap routine correctness; costly witnesses and model calls are explicit lanes.
A01 Health/receipt is not accuracy or full-workflow qualification.
A02 No tuned tolerances or approximate identity; inspect actual loaded state.
A03 Bound reasons without losing useful causes or turning rejection into execution failure.
A04 Actual admitted closure, no ambient imports; hashes alone do not prove completeness.
A05 Existing lifecycle/publication owners; no parallel journal/framework by default.
A06 No imported sibling solvent/peaks/ranking/atom-map/absent-nucleus semantics.
A07 Coordinates do not establish stereochemical validation.
A08 Explicit angstrom convention with bounded evidence, not assumed producer units.
A09 Real maximum computation; admission/synthetic cases do not prove chemistry.
A10 Preserve useful observations/rationale, not raw logs or obsolete runtime structures.
X01/X04 apply to provider lifecycle/network; X02 is serial admission; X03 is actual
recovery state. X05 geometry preparation is now explicitly required.
X06 ensemble/GPU remains deferred. X07 grants no sibling authority.

Review discipline
=================

Coordinator authors/integrates; Luna-low agents challenge the end-user workflow,
science/U/A, operations/containment and API/error delivery. After material corrections,
require two complete unchanged-text rounds without actionable findings and record
concise dispositions/identity, not raw logs. During implementation audit every small
meaningful slice against important U/A and ordinary code concerns, with focused
contained tests and commits using explicit -- FILE paths. Plan review is not runtime
proof; do not manufacture requirements merely to prolong it.

Historical workshop review, before the three-route decision
===========================================================

Three context-isolated Luna-low agents compared actual M/S/P workflows in parallel,
then challenged the integrated plan across product/API, operations/containment/
recovery, and science/interpretation/U/A/recipient evidence. Accepted refinements
retained executed-input identity before dispatch and restored whole-exchange API
and runner transport requirements. Rejected host-Python permission and a mandatory
new analysis kind: neither follows from our requirements or the API contract.

At commit ab90ed0, after those corrections, two rounds on unchanged text returned no
actionable findings. This settles the plan structure, not the explicitly open
input-product decision then in slice 1, runtime correctness or deployed service.
These hashes describe that historical revision, not the revised plan above.
Reviewed body: first 355 lines, SHA-256
b664ed16b61c884d5774e4577efe5f758075cbdd1eea5912e253a3dc34645adc.
Reviewed comparison note 014 SHA-256:
183bd25259327e7b036d47484d4f6c0f9a43223cd7f3e4318635220a987db9c0.
All five sibling/API/GUI source revisions were rechecked against 014 and their
worktrees were clean. Whitespace checks passed. No runtime tests, downloads,
external model calls, sibling edits or deployment actions were performed.

R19. Actual API qualification resumed; explicit mapped host publication
-------------------------------------------------------------------
2026-10-21. The user resumed the first transaction and requested provisioning
through the nmr-api-v1 owner thread. That owner reports the dedicated dev-local
provider and existing demo Project's peaks_from_mol entitlement ready, preserving
other credentials/grants. Private paths and credentials remain outside this repo.
No Job has been created at this entry; provisioning is not prediction evidence.

The inspected sibling precedent is Magnet 600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf,
compose/provider-localhost.yml (host-gateway hostname + CA), corroborated by
NMRPeak 1697dc84dd1d76ae25b04efc8183fd80614000e5,
notes/001_nmrpeak_multi_runner_deployment_20260824.txt (localhost provider route).
The API owner confirmed its selected host publication differs from the internal
TLS listener port. Mapping the original hostname to the ingress container IP
would therefore select the wrong port. Preserve original origin, TLS SNI, Host
and signature authority, and map only the TCP address. A host-gateway label does
not establish DNS resolution. The chosen host address/interface is an explicit
operator grant, not a resolved/attested hostname; observe the actual publication
before use. Host route observation selected lo for this local publication.

provider.sh now accepts mapped routes with literal MAPPED_ADDRESSES and explicit
EXTERNAL_INTERFACE. It reuses provider_proxy.ServicePolicy/connect_bound's existing
literal IPv4 path, host network and finite relay. Every mapped host must be used;
missing/duplicate/nonliteral assignments refuse. No DNS fallback or new resolver
is introduced. Local routes still require exact observed internal-network peer
membership; external routes retain interface-bound DNS. One host can have two
admitted ports without duplicate address assignments. The real-Make checks cover
the new selector's literal forwarding and nonexecution.

Focused evidence: 27 host/proxy tests passed; corrected harness grants then passed
both real-Make tests and the updated mapped-refusal witness. The first ad-hoc Make
run lacked its RO containers fixture mount and errored before exercising Make;
this was a qualification harness error, not an application pass. Ruff/shell syntax
and diff checks pass. Independent read-only reviewers found the duplicate-host
argv defect and a missing delimiter check; both are corrected with targeted proof.
Actual authenticated routing and prediction remain the next connected evidence.
The controller image was refreshed for launch_capture; four installed-runtime
checks passed before this mapped-route edit. The next refresh includes the route
and explicitly checks launch_capture's installed import origin as well.

R20. Maintained, explicitly parameterized actual-API witness
---------------------------------------------------------
2026-10-21. provider/qualify/api/pasted is an opt-in Make target, excluded from
all default offline test aggregates. It creates a persistent Job. Its documented
command-line selectors choose API origin/topology, Project/user, original issued
credential/CA grants, observed literal publication/interface, isolated model
network/interface, immutable API client image, retained comparison receipt and
fresh private output. Provider identity/profile derive from the admitted original
provider artifact; no origin, port, user or provider must be edited into Python.
The existing literal Make forwarding owner covers every new selector. The receipt
location is an input; expected scientific bytes/hash remain pinned, never regenerated.

The host caller reuses provider.sh for the actual foreground/native execution;
worker_retirement.sh owns exact fixture/helper container admission and retirement.
No model peer receives provider/client keys, configuration, native sockets or host
ownership receipts. Configuration staging has only its source directory writable;
the public client has separate output. Private configuration, Attempt state and
receipts remain outside the checkout. Failure never automatically resends a
mutation, deletes its original request, resets state or replaces held ownership.
One peer exchange, successful handler settlement and exit, successful client
readback and normal foreground retirement are distinct required observations.

API client source precedent: nmr-api-v1 e7790cf6a922c39261fe736d5a23d17a9a5ea322,
nmr_api/security/user_credential_artifacts.py::validate_user_credential_artifacts;
discovery_examples/sign_request.py::main; public/job_create_request.py::
canonicalize_job_create_request_body; public/{analysis_result_read_response,
analysis_result_list_response,execution_attempt_list_response}.py; canonical_base64.py.
The installed API runtime supplies these owners. The existing provider artifact
parser is deliberately not used for a user's different issued artifact grammar.
Job creation begins closed, then selects exactly the derived provider and opens.
Response status/topology, immutable creation fingerprints, accepted result byte
length/hash and Job/Attempt/source identities are checked. History is re-read after
a result appears to avoid treating independent GETs as an atomic snapshot.

Scientific case: api_pasted.json copies the authored table/instructions from
SuppliedLifecycle at d622f27, tests/integration/provider_core/normative/
test_nmrnet_supplied_lifecycle.py. Expected receipt SHA-256 is
9ae5017c42af5c5691554eb3ff6dced7895c6a00ab177975d8aa15ae0c58f59a.
Exact received source, positions, preparation/unit conversion, prepared request,
float32 inputs, selected artifacts, observed scientific runtime, prediction image
and ordered shifts must join that independent retained receipt. New Job/Attempt,
configuration and caller execution identities remain new, truthful identities.
This is repeatability with scripted interpretation, not independent accuracy,
real-model interpretation or GUI proof.

The first foreground bootstrap (private /tmp/nmrnet-api-WeygUcCY) failed its initial
inventory read before Hello/Job creation and retired its components. The chosen
host publication plus lo binding timed out. A separate contained read-only probe
of the also-observed loopback publication, with the original hostname/port and CA,
returned HTTP200 in0.055s. The next target invocation explicitly chooses that
working observed mapping; runtime adds no fallback. The first temporary peer's
full inspect exceeded the existing4KiB receipt ceiling; it was retired, and
qualification posture now projects only relevant fields. No actual Job exists yet.

Focused qualification: installed controller refresh and four installed-runtime
checks passed (including launch_capture import origin). Installed API-owner imports
passed in its existing runtime, with no network or credential grants. Three focused
real-Make tests, Ruff, shell syntax and diff checks passed. Independent reviews
corrected an Attempt/result observation race, bounded the client process to240s,
joined source/Job fingerprints, made the receipt path explicit and required the
scripted peer's own successful outcome. Final correction review: no new signal.
Actual transaction and its observed grants remain the next evidence, not a claim
established by these source/unit checks.

R20a. First actual transaction succeeded; fixture capacity stopped the service
-------------------------------------------------------------------------
2026-10-21T20:56Z, target source22dff9f. The dedicated provider was discoverable;
authenticated create(201), select/open and public result readback succeeded for
one new Job. Exactly one Attempt/result was received. The client verified exact
result bytes/hash, new Job/specification/source correspondence and all pinned
scientific subfields; client/passed.json reports scientific_repeatability=true,
interpretation_scripted=true, gui_exercised=false. Private complete evidence:
/tmp/nmrnet-api-qualified-20261021-2056. No private key contents enter this note.

Overall target exit2 is preserved: ConfigFiles defaults maximum_records=1, so
the correct production admission owner refused the next work-loop iteration once
the sole durable slot held this completed result. This is fixture capacity, not
failed chemistry or delivery. Staging now explicitly requests two slots: the
completed record plus one free admission slot while the single-Job service idles
until orderly stop. No production capacity rule is weakened and no record deleted.
The actual model peer recorded one request and settled handlers. Native/service
retirement completed, but the controller honestly reported stopped_after_failure.
The successful transaction is retained unchanged. A fresh explicit target invocation
will qualify the corrected entire lifecycle; it is a new qualification Job/operation,
not automatic resending of any original mutation or regenerated expected output.

R21. Actual API prediction, readback and normal retirement qualified
----------------------------------------------------------------
2026-10-21T20:59–21:00Z (local date2026-10-22).
Source bb15cf2676525cc605949e2431b741a2ff9a616d. The maintained opt-in target
provider/qualify/api/pasted completed exit0. It used the actual dev-local API and
its original signing/TLS authority/port, a separately granted scripted model peer,
the normal foreground host owner, isolated RDKit reader and released NMRNet models.
The API owner's dedicated credential/Project entitlement workflow is described in
R19–R20. The original provider and client keys were admitted/read in their own
private grants; no credential contents enter the repository or evidence archive.

One new Job was created closed with201/non-replayed receipt, selected the dedicated
provider, opened and completed one Attempt. Twenty-two signed public requests
include discovery, immutable creation/selection/state receipts, Attempt/result
metadata and the accepted result document. Readback verified canonical Base64,
13721 exact decoded bytes and SHA-256:
76cad7f1b0c3fc646de762ab11012e60fd9e5155bd34ac6e226bd6041bcc39b6.
Input fingerprint: sha256:f9e0090b8bdc69dbe184b8d461aff07915aac4a3a3f5d6b631aac552d7341b82

The new Job/Attempt/source joins passed. Received source bytes/positions/origin,
explicit nm-to-angstrom conversion, prepared request/float32 inputs, model/scaler
identities, observed scientific runtime, prediction image and ordered shifts all
match the independently retained pinned receipt in R20. Exactly ordered predictions
(atom index, nucleus, ppm):
  0 H  3.062568426132202
  2 C 32.309967041015625
  3 H  3.0625784397125244
  4 H  3.0625784397125244
Only H/C heads are supported; the supplied Cl remains in the geometry/order.
Prediction image: sha256:cabb4fe3e36541b0fefe54ca7c16fb21f9a60112a1e3d47992d4aa18343ecd08
Geometry image: sha256:be4358dd385b280723831950e527e44a87de4ee49afa9020ef8e7e8929bd3bb3
Controller image: sha256:5b40da88e76255b3761a21386a3aa5135aac9c82fb165f8eb106ed20bce05bea
API client image: sha256:d5f0eeba0b617d0686d2cb00bfff0844ac488ae0be888829a00dceaec641f7c6
Upstream gitlink: 3ba8b9c2f3d0a390d00685d238618345c6ab24d7 (unchanged).

One model exchange and exactly two native allocations (reader, prediction) occurred.
The scripted peer exited0 after exactly one request and handler settlement. All
ten container IDs (eight supporting components plus two native roles) have matching
stopped-state and removal receipts. The controller result is state=stopped with
requires_host_retirement=false. A Hello interrupted during shutdown retains its
unconfirmed acceptance and cancellation cause in that protected result. This does
not erase the confirmed AnalysisResult or falsely assert the Hello's API outcome.
No mutation was automatically retried. The earlier R20a Job is a distinct retained
transaction; its lifecycle exit2 is not relabelled successful by this later run.

Private full run: /tmp/nmrnet-api-qualified-20261021-2100. Stopped configuration
and durable Attempt state remain there for explicit later recovery/inspection.
Compact retained local capsule, outside version control:
.work/qualification/provider-api-pasted-20261021-2100/
  scientific-result.json, client-passed.json, qualification-sources.sha256,
  receipts.tar.gz and SHA256SUMS.
The compressed receipt archive is 26,209 bytes: public client request/response evidence,
protected helper/controller/native ownership and retirement receipts, and the
peer's count/settlement witness. Explicit archive paths exclude original/captured
credential contents, startup configuration trees and model keys. Native captures
also pin tools/bound_http_proxy.py and tools/container_guard.py, complementing the
qualification caller's source manifest. No expected outputs were regenerated.

Actual creation observations: UID/GID1000, private0700 directories and0600 sensitive
files; private native/state/source/component/route/output trees contain no group/
other permission bits. Source-code captures retain public0644/0755 modes behind
private ancestors and readonly grants. No historical source/scratch permissions
were changed. See018's appended production-run observation and its proof limits.

Independent authority/provenance/mechanics reviewers inspected actual receipts,
source and scientific correspondence without reading keys or rerunning effects;
no claim/refusal signal remains. Earlier focused real-Make/installed-runtime and
Ruff/shell checks remain applicable. No unchanged scientific population/capacity
matrix or broad default suite was rerun for this connection/fixture correction.

This closes the first actual-API transaction milestone with scripted interpretation.
It establishes repeatability of released CPUfloat32 fold0 predictions, not published
five-checkpoint ensemble accuracy, independent experimental accuracy, real-model
interpretation, GUI delivery or deployment. 003 stays open. Next: qualify the real
interpreter for all three agreed routes/formats using an explicitly selected
endpoint/model and original private key-file grant; no such real-model configuration
or paid calls were used here. GUI submission/receiver proof remains separate.

R22. Existing Gemma, OpenAI and Mistral configurations copied and admitted
------------------------------------------------------------------------
2026-10-21T21:18Z (local date2026-10-22). At the user's request, the selected
sibling configurations were copied into separate private, selectable NMRNet
interpreter fragments. This closes configuration acquisition for the next real
interpreter qualification; no further credential request is needed for these
three choices. It does not change R21's historical scripted-model evidence.

Private locations, outside version control:
  .work/provider/interpreters/{gemma,openai,mistral}/interpreter.toml
  .work/provider/interpreters/{gemma,openai,mistral}/api.key
  .work/provider/interpreters/manifest.json
  .work/provider/interpreter-imports/
The import area retains the original selected artifacts and the one-time
materialization source/hash. The manifest retains original identity/source
provenance privately. Endpoint hostnames, account labels, original configuration
IDs and credential contents are deliberately absent from this public record.

Selected model/status facts:
  Gemma:  gemma-4-12b; donor artifact disabled.
  OpenAI: gpt-5.6-luna, reasoning_effort="none"; donor artifact active.
  Mistral: mistral-large-latest; donor artifact disabled.
Exported configuration IDs use neutral model/family labels rather than donor
host/account labels. Each fragment contains one endpoint and can be selected
independently. Copying a disabled donor artifact does not enable it: no aggregate
endpoint list or automatic fallback among these three was installed or selected.
The donor's enabled/disabled status remains explicit in the private manifest.

Contract source: magnet-deploy 600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf,
magnet_provider/openai_chat_interpreter.py::_parse_config_document/_parse_config,
_chat_completions_url and _MAX_RESPONSE_BYTES. Its closed endpoint grammar is
id, base_url, api_key, model and optional reasoning_effort. The adaptation maps
id to configuration_id, appends /chat/completions after removing trailing base
URL slashes, preserves model/reasoning settings, and places the original key
value in its separate key_file. Current NMRNet HTTPS/header/key admission remains
authoritative; no alternate endpoint parser or production discovery was added.
NMRNet owners: nmrnet_provider/config.py::_interpreter/_endpoint and
provider_core.chat::ChatEndpointSpec. The copied fragments were admitted by the
existing installed _interpreter owner with read_startup_file; all three matched
their constructed endpoint specifications. This was offline configuration
admission, not an authentication, reachability or model-behavior test.

The inspected E01 policy separates 25s request, 60s turn and 240s interpretation
budgets. Its parser is models/e_01_jvae_nmrexp/provider/magnet_provider_bindings/
e_01_jvae_nmrexp/binding_config_v1.py::parse_e01_binding_config_v1 at the same pin.
The fragments explicitly use exchange_seconds=25, retirement_seconds=5,
request_bytes=65536, response_bytes=262144 and max_turns=6. The256KiB response
ceiling follows the donor carrier; request/retirement/turn-count values are
explicit import choices. The fragment comment/manifest records the owning
[preparation].seconds=240 integration requirement; a fragment alone does not
modify that outer preparation policy. Magnet's 60s two-attempt turn policy is
not copied into a retry: NMRNet still sends each carrier request once. Its
existing parallel_tool_calls=false, completed-reply checks, retirement and
effect-safe fallback rules remain unchanged. No provider-specific request
options or endpoint compatibility claims were invented during copying.

Observed private modes: import/interpreter/family directories0700; each fragment,
key and manifest0600. Original key values and configuration text were processed
only inside their private grants; the independent documentation review used
safe manifest fields, materialization source and filesystem metadata, not key
contents. No interpreter HTTP request, paid call, API mutation or scientific run
was made for this copy. No model/GUI/deployment milestone is closed by it.

The current read-only boundary remains in force. The next follow-ups are the
separately requested DRY review and finite checker work. A subsequent real-model
qualification now has concrete configuration available: explicitly select one
of these endpoints, integrate its outer budget and existing sole-route grants,
and retain actual interpretation/error/retirement evidence for the agreed input
routes. Do not repeat configuration discovery or ask for these credentials again.

R23. Finite checker clients and one component creation/admission owner
--------------------------------------------------------------------
2026-10-21T21:30Z (local date2026-10-22). These two bounded maintenance slices
close the immediate finite-checker and duplicate-launch-policy follow-ups in R22.
They do not add a real-model qualification lane or make interpreter requests.

A: 3cdf288e090f5921575a5bbe6509a1f157baedac, tools/checker.sh and
tests/test_checker_{launcher,engine}.py. Dependency verification now has a 60s
client budget in checker check, initial build preflight and captured-dependency
verification. The offline build client has a 900s budget, matching the existing
provider/RDKit image-build convention. Image admission retains its existing 30s
budget. The shared tools/inference_native.sh owner still controls deadline
delivery, TERM grace, exact child joining and its original retirement fact;
no second timeout wrapper or checker-specific process owner was introduced.

Precedent: dapp32 39819ec60d0b38169b0beb20f0742b308eb4fe74,
tests/checks/test_release_approval_image.py:342-360,
ReleaseApprovalImageCancellationTest.test_target_deadline_stops_work_before_teardown;
tools/release_approval_image_build.sh:57-81,134-141. That workflow stops owned
launch work before teardown and retains mounted inputs when release cannot be
confirmed. NMRNet ports this proof obligation into its existing native owner,
not dapp32's Compose lifecycle or its numeric budget values. A stopped local
Docker client does not establish daemon-side container or build cancellation.
Neither the new deadline nor these tests proves that daemon-side work retired.

Related precedent: dapp32 c0a3e8d758ac821002751a5b461d22349ea135e6,
tests/checks/test_release_rehearsal.py:69-90, ReleaseRehearsalCancellationTest.test_target_deadline_waits_for_child_cleanup_before_fixture_teardown;
Makefile:1209-1211 sends TERM at 600s with 420s grace. This tests the same
child-cleanup-before-fixture-teardown ordering; numeric values and outer wrapper were not ported.

The regression witness shortens only the fixture copy's policy values to 1s;
the real native owner and timeout executable handle expiry and child joining.
All four affected call positions are held independently. They must return 124,
stop the exact original client before removing its private inputs/client state,
perform no later image admission or publication, and preserve the predecessor
image record. Failed capture removal must retain/report its path without
replacing timeout status 124. Existing unknown-retirement gating still retains
owned paths and starts no replacement owner or later workflow phase.
The old untimed build exceeded the witness's 7s observation bound:
/tmp/nmrnet-checker-deadline-red.log. The focused checker/native-owner selection
passed 27 tests in 124.389s (/tmp/nmrnet-checker-deadline-focused.log); the final
two deadline tests passed in 16.806s (/tmp/nmrnet-checker-deadline-final.log).
Ruff, formatting, shell syntax and diff checks passed.

B: cbc7ecf372a37df7db433a03bdea85749b6be1e6, tools/provider.sh::
provider_host_create and tools/provider_api_qualification.sh. The duplicate
api_witness_create was removed. The existing creation owner now takes explicit
image, grants and command arrays; every component shares its fixed resource/
isolation policy, exact CID admission, mandatory observed posture gate and start
ordering. Production still invokes installed modules with isolated Python;
qualification helpers explicitly grant their fixture environment and script argv.
No command string is evaluated or implicit image selected by the shared owner.

A source-only reconstruction using captured helper JSON field shape found that
unconditional full mount capture would add a service path-length restriction at
the existing 4KiB receipt ceiling. This was not a live production measurement.
The final internal record_mounts argument controls evidence only: production
service calls pass false, qualification helpers true. Mandatory posture checks
remain common. Helper mount receipts are private, bounded and recorded before
start; capture failure blocks start while preserving the exact cleanup handle.
The service gains no new mount-metadata byte limit. No second launch policy or
expanded receipt limit was added to avoid the regression.

The recording-engine host tests cover literal image/network/grant/argv transfer,
private modes, common posture refusal for both invocation styles, failed-create
cleanup-handle adoption without start/retry, mismatched-create ownership held
without guessed cleanup, and helper mount-capture failure. Final
make test/unit/provider/host passed 14 tests in 3.899s (tool session95536).
make test/unit/provider/allocation passed 33 tests in 9.154s (tool session42633),
qualifying the shared fake before the final evidence-only mount correction.
Those outputs were retained in tool sessions only; no filesystem test log is
claimed. Ruff0.15.15, formatting and bash -n passed; style evidence is retained
at /tmp/nmrnet-slice-b-style.ua3pDX35/check.log.
These are contained process/recording-engine proofs, not a new actual daemon,
actual API transaction, scientific execution or real-model compatibility run.
Independent final source reviews found no further signal in either slice.

The current read-only boundary remains. R22's copied endpoints are available
configuration, not calls or an enabled fallback chain. A maintained real-model
qualification lane does not yet exist; explicitly selecting/integrating one
endpoint and proving the agreed input routes remains subsequent work. R21's
scripted actual-API result stays historical evidence with its original limits;
the actual API/scientific run was not repeated for these unchanged contracts.
Neither maintenance slice closes full 003, real-model interpretation or GUI proof.

The next real-model lane also needs a qualification deadline that covers its
sequential work. The scripted client's 180s readback and 240s process limits do
not represent the copied profile's 240s preparation budget plus separate native
operations. nmrnet_provider/session.py::NMRNetSession.execute awaits prediction
prepare then execute; worker_client.py::WorkerClient._exchange gives each its
own configured 90s budget, and WorkerClient.wait_closed separately observes
channel closure with that same 90s policy. Host retirement and API publication
remain additional owned phases. The new lane must choose a finite qualification
deadline covering its actual sequence, retain unresolved cleanup ownership on
expiry, and never infer permission to retry a mutation or model request. No new
numeric deadline or selector suite is adopted by this finding.

R24. Real OpenAI interpretation delivered exact API science; fast-path check failed
-------------------------------------------------------------------------------
2026-10-21T22:14Z (local date2026-10-22). One maintained
provider/qualify/api/real-pasted invocation ran from
ab254b9ecf89e5b8330ed27602d01b724b914c39. It selected the existing private
OpenAI configuration for gpt-5.6-luna with reasoning_effort=none; no aggregate
fallback or scripted peer was enabled. Earlier source slices f5e7170 and8101ba2
separate mapped/API and external/model interfaces, admit individual interpreter
file grants, and retain the strict independent scientific oracle. The installed
controller was refreshed after the badd107 citation-only image-input change.

Discovery, create(201/non-replayed), exact provider selection/open and accepted
public result readback completed for one new Job and one succeeded Attempt.
Thirty-six responses to signed public requests identified the expected dev-local topology.
Delivered length13732 bytes, SHA-256:
3eb7aba1c2d8334b4843076f779e5ff5c1a38f6a02716a5a4091060a4bbb94cc.
The Job/specification/source fingerprint joins passed. Received table source is
88 bytes, SHA-256 acb27f16267965125a02049811172c6388fb9027dd41517c65c2cd6dcf87a3a5,
with received table line positions1–5. Its identity equals the authored source
with only its final LF omitted; no fixture text was substituted for model output.

Overall target exit2 and client exit1 are preserved; client/passed.json is absent.
The delivered interpretation records one admitted endpoint route, two turns,
one correction and the successful prepare_pasted operation. Its safe endpoint
identity matches the staged selected configuration. The original qualification
required one uncorrected exchange and therefore failed before its later scientific
comparisons. It was not weakened or rerun. The precise rejected source/correction
message is not retained; its cause is unknown. No endpoint/carrier failure is
recorded, and this observation does not establish a transport retry.

Scientific equality was independently checked after that failure, without
rewriting the actual interpretation observation. The contained read-only
/tmp/nmrnet-real-readback-proof.sh and receiving
/tmp/nmrnet-real-api.AEKdZrp7/scientific-proof.log are retained durably as
.work/qualification/api-real-openai-pasted-ab254b9/readback-proof.sh and
evidence/scientific-proof.log within that capsule. They verify the pinned oracle SHA
and all16 projected checks: selected models, runtime, prediction image, single geometry, exact executable
request SHA and full binary64 prepared_request, float32 coordinates, loaded heads,
prediction unit, ordered predictions, nm preparation/conversion, selected endpoint
and public decoded bytes/fingerprint/length. Separate read-only comparisons agree.
The projection's initial API-field-name typo was corrected to
canonical_result_base64; that offline correction made no API/model/scientific call.
No expected outputs were regenerated and no numerical tolerance was widened.

Prediction and geometry images match R21. Actual controller image:
sha256:8b2c004f4699f5c6fb39bff1a540444081a326bef32f864092a2d872cb385368.
The pinned scientific receipt remains SHA9ae5017c42af5c5691554eb3ff6dced7895c6a00ab177975d8aa15ae0c58f59a;
its caller revision f01e52d0e91b7afd23af7465bc27da38aaa8b9e1 and controller image
sha256:9164d380c00bf0e013d44357cafb03d4b1f64570a93105f74ac4b85b66cf1b49
remain historical identities, not expected equalities for the new live caller.
Scientific model/runtime/request/prediction equality is separate from those
changed caller/controller identities.

Two readers and one prediction worker were allocated; all three have retired
receipts and IPC is empty. All eleven component/native CIDs have matching exact
stopped-state and removal receipts. The controller exited0, reports state=stopped
and requires_host_retirement=false, and records no interrupted Hello. This makes
no claim about unobserved Hello acceptance. Retirement metadata's zero is PID0,
not a claim that every container exited0: the public client actually exited1.

Private selective capsule, outside version control:
.work/qualification/api-real-openai-pasted-ab254b9/ (329 files,2.0MiB;0700/0600).
It excludes frozen configuration, keys and original private interpreter fragments.
files.sha256 SHA-256:
7d41184ca0f87d59d9bb1c582d2ecb09fe037fbc503ec61722f17ca5d89fcb43.
Executed-source archive SHA-256:
3d8122e034cb7958c1fa1e70698d8b251814e453d4837a1fd9a4905d42bdf7b4.
Original private evidence remains under /tmp/nmrnet-real-api.AEKdZrp7/evidence.
No Job or model request was resent to change the qualification outcome. This
establishes live LLM-interpreted API delivery with exact scientific repeatability,
not the one-exchange fast path, other input routes, GUI delivery or full003 closure.

R25. Live OpenAI CCl/N1 interpretation and accepted generated result
------------------------------------------------------------------
2026-10-21T22:28Z (local date2026-10-22). One maintained
provider/qualify/api/real-smiles invocation from
011a248f029bd4e85a1107cc0ee5ed7bac135ff5 completed with target exit0,
client/passed.json and thirty responses to signed public requests. Discovery,
create(non-replayed), provider selection/open and accepted result readback joined
one new Job, one succeeded Attempt and the durable non-replayed complete receipt:
Public decoded bytes equal the private scientific result:16389 bytes, SHA-256
574dbf183feb23e9ab28e97ce2fb1bf74cc81b3823f83e84245c532a6cb4ad0a.

The admitted endpoint was openai-gpt-5-6-luna, model gpt-5.6-luna,
configuration SHA71471bf0f3eb021c90994c89e8065dcf50e708004cd0cb125127957d14b6e12f.
Actual interpretation selected prepare_smiles in one turn with zero corrections;
no fallback, second Job or model-request retry was used. Interpreter-supplied CCl
is3 bytes, SHA6626fa114cb4c6414c3cdc2848c385521e6182c6d4a85731ec01148c5dc3baab.
Selection binds that received source to the Job/input fingerprint and N1.
The generated conformer0 retains atom order C,Cl,H,H,H and added-H parents
2->0,3->0,4->0. RDKit2026.09.1/Python3.12.12 used ETKDGv3, seed17,
maxIterations200 and one thread. Observed generation provenance SHA:
82a2762180b8698b4d205bf305985303c607b5f5a01f2d3d691c6a18d752dad2.
Executable angstrom request SHA:
6a0fb74f78c886aa29a95834c60665bbb95607138843554d76b804dd4eea697c.
The checker joins actual coordinate bytes/binary32 values, observed stereo
annotation/digest and H/C coverage. Observed ppm values, in atom order:
C0=32.348209381103516; H2=3.0629334449768066;
H3=3.062577724456787; H4=3.062323808670044. No chlorine shift is predicted.
These are received values, not regenerated expected outputs. No independent
CCl/N1 numerical reference was available; scientific_repeatability=false and
hydrogen_completeness=not_independently_validated remain explicit. This proves
the finite case's provenance and H/C coverage, not numerical accuracy,
stereochemical correctness or repeatability. The pasted numerical oracle and
its exact comparison remain unchanged.

At011a248, tests/fixtures/preparation/api_smiles.json supplies the Job request;
smiles.json::normative.implicit_hydrogens supplies the authored CCl atom/parent/
count expectations. tests/integration/provider_runtime/api_prediction.py::
compare_smiles_scientific_documents owns this comparison; its normative and
adversarial test_api_prediction.py owners cover accepted observations and causal
rejections. Final client14 passed (/tmp/nmrnet-api-client-smiles-stereo.bFMvIZg5/test.log);
stage9, including actual shell composition for all three modes, passed
(/tmp/nmrnet-api-stage-smiles.QdZxJAW5/test.log). Style checks passed
(/tmp/nmrnet-api-smiles-style.HYiRV6CZ/check.log). The unchanged scientific
matrix was not rerun for this qualification-only slice.

Controller8b2c004f4699f5c6fb39bff1a540444081a326bef32f864092a2d872cb385368,
prediction cabb4fe3e36541b0fefe54ca7c16fb21f9a60112a1e3d47992d4aa18343ecd08
and geometry be4358dd385b280723831950e527e44a87de4ee49afa9020ef8e7e8929bd3bb3
retain R24's image identities; the executed caller revision is011a248. Selected
model bytes and prediction runtime match the pinned receipt's metadata, which
supplies no generated-coordinate or shift reference for this case.
One SMILES worker and one prediction worker have retired receipts; IPC is empty.
All ten component/native CIDs have matching exact stopped-state/removal receipts.
The controller reports stopped/requires_host_retirement=false and no interrupted
Hello observation; no inference about unobserved Hello acceptance is made.

Private selective capsule: .work/qualification/api-real-openai-smiles-011a248/
(299 files,2.0MiB;0700/0600), excluding frozen configuration and keys.
Its evidence/observed-summary.json and evidence/exact-retirement.txt retain the
bounded observations and exact lifecycle joins; original evidence remains at
/tmp/nmrnet-real-smiles-api.MeqSHG4s/evidence. files.sha256 SHA-256:
aab95804690d95ff0f822dd0792de869bc7739649f983ac68a16560c971b2ccd.
Executed-source archive SHA-256:
f263ae2a78be1b3ae1c8ae200f2f9085ef1af73439b717987b074fb7d0d3f9df.
This is one actual API/live-interpreter/generated-science qualification, not GUI
proof, other endpoint/input coverage or full003 closure.

R26. Planned actual Upload qualification; no Upload trial yet
-----------------------------------------------------------
Next is one explicitly selected live-interpreter/API Upload case using only
tests/fixtures/preparation/normative/atom_order.xyz and independent expected.json.
Before any mutation, freeze those source bytes and prove their native binary32
coordinates/order exactly match the existing pinned pasted receipt. Both order
atoms H,Cl,C,H,H; generated R25's C,Cl,H,H,H order is a different case. The XYZ
raw angstrom request/source identity differs from the pasted nm representation;
retain each actual identity and unit provenance, while requiring unchanged exact
native binary32 inputs and ordered pinned predictions. No reordering, new
numerical reference, expected-output regeneration or tolerance widening is planned.

Reuse the installed APIe7790cf6a922c39261fe736d5a23d17a9a5ea322
public/upload_create_request.py::
parse_upload_create_request and its command fingerprint for one signed reservation.
Issue one signed bodyless publish-capability request; its raw response and bearer
remain transient on every status/error path. Bind its method/ref/length and URL
to upload_store_target.py::UploadStoreTarget.bytes_url for the admitted original
store origin. Send exact frozen bytes once by unsigned bearer PUT, then signed
bodyless finalize; verify content hash, length and reservation identity. Create
one closed Job, attach the exact singleton Upload set, verify the set, select the
provider and open. public/upload_publish_capability_response.py,
upload_finalize_response.py and job_upload_set_replace_request.py own those wire
facts. GUI df172527409cc08d46b3318cd19e961f6c3be432
app/src/api/upload-transfer-api.ts::runUploadCreate/
runUploadPublishCapability/runUploadFinalize and upload-byte-publication.ts::
runUploadBytePublication supply the transient-grant/effect-uncertainty precedent.
Retain safe correlation/effect facts, never raw capability bodies or bearer logs.
No arbitrary returned URL, redirect, fallback, mutation resend or automatic deletion.

Normal interpretation is inspect_uploads then prepare_upload: two turns, zero
corrections, with the actual inspected member reference rather than a static Ref.
Plan finite readback/process/host limits900/1020/1040s. First implement and test
the real staged Upload session's300s budget (240s preparation plus60s setup);
existing API/store exchange2s and retirement1s policies remain unchanged. Expiry
must block a new grant and preserve original cleanup/effect uncertainty. Source
review, causal offline tests and commit precede any actual Upload/model request.
This records intended procedure only, not observed delivery or full003 closure.

R27. Upload lane ready offline; live invocation blocked before execution
----------------------------------------------------------------------
68913a002ae2731bf6067e090f435cf0a2b83c65 implements R26's maintained
provider/qualify/api/real-upload target. Its prerequisite budget change is
cdf3be8b786a305b5ae4aa62096e32f846c5cfc4: real Upload sessions receive 300 s,
while scripted sessions, API/store 2 s exchanges and 1 s retirement remain unchanged.
The installed controller image remains
sha256:8b2c004f4699f5c6fb39bff1a540444081a326bef32f864092a2d872cb385368;
existing image/input admission is still required. No new image, scientific model,
numerical oracle, tolerance or production lifecycle framework was introduced.

The client uses existing installed API owners, exact source/pinned-binary32
preflight, transient authorization responses, one unsigned bearer PUT and verified
finalization before closed-Job attachment/select/open. Independent review found
and corrected two error/proof issues: the carrier now closes on interruption,
owns the raw socket before timeout/TLS setup, and preserves safe primary plus
close observations; scientific comparison requires exact retained coverage,
including rejection of omitted coverage. A complete PUT201 followed by closeEIO
retains status/requestID in the existing head receipt, identifies the close phase,
and blocks all downstream mutations without exposing secret canaries. No separate
effect registry was added. Future exchange counts must distinguish that unsigned
PUT from signed public API requests; Client.count includes both.

The final 25 client tests passed in 0.622 s:
/tmp/nmrnet-upload-client-970.jxeQkiaE/test.log. These include successful composed
Upload/readback at simulated clock second 970, crossing the old 960 s limit,
expiry at simulated clock second 990 with both original receipts unchanged, and
the 1020 s whole-process alarm. The 11 staging tests, including actual
shell composition for all four modes, passed in 1.495 s:
/tmp/nmrnet-upload-shell.GMkpT4xU/test.log. Full-slice style evidence:
/tmp/nmrnet-api-upload-style.7o85pFwf/check.log; final clock-only lint/format:
/tmp/nmrnet-upload-clock-style.PTzcQGtw/check.log. These are contained offline
proofs; the unchanged scientific matrix was not rerun.

Automatic approval rejected the attempted provider/qualify/api/real-upload command
at CreateProcess, before mktemp, an output directory, Upload reservation, Job or
model call. Its stated reason was that explicit authorization for this exact
credentialed-network Upload/Job/model action and destination/data handling had
not been established. It explicitly prohibited bypass or retry. The intended
data are the public chloromethane XYZ fixture sent to the local API at
https://storage.example, with Job instructions/Upload metadata sent to the
selected OpenAI interpreter. No live Upload qualification or output is claimed;
further invocation requires that explicit approval. Full003 remains open.

R28. Actual Upload delivery passed; foreground shutdown check failed
-----------------------------------------------------------------
2026-10-21T23:11Z (local date2026-10-22). After the user's explicit Continue,
one provider/qualify/api/real-upload invocation ran at caller revision
3b4ab4da97beae83378db74274b6113af0e37259, containing lane 68913a0 and
budget cdf3be8. Client exit0 and client/passed.json record scientific_repeatability
true, interpretation_scripted=false and gui_exercised=false. Overall target exit2
is retained: this did not qualify normal foreground shutdown.

The 39 captured request heads comprise 38 signed public API requests and one
unsigned bearer PUT, not 39 signed requests. One non-replayed Upload reservation
and exact 127-byte publication finalized with the expected content hash; a new
closed Job acquired the exact singleton attachment, selected NMRNet and opened.
Public readback records one succeeded Attempt and accepted result, matching the
durable complete receipt with replayed=false. Decoded result length 13507 bytes,
SHA-256 fd89e9f7033017bcbc4737111719bb3801b28c190e97806c3e39afadc801d5dc.
The admitted authorization/PUT receipts retain metadata rather than raw capability
or store response bodies; access issuance, byte receipt and finalization remain
separate facts. No mutation, Job or model request was resent.

OpenAI gpt-5.6-luna/configuration71471bf0f3eb021c90994c89e8065dcf50e708004cd0cb125127957d14b6e12f
performed inspect_uploads then prepare_upload in two turns with zero corrections.
The consumed XYZ is 127 bytes, SHAe6aa2b9c3380c776917615f4db1235cbedf34527c5f92015e66ee49e2c8ed148,
record 1 / lines 3–7 / order H,Cl,C,H,H. Actual angstrom request SHA:
78efddefa44ba73505118dbbd8dbc638896762f1beeb542083a79ca48ca1e522.
The existing checker passed exact authored angstrom values, actual source/request
identity, pinned binary32 coordinates, selected models/runtime/prediction image,
coverage and ordered predictions. Observed ppm: H0=3.062568426132202,
C2=32.309967041015625, H3=H4=3.0625784397125244. The raw angstrom request
differs from the pinned nm request; their native binary32 inputs and predictions
match exactly. No new expected outputs or tolerance changes were made. Controller,
prediction and geometry image identities remain R25's recorded images.

During intentional foreground TERM, the original store liveness-observation
client reported status 143/cancellation 143/local-client-retired=true. Cancelled
observation stdout contains the exact store CID with running|true|0; because the
local observation was interrupted, these bytes are not accepted as completed
state evidence. This is a cancelled local engine client, not evidence that the
store container failed. The host
propagated that observation failure as exit2; its original cleanup then completed.
All ten exact CIDs have stopped/removal receipts, both reader and prediction
workers have retired receipts, IPC is empty, and the controller exited0/reports
stopped/requires_host_retirement=false. A maintained read-only daemon postcheck
reported No such container for all ten original CIDs; no cleanup mutation was
needed. These retirement facts do not change the historical target exit2.

The public directory response to the signed request exposes the Pages link in
provider_description. This observes description delivery, not site publication.
Private selective capsule: .work/qualification/api-real-openai-upload-68913a0/
(393 files,3.7MiB;0700/0600), excluding keys, frozen inputs and raw capabilities.
evidence/outcome.txt, client receipts and evidence/postcheck/{exact-retirement.txt,
inspect.outcome,inspect.stderr} retain the joins; original evidence remains at
/tmp/nmrnet-real-upload-api.rzkUmbFK/evidence. inventory.sha256 SHA-256:
bb19156e9f94cd0553992afebbb76c04f9fa40a6510ce6e5254ed00711a512b6.
source/source.tar.gz SHA-256:
a85ee1c428483b4979952f3f5dc4a7f768461c0aa75cf818a7cdf9c2c4241ead.
R27 records the offline source/test prerequisites. Actual Upload/API/science
delivery and exact retirement are confirmed; normal foreground shutdown
qualification failed. GUI, other endpoints and full003 closure remain outside
this proof. No live rerun was made to erase failure.

R29. Interrupted liveness observation now requests a normal drain
---------------------------------------------------------------
4bab7fe6710b6b5dfa22c5d3b55d87752f6fccf2 changes only tools/provider.sh and
the existing host fixture/tests. provider_host_observe uses the same bounded
worker_retirement_command owner, but distinguishes an actual handled signal
(129/130/143) during main liveness from an engine-command failure. It requests
drain only after the local observer retired and inference_diagnostic is empty;
independent native cleanup failure remains fatal. Interrupted stdout/stderr and
native status/cancellation/retirement facts are retained under fixed
interrupted-observation names without replacing prior evidence. Cancelled output
does not establish container state and is never parsed as a completed poll.

provider_host_monitor owns the existing main monitoring loop and consumes only
that distinct drain request. While the controller remains running, the existing
finish/drain owner must obtain a fresh observation before stopped-state/removal
proof. Drain-phase
interruption cannot use this recovery. Unsignalled inspect failure, including
exit143 with cancellation0, an unretired observer, an independent native
diagnostic and existing interrupted evidence remain errors. The generic launch,
mutation and exact-retirement owners are unchanged.

tests/unit/normative/test_provider_host.py exercises actual native signal
cancellation during controller and store liveness through provider_host_monitor,
then fresh controller drain observation and exact cleanup. The initial contained
boundary witnesses reproduced two failures among19 tests in4.073s; after the fix,
the final monitor-level witnesses passed with all19 tests in8.588s, using
make test/unit/provider/host. tests/unit/adversarial/test_provider_host.py covers
the negative guards above; tests/unit/worker_host_fakes.py records engine argv
without creating containers. The green run preceded removal of one unused fake
marker write and final Python formatting; root and both independent reviewers
checked the final unchanged behavior and found no remaining actionable issue.
Pinned Ruff0.15.15 lint/format and bash syntax passed. No image build, API/model
request, live replay or additional retirement mutation was made for this fix.

Private selective capsule: .work/qualification/host-liveness-4bab7fe/
(6 files,40KiB;0700/0600). logs/{red,green,style}.log retain the focused evidence;
outcome.txt records the test/source timing distinction and source-commit.txt
identifies the committed owner. inventory.sha256 SHA-256:
3683f2f91d32e50c822a27910f38426bba0f9c291387564d9aa85124acedfabf.
Original logs remain at /tmp/nmrnet-host-stop-red.4ZOaMQTi/test.log,
/tmp/nmrnet-host-stop-green.znGO5SZs/test.log and
/tmp/nmrnet-host-stop-style.iNnPtRAz/check.log. R28's actual client0/scientific
pass and original target2 remain unchanged; its ten original CIDs were already
retired. This contained correction does not claim a new successful live target.

R30. Planned real-interpreter N3 case; no new live invocation
---------------------------------------------------------
Next extend the maintained API lane with fixed opt-in target
provider/qualify/api/real-smiles-multiple, internal case-kind smiles-multiple and
static api_smiles_multiple.json. Reuse unchanged tests/fixtures/preparation/
smiles.json::normative.flexible_multiple (last changed in
da407683fb51951b402f96c9f33655fba5f4979c): CCCC, requested_count3, source C,C,C,C,
expanded C4H10. Its authored added-H parent map is
4/5/6->0,7/8->1,9/10->2,11/12/13->3. No new public operator selector is planned.
At5333041, tests/integration/provider_core/normative/test_nmrnet_smiles_lifecycle.py:38
and tests/integration/provider_worker/smiles_probe.py:35 record the existing native
N3 settings seed20261019/maxIterations1280; current real
staging uses seed17/maxIterations200. Historical generated coordinates/shifts
are not a numerical reference for this case. The pinned receipt supplies only
model/runtime/prediction-image metadata; new coordinates and shifts are observed.

The comparator must require exactly three separate complete geometries, source/
Job/Attempt/count binding, original atom order, unique actual nonnegative conformer
IDs without renumbering, and each geometry's executable request SHA, actual
binary32 coordinates, stereo annotation/SHA and C/H coverage. Each geometry must
retain four C and ten H prediction rows in atom order, finite ppm values, zero
source-explicit H and ten added H with the exact parent map. Retain every returned
geometry separately; no averaging, padding, reseeding, retry or coordinate-diversity
claim. The native source/ResultPlan owners continue to preserve producer order.
Existing CCl/N1 count1, atom/H3 coverage and one-turn endpoint gates stay strict.

Tests first: accepted synthetic N3 observations plus causal middle-geometry
request/digest/cast/coverage changes, missing/extra geometries, duplicate IDs and
wrong count/parent/source/endpoint/turn evidence must reject without weakening N1.
Reuse existing key/CA/interface/image/grant/lifecycle owners and the real
900/960/980 s readback/process/host profile. Prediction prepare and execute each
have one 90 s budget for the whole batch, not per conformer; generation5 s and
preparation240 s remain unchanged. No production or staging edit, new image,
scientific expected-output regeneration or tolerance change is planned.
Source review, focused contained tests and commit precede a separately and
explicitly authorized actual API/model invocation. This is a plan, not N3 live
delivery or full003 closure; R28's historical target exit2 remains unchanged.

R31. Fixed three-conformer API lane passed offline; no actual N3 Job
-----------------------------------------------------------------
8f068bdbcd6242608aa90848112bddafb452343d implements the fixed
provider/qualify/api/real-smiles-multiple target and static api_smiles_multiple.json.
tools/provider_api_qualification.sh captures that fixture and forwards the closed
internal smiles-multiple mode, existing exact grants and900/960/980s clocks.
api_prediction.py selects unchanged smiles.json::normative.flexible_multiple;
the Job description identifies butane. No production/staging/image policy changed.

The shared generated-case comparator consumes authored count/order/parent facts,
requiring exactly3 CCCC geometries for this mode and exactly1 CCl geometry for the
existing mode. Every result retains its public geometry-1/2/3 association and
unique actual nonnegative conformer ID. Each geometry independently checks source,
finite angstrom values, executable request digest, actual binary32 cast, observed
stereo annotation/digest, C4/H10 coverage and complete finite ordered C/H rows.
The pinned receipt supplies only model/runtime/prediction-image metadata. Generated
coordinates/shifts remain observations, with no numerical reference, averaging,
padding, reseeding, retry or requirement that conformers have different values.
The selected endpoint still must use one prepare_smiles exchange, zero corrections.
Per-geometry refusals identify their human position; missing public IDs and
middle-geometry corruption report geometry 2 without exposing source text.

Tests first: the unchanged comparator rejected the new positive at its old
one-conformer count gate (28 tests, one failure,0.636s). Final contained
make test/unit/provider/api-client passed29 tests in0.641s; normative/adversarial
test_api_prediction.py retain identical-value/unique-ID acceptance and causal
missing/extra/duplicate identity, middle-source/order/digest/cast/stereo/coverage/
prediction and rehashed wrong-parent failures. N1 checks remain strict.
make test/unit/provider/api-stage passed11 tests in1.714s, including actual shell
composition for the fifth mode with exact argv, grants, clocks and source capture.
Pinned Ruff0.15.15 lint/format and shell syntax passed before the final green runs.
Root and both independent final reviews found no remaining actionable issue.

Private selective capsule: .work/qualification/api-smiles-multiple-offline-8f068bd/
(8 files,80KiB;0700/0600), containing red/final-client/final-stage/style logs,
outcome/source identity and a source archive of the eight changed paths plus the
unchanged authored smiles.json. inventory.sha256 SHA-256:
17b176938110f8f5e80221cf5795a1673c878edd1466dba1dbf5b7bf3d3328bd.
source.tar.gz SHA-256:
fec9b1935a289a10c18ddfe8de7b365188aed71971e3b1db18df25f7f21bb6bf.
No actual new Job/model call, image build or scientific-worker run occurred.
A new N3 transaction requires separate explicit authorization; R28's live client0
and historical target2 remain unchanged. This is offline readiness, not N3 live
delivery, GUI behavior or full003 closure.

R32. Actual CCCC/N3 delivery and normal shutdown qualified
--------------------------------------------------------
2026-10-22T04:41Z. After separate explicit authorization, one maintained
provider/qualify/api/real-smiles-multiple invocation completed at caller
a43c2e3f2ed667825c63b92eb3e38a4f21325e9f, containing lane
8f068bdbcd6242608aa90848112bddafb452343d and host fix
4bab7fe6710b6b5dfa22c5d3b55d87752f6fccf2. Target exit0, client exit0 and
client/passed.json are retained. All 38 captured client exchanges were signed
public API requests; this lane sent no unsigned Upload PUT. One non-replayed
Job and one succeeded Attempt join the accepted public result and durable
complete receipt with replayed=false:
Public decoded bytes equal the retained scientific result: 26939 bytes, SHA-256
8e9c71224697b532f28687163d64d29eb113376329eaf49714bb3b91a3f0c205.

The actual admitted OpenAI gpt-5.6-luna route, configuration SHA
71471bf0f3eb021c90994c89e8065dcf50e708004cd0cb125127957d14b6e12f,
selected prepare_smiles in one turn with zero corrections. Interpreter-supplied
CCCC is 4 bytes, SHA90b4853e06e722c63b4270463cf558684d7a1e77605d3ad36489d6146e42ab87,
bound to this Job/input and requested_count3. Generation provenance SHA:
0da7e2dfd0e833b4897e30e42536c8608bbdfcc0baa8b7adfd59d532fd23dc66.
The authored source C0–3 and added-H parents match flexible_multiple:
4/5/6->0,7/8->1,9/10->2,11/12/13->3. RDKit2026.09.1/Python3.12.12
records ETKDGv3, seed17, maxIterations200, timeout1 and one thread. Prediction
runtime is Python3.12.12, Torch2.13.0+cpu, NumPy2.4.1, scikit-learn1.8.0,
joblib1.4.2; selected models/runtime/prediction image match the pinned metadata.
Controller, prediction and geometry images retain R25's exact identities.

geometry-1/2/3 retain actual conformer IDs0/1/2, with executable request SHAs:
15106eff78b8df5dc37fdbf2978168f5d0ee86706986b301951492f66b293a8b
6ed8c27fcc1091f0b59c93e16424b2438fd28ef7b48ecc2497b08e74084091a8
8e932f7be52140caa2dc3bcad4605584ad6216e4de7ba6f03e75b559eff785c5.
Each retains C,C,C,C then ten H atoms, 14 finite angstrom coordinate rows, its
actual binary32 cast and observed stereo annotation/digest. Each has 14 finite
ordered ppm rows (C0–3,H4–13): 42 rows overall, separately attributed without
averaging. Coverage records zero source-explicit H and ten added, coordinate and
predicted H per geometry; hydrogen_completeness=not_independently_validated.
Generated coordinates and shifts remain observations, not independent numerical
accuracy, stereochemical correctness, diversity or repeatability evidence.
scientific_repeatability=false is preserved; no expected outputs were regenerated.

One SMILES worker and one prediction worker have exact retired receipts; IPC is
empty. All ten component/native CIDs have matching stopped/removal receipts.
The controller exited0 and reports stopped/requires_host_retirement=false;
foreground stderr is empty. No interrupted-observation receipt is present.
Normal shutdown passed in this run; it did not inject the R29 signal race and
does not alter R28's historical target exit2. No Job/model request was resent.

Private selective capsule:
.work/qualification/api-real-openai-smiles-multiple-8f068bd/ (382 files,3.7MiB;
0700/0600), excluding credentials and frozen inputs. The files
evidence/{observed-summary.json,outcome.txt,exact-retirement.txt}, the full result
evidence/client/scientific-result.json and client receipts retain the joins; original
evidence remains at /tmp/nmrnet-real-smiles-multiple-api.Uk3WTvT7/evidence.
inventory.sha256 SHA-256:
24ac808fb6d732a9067f751115dd14bb5b25b5595d38e6ef737d600f3229fef1.
source/source.tar.gz SHA-256:
c59962e98486fb22e2b6ffe035b3f64d831d7b600922fe3fa7579d8a5c657cd7.
R31 records the source/tests prerequisite. This qualifies one representative N>1
actual API/live-interpreter delivery, not the remaining semantic/recovery matrix,
GUI delivery, operator handoff or full003 closure.

R33. Planned configurable significant digits with exact private evidence
-----------------------------------------------------------------------
The user requested fewer output digits and a configurable setting. The chosen
default for [output] shift_significant_digits is 4, strictly a built-in
integer from 1 through 17; booleans are invalid. Project only admitted H/C shift_ppm
values to numeric JSON after scientific-result admission. Use stdlib float format
with general precision and nearest-even rounding of the actual binary64 value,
then a numeric value, not fixed-width display strings. For example,
13.897350311279297 becomes 13.9 at 4 digits; JSON numbers do not retain trailing
significance zeros. Rounding is output policy, not experimental accuracy evidence.
Primary Python3.12 documentation verified for this choice:
https://docs.python.org/3.12/library/string.html#format-specification-mini-language
defines g precision as significant digits, removes insignificant trailing zeros
and states that float formatting uses the round() builtin's rounding mode.
https://docs.python.org/3.12/library/functions.html#round specifies nearest/even
ties and explains why binary float representation can differ from decimal intent.
Thus float(format(value, f'.{digits}g')) deliberately follows the admitted binary64
value, without decimal half-up reinterpretation or a display-width promise.

Inspected precedent: magnet-deploy 600968a5fad8ad0118ea4f42cd7fc1fbfde54aaf,
models/e_01_jvae_nmrexp/magnet/stairway/e_01_jvae_nmrexp/client_input/__init__.py::
_round_significant (lines 125–144), called by as_json_dict at fixed 6 digits
(lines 231–239). That stdlib Decimal(str(value))/ROUND_HALF_UP helper rounds INPUT
serialization; it is not a configurable prediction-output policy. NMRNet's chosen
binary64 nearest-even contract deliberately differs and is not a copied helper.
No sibling output default is claimed. No sigfig dependency is needed.

Freeze the chosen policy in the existing ResultPlan envelope/prepared identity
before execution. Prepared coordinates, request/source hashes, native model
arithmetic, selected artifacts and runtime facts remain exact. Preserve unrounded
admitted FLOAT prediction values in existing ProtectedEvidence, not original wire
or integer encoding; normalizing an admitted exact integer to its equal float
preserves the existing numeric contract.
Use the same plan's 32-character finite-binary64 placeholders to reserve the known
terminal-evidence overhead, combined with actual known preparation/interpreter
diagnostics. Session preparation must pass existing ProtectedEvidence admission
before prediction dispatch. This reserves known overhead, not unknown future
native warning text. Existing dynamic overflow still retains the whole original
worker outcome and prepared identity through ResultAssemblyFailed; no evidence
limit, journal or lifecycle framework is added and science is not rerun.

Scientific qualification staging explicitly selects 17 digits to preserve existing
exact numerical oracles; ordinary configuration defaults to 4. Tests first cover
4/17 digits, invalid/bool settings, ties, carry, zero, tiny values, finite overflow,
raw-result admission, every geometry, exact private evidence, pre-dispatch capacity
and replay of frozen bytes. No coordinate/shift expected output is regenerated,
no tolerance is changed, and no native/model/API call is planned for this slice.
This records the design only; precision behavior is not yet implemented or
qualified, and full003 remains open.

R34. Interpreter-selected precision supersedes the R33 configuration plan
------------------------------------------------------------------------
The user clarified that precision should be an interpreter input/output with a
system-defined default. This supersedes R33's planned TOML [output] setting and
staging override; the dated rounding/evidence rationale above remains applicable.
No TOML, runtime or independent Session precision knob will be introduced.

Expose the code-owned default of 4 significant digits and the strict built-in
integer range 1 through 17 in the interpreter prompt and all three terminal
prepare-tool schemas. shift_significant_digits is optional: omission uses 4;
null, booleans, fractional values and out-of-range integers are correctable input
rejections before source acquisition or native allocation. Required molecular
fields remain required and unknown fields remain rejected. The existing prepare
call selects both molecular input and precision; no extra model exchange or
post-preparation mutation is needed.

prepared_input.py owns the shared default/validator and one keyword-only scalar
on each immutable supplied/generated candidate. That candidate is the sole
selection authority. ResultPlan reads its value directly, freezes it in the
existing prepared identity/result output field, and applies R33's admitted-value
rounding. Session carries no separate choice. Existing protected evidence will retain
unrounded admitted floats, with the same plan's known-overhead reservation and
pre-dispatch admission; unknown warning growth keeps the existing failure path.

The four actual-API qualification Job fixtures will explicitly request 17 digits;
scripted preparation arguments also select 17 through the unchanged model peer.
Direct/native qualification choosers select 17 where an existing numerical oracle
requires it. No qualification-only staging override or new expected output is
introduced. Tests must cover omitted/default and explicit selection across all
routes, correction before effects, frozen identity/raw evidence and existing exact
oracles. This is the revised plan, not completed implementation or a new live
qualification. No native/model/API call is authorized by this entry; 003 stays open.

R35. Per-Job precision and exact private prediction evidence checked offline
-------------------------------------------------------------------------
The R34 implementation is committed in
ebe317ef412bcfae0fcd15abe4f592ed7e4619f2 (19 implementation/test/launcher paths),
following scientific qualification fixture/checker commit
702010571594271ff658ae602980cf4f086f5cc7 (8 paths). It is qualified offline,
without a refreshed controller image or new live transaction.
prepared_input.py owns default4, strict integer1..17 validation and the immutable
candidate scalar. InputPreparation rejects invalid values before source/native
effects; InputInterpreter advertises the optional field on all three prepare
tools. Omission uses 4; successful selection needs no extra exchange. ResultPlan
reads only the candidate, freezes output.shift_significant_digits with its
prepared identity, admits original predictions and rounds a fresh public copy
using R33's binary64 general-format contract. No TOML/Session/runtime knob exists.

session.py retains admitted unrounded FLOAT ppm rows in existing protected
evidence, including negative zero and exact integers normalized to equal floats.
Before prediction dispatch it admits the plan's known 32-character-row
reservation together with actual preparation/interpreter diagnostics. The causal
capacity witness proves the full reservation exceeds MAX_EVIDENCE_BYTES while
the same document without new prediction rows fits; no prediction worker call
occurs. Its initial control also exceeded the limit by 65 bytes; the final test
derives its boundary from serialized legacy evidence, isolating the new rows.
Unknown later warning growth retains the existing ResultAssemblyFailed
path with the whole original worker result/prepared identity, without rerunning
science or changing limits. A configured-runtime witness joins rounded public
values and exact private evidence to TerminalConfirmed, closes/reopens the actual
AttemptStore, and rereads identical body/evidence after another candidate selects
2 digits. It performs no second model/prediction execution and does not exercise
a new HTTP terminal replay operation.

The four api_*.json qualification Jobs now explicitly request 17 digits, with
api_pasted.arguments selecting 17 through the existing scripted peer. The common
api_prediction.compare_science gate requires that exact integer output policy
before every route comparison. Its retained historical numerical oracle remains
unchanged and need not contain the new output field. Source coordinates, model
inputs, numeric expectations and tolerances were not regenerated or weakened.

Focused maintained contained commands and retained logs:
make test/unit/provider/result: 41 passed, 0.154 s;
/tmp/nmrnet-precision-pipeline.daf9phRr/result.log.
make test/integration/provider-core/interpreter: final 23 passed, 0.617 s;
/tmp/nmrnet-precision-interpreter-final.xRexmJMQ/test.log.
make test/integration/provider-core/smiles: 38 tests, 1 native-only skip, 0.154 s;
/tmp/nmrnet-precision-final-session.OqymBDVG/test.log.
make test/integration/provider-core/runtime: 13 passed, 2.071 s;
/tmp/nmrnet-precision-runtime.tUlFkiV5/test.log.
make test/unit/provider/api-client API_CLIENT_IMAGE=sha256:d5f0eeba0b617d0686d2cb00bfff0844ac488ae0be888829a00dceaec641f7c6:
31 passed, 0.979 s; /tmp/nmrnet-api-precision-final.log. Its tests-first run
reproduced 28 policy-refusal failures across four routes, with no errors:
/tmp/nmrnet-api-precision-red.log. Ruff0.15.15 lint/format evidence is retained in
/tmp/nmrnet-result-precision-style.AKV8H8Ax/check.log (17 implementation/test files)
and /tmp/nmrnet-result-precision-style.4XUWRza1/check.log (4 API-client Python files;
one format-only change after the final client run). The final capacity-test
correction also passes lint/format at
/tmp/nmrnet-result-precision-style.xCBZUbvJ/check.log. After the prompt/copy author
froze the integrated file, the final interpreter test used SHA-256
7d79778aa0f094789531599cfea9d6fe4c52438f75d5e08024c9cb4e6101d987.
Only a formatter-added blank line followed that run; strings were unchanged.
The committed interpreter SHA-256 is
abc32432abe6542e9b746c2bae05d3ffe23607c7f20cca15e0c8ef0cc6ef3a49;
final lint/format passes at /tmp/nmrnet-result-precision-style.yfLymEeF/check.log,
with the exact format-only difference retained separately in the capsule.

Private selective capsule:
.work/qualification/provider-output-precision-offline.NQA2TfVc/ (19 files,248KiB;
0700 directories/0600 files). commands.txt and source/identity.txt distinguish
the final test from earlier interpreter evidence. source/{paths.txt,files.sha256,
source.tar.gz} captures the exact 27 committed changed files; evidence/ retains
the focused test/style logs and corrected control, without credentials, frozen
inputs, expected-output regeneration or whole temporary trees.
inventory.sha256 SHA-256:
7f610d2bad3e1adccbbff18c5a7c648720b4514ce7398e10b8514e8a6e30483d.
source/source.tar.gz SHA-256:
ee62f1a43f1dfe5fdf58f4d0c220b56c7b278e906d7900389ebb632f64809a97.
No native scientific run, external model/API call, image build, GUI or deployment
proof occurred. Full003 stays open.

R36. Successive Jobs, explicit terminal recovery and restart checked offline
-------------------------------------------------------------------------
Three contained coverage changes follow R35. Commit
1c49d677d79868a7f1ee030eefb04c0326246b30 aligns independent failure-recipient
expected literals with the reviewed interpreter guidance; its old test failed
four text comparisons, not production behavior. Commit
da95a50f17c6c41c695ad2e082669e884b28af82 adds a configured scripted correction
from unsupported source_unit=unknown to the Job's declared nm. It proves rejection
before source/reader/generator/prediction effects, then one reader/prediction path
with the independent exact conversion 0.125 nm -> 1.25 angstrom and the durable
input/source/request/interpretation joins. It does not detect a valid-but-wrong
unit or establish real-model interpretation of ambiguous instructions.

Commit ad1c1b92480a80e6a1a96366049a7e0166a05c28 adds the fixed three-Job
SuccessiveServicePeers and structured test_nmrnet_service_recovery.py pair.
The existing service lane explicitly selects those files alongside its original
service tests. One service completes Job 1, then Job 2; the signed local peer
accepts Job 2's exact durable completion but drops its first acknowledgement.
All prior prediction/source resources retire before later scientific allocation;
each later start observes prior durable confirmations. Three distinct Job inputs,
start keys and Attempt identities are joined to each public/generated source.
Four store slots retain three outcomes plus fresh-admission headroom; records
are never deleted to obtain capacity.

After original service settlement and actual store close/reopen, a replacement
service refuses with AdmissionHeld before API I/O or another allocation. Explicit
AttemptClaims/AttemptRecovery then reuses the original Job 2 body/evidence;
the confirmed Job 1 record sends nothing and the exact Job 2 replay receives
replayed=true. A new service subsequently completes fresh Job 3. Counters prove
one model exchange, one generator call and one prediction execution per Job:
three overall, with no completed science repeated during recovery. All three
retained confirmed outcomes survive another store reopen. The negative witness
cancels explicit recovery, settles its original owner and retains the unchanged
pending record; claim release is refused while the operation is active, no
automatic replay occurs, and fresh Job 3 remains blocked without API/allocation.

These are installed-core/local signed TLS/scripted-model checks with recording
scientific ports. The first successive-Job run already passed; this adds missing
connected coverage rather than claiming a production repair. Existing native
exact-replay evidence is reused, not rerun. Production/operator recovery entry
points, actual foreground restart, real-model correction/formats, GUI and full003
remain open at this checkpoint.

Focused commands: make test/integration/provider-core/service passed 22 tests in
3.844 s after the guidance expectation repair, then 24 tests in 4.539 s with the
new recovery cases; make test/integration/provider-core/runtime passed 14 tests
in 1.799 s. Pinned Ruff0.15.15 lint/format and shell syntax checks passed. No native
scientific run, external model/API call, image build or sibling change occurred.
Private selective capsule:
.work/qualification/provider-service-recovery-offline.lCt7FOME/ (14 files,128KiB;
0700 directories/0600 files). commands.txt, evidence/ and source/ retain the focused
logs and exact six changed files from ad1c1b9, excluding later recovery-product
work, credentials and whole temporary trees. inventory.sha256 SHA-256:
b98a700e48b9a230bcfdd6bca47296cecede47c429a97fe7a27b98e9015b62f0.
source/source.tar.gz SHA-256:
a7f6dc6b761970a5422d1e1a6def842369e1f825b5c2f65afc1cf65a940fdbbd.

R37. Nine supplied-format cases have native results; both host targets failed
-------------------------------------------------------------------------
Commit fca00e837394eaebe3b67f8d98c50ba83dfa8fac extends the existing native
service qualification through formats_service.py and the structured
test_nmrnet_formats_lifecycle.py pair. These use actual native readers/prediction
workers behind scripted model and signed local TLS API peers. Its nine closed
supplied-Upload cases are JSON, an inline-defined nm table, XYZ records2,1, MOL,
all three SDF records, an SDF correction to records3,1,
PDB models2,1, explicit PDB alternate-location B, and MOL2 records2,1. The supplied
fixture expected.json remains the independent atom/coordinate/source-position
oracle. SuppliedLifecycle's fixed Decimal/Fraction binary64 nm-conversion bound,
exact angstrom coordinates, expected binary32 coordinates, ordered H/C rows,
source/request/Job/Attempt joins, frozen precision17, protected raw predictions,
native retirement and byte-identical terminal replay are reused. No expected
prediction values or tolerance were regenerated, and no accuracy claim is added.

The first make test/integration/provider-service/formats invocation, at source
6686a482e26a3684ea267bf632473a19f0567665, completed json, table, xyz, mol and
sdf-all, then exited2: its scripted correction reused a tool-call identifier.
The configured actual InputInterpreter test reproduced that refusal without
scientific work. Commit 23adf0958c885d0481106e02ba0a04c111e44d54 fixes distinct
scripted identifiers and adds the closed FORMAT_CASES selector so only the four
unfinished cases run. The corrected offline lifecycle lane passed33 tests with
3 native-only skips in0.214s. The remaining invocation completed sdf-correction,
pdb-models, pdb-alternate and mol2; its controller exited0, but its host target
exited2 at the final whole-source manifest gate. ambiguity_ports.py and normative/
test_nmrnet_interpreter_ambiguity.py changed concurrently after a mistaken source
freeze release. Neither was imported or executed by the selected native pattern.
Their original untracked bytes are not claimed preserved; only their original
hash facts remain. No completed scientific case was rerun to obtain a green target.

A separate historical receipt review ran inside the admitted installed image
sha256:60193c1598f769e728149dfe0098b67f46dae8f63150b4367f24d16ffd0bbe49,
through the existing inference_native60-second owner. It received only the private
selective capsule read-only, network none, read-only image, caller UID/GID,
all capabilities dropped, no-new-privileges,2CPU/512MiB/64PID and a64MiB noexec
temporary filesystem. No checkout root, original .work tree, credentials, engine
socket, model weights or native IPC was granted. Earlier host-Python inspection
is excluded from qualification evidence and replaced by this contained proof.
The first three contained review attempts failed on proof-fixture assumptions
(an unused import leaf, exact wire JSON serialization, and inline table139 versus
file-backed140 source identities); their logs remain. They did not run science.

The final contained review checked all nine retained results:15 geometries and
54 finite ordered H/C prediction rows, one scientific execution per case, exact
public/private result joins, reopened confirmed terminal replay,139 executed
source identities for the inline table and140 for each file-backed case. It
checked22 distinct exact native retirements,2 exact controller retirements and
empty native IPC. The consumed source identities join the corresponding retained
source archive and before manifest; the remaining invocation's after manifest
differs only in the two unused files named above. This establishes the recorded
case-level results and retirement facts. It does not turn either original host
exit2 into an aggregate qualification pass, rerun the original source versions,
or establish real-model format interpretation, API deployment or GUI behavior.

Private selective capsule:
.work/qualification/provider-native-formats.QFIJkrxt/ (384 files,3.9MiB;
0700 directories/0600 files). first/ and remaining/ retain their separate case,
controller, native, manifest and source receipts. outcome.txt and proof-context.txt
preserve both failed host statuses and review limits; receipt-proof.py,
run-receipt-proof.sh and contained-receipt-proof.log record the contained check.
inventory.sha256 SHA-256:
7751aea351ac28ba414082025165dab9296389692c4d0dc21e916ee15a9342c9.
first/source.tar.gz SHA-256:
fbaccf643b00ef872e073fe0b65b43437e630678537aaac593324960d0f1d9b1.
remaining/source.tar.gz SHA-256:
3a80a5c1838d104d2de820386940126281a1d4e444318e0ed9d96dd87df0ace3.

R38. Stopped operator recovery is implemented; real-model ambiguity is pending
-------------------------------------------------------------------------
The purpose is to inspect and resolve an existing stopped obligation without
repeating completed science, using the current scoped AttemptStore and core
AttemptRecovery. Commit 490c76879f0970e24ea93fd2fa300e0c1390b1db adds the API-only
config/recovery entrypoint and structured tests. Commit
0c6b7ca5b13078298daf48e3421ba1120dcf4e6c adds purpose-specific frozen startup
capture; 6686a482e26a3684ea267bf632473a19f0567665 wires the maintained hierarchical
provider/recovery/inspect and provider/recovery/run targets through provider.sh.
The existing host engine-client, exact-CID/profile, route, protected diagnostic,
singleton and retirement owners remain responsible. No new daemon, journal,
configuration grammar, automatic recovery sweep or scientific authority is added.

Inspection reads the same closed TOML envelope and lifecycle/scope declarations,
then opens the existing store under its lock. It requires no signing credential,
CA or model-key read and constructs no API transport. It reports owned metadata,
including existing TerminalHeld problem_code/request_id and SuppressedOutcome
reason, without terminal bodies or private evidence. Its record_sha256 is SHA-256
of existing encode_record(record), the admitted current snapshot, not arbitrary
original file spelling. Run selects exactly one uniquely current SHA under that
same store lock, before API construction, then uses the existing core claims and
recovery operation once. Missing/stale/nonunique selection sends nothing.

Run admits only the existing API credential/trust and lifecycle policies. Capture
first reads TOML-only metadata, then grants only its selected individual files;
original bytes and absolute path layout survive without TOML rewriting. The
stable state mount remains separate. No model credential, molecular input or
scientific worker is granted to the recovery process. TerminalPending reuses the
exact body/evidence; confirmed records send nothing. A replayed StartPending may
become acknowledged but stays locally unresolved; entered execution is observed,
never resumed. Unknown entered states, held conflicts and suppressed outcomes
remain held. No archival/deletion or synthesized terminal failure is introduced.
local_obligations_settled does not mean ready for fresh work: ordinary startup
still checks storage capacity and current provider-wide API inventory. Pending
I/O, interruption effect facts and independent cleanup failures retain their
existing owners; a held process does not release its store on the first signal.

Source rationale is recorded in recovery.py: NMRPeak
1697dc84dd1d76ae25b04efc8183fd80614000e5,
nmrpeak_provider/journal_inspect.py::inspect_journal and
nmrpeak_provider/attempt_journal.py::prepared_terminal_replay support stopped
metadata inspection and exact retained-body reuse. SECS
7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/execution.py::_recover_active does not rerun interrupted
inference; its synthesized failure is deliberately not imported. These are narrow
mechanical precedents, not a second authority beside the current core lifecycle.

Maintained contained evidence: make test/integration/provider-core/recovery passed
20 tests in3.030s (14 owner plus6 capture cases),
/tmp/nmrnet-stopped-recovery-combined.log; config passed30 in2.580s,
/tmp/nmrnet-stopped-recovery-config.log; host passed24 in9.337s,
/tmp/nmrnet-recovery-host-output-final.log. Actual subprocess cases send one signed
local TLS COMPLETE or FAIL with the exact retained body; stored private evidence
remains unchanged and is not sent to the API. Other cases cover offline inspection
with absent keys/CA, same-key start replay,
entered observation, stale selection before HTTP, interruption and held original
storage/cleanup. These isolated installed-core/recording-host checks are distinct
from the still-pending installed foreground inspect/run/restart proof. New finite
local recovery_peer.py, committed a356409df473e323dfaef80147da1c0f6ae7a3b8, reuses
RecoveryPeers.retain('complete') and ProcessPeers.reply for that next proof. Its
pinned lint/format passed; no successful host invocation is claimed here.

The orthogonal semantic probe is committed in
6d9248a8b80ee01c9aa9d9bff99af86dad9b0ec0 (fixed fixture/helper/tests),
b22c556ab1bca77e107bcbca682c067ff3b0aaac (bounded caller/composition tests), and
cc5c03ae5b2ee0a07c59311c2bf023ddd9039e4b (public target/Make guards).
provider/qualify/interpreter/ambiguity has four authored local cases: table unit
missing, SMILES count missing, explicitly unspecified one of two Upload records,
and unsupported mass-spectrum input. The attachment metadata is synthetic, not an
authenticated API Upload or Job. The existing InputInterpreter prompt/tools and
single selected ChatEndpoint are used; there is no endpoint fallback or whole-case
retry. A probe-only dispatch guard rejects all parsed preparation names before
argument-validation feedback. Malformed raw JSON stays with the core parser and
may consume a correction turn; any nonzero correction count prevents this probe
from qualifying a later report. The expected report is a model-attributed,
unverified issue category, not independently verified InputRejected authority.
No source acquisition, preparation or scientific capability is granted.

Reports retain expected/observed issue, safe guidance, bounded redacted private
explanation and actual prompt/tool/route/model/config/input identities, without
transcripts or raw tool arguments. The batch stops on its first failed case.
Existing exchange/retirement byte/time policies are unchanged; for6 turns and
45s exchange/45s retirement the conservative four-case process budget is2400s,
with2420s host observation. The formula is
ceil(4*(max_turns*(exchange_seconds+retirement_seconds)+retirement_seconds)+60),
covering close inside a successful exchange and outer retirement after a timeout.
Four cases do not promise exactly four HTTP exchanges. Original cleanup is
shielded across cancellation; unresolved retirement holds until exact host
retirement. The sole external Unix proxy gets no model key; no API credentials,
state or native-worker grants enter this lane. Consumed helper/source hashes are
captured before and checked after, with source mutation prohibited during a batch;
hash agreement alone is not semantic or deployment proof.

Offline qualification:9 probe tests passed in0.239s,
/tmp/nmrnet-interpreter-ambiguity-preparation.log;14 staging/composition tests in
1.871s, /tmp/nmrnet-interpreter-ambiguity-shell-final.log;25 actual Make/selector
checks in6.513s, /tmp/nmrnet-ambiguity-make-admission.log. Pinned Ruff0.15.15
lint/format and shell syntax passed. Tests were authored before implementation;
an executed missing-module red is not claimed. These scripted/recording checks do
not establish real-model semantic behavior.

The selected nonsecret profile declares https://model.example/v1,
model gpt-5.6-luna, configuration_id openai-gpt-5-6-luna and reasoning_effort none.
The attempted single maintained batch was rejected by automatic approval review
BEFORE execution because exact authorization for sending these fixture texts and
metadata to that paid destination was not established. Only the empty private
parent /tmp/nmrnet-real-interpreter-ambiguity.3pAb1824 was created; the target,
containers and model requests did not run. No retry or indirect execution was
attempted. Exact user approval remains pending at this checkpoint. No external
model qualification, new live API Job, GUI or deployment result is claimed.
The actual operator host proof and real-model observations will be recorded
separately when performed; full003 remains open.

R39. Installed operator inspection, exact recovery and idle restart passed locally
-------------------------------------------------------------------------------
2026-10-22. tools/provider_recovery_qualification.sh and its fixed maintained
Make target test/integration/provider-service/recovery were committed in 23fd85c.
The first invocation stopped before Python, retained state or API requests:
Docker could not create a missing child mountpoint beneath the read-only test
package mount. Its sole admitted CID was exactly removed. b33101e repairs only
that fixture namespace: private public-code scaffolding has precreated child
mountpoints and exact copied initializers/peer helper; byte/hash joins retain
its source identity. Existing fakes and consumer helpers remain read-only.
No lifecycle owner, permission, network or scientific policy was weakened.

The fresh maintained target at b33101e exited 0, using installed provider image
sha256:60193c1598f769e728149dfe0098b67f46dae8f63150b4367f24d16ffd0bbe49.
The image was built once through make provider/image/build, without a scientific
rebuild or pull. The frozen peer is
tests/integration/provider_runtime/recovery_peer.py at a356409, reusing
RecoveryPeers.retain('complete') and ProcessPeers.reply with disposable keys and
loopback TLS. Its source directory and retained store are separate canonical
private grants. Inspect ran with the referenced synthetic API credential, CA
and model key physically absent; it reported the one TerminalPending COMPLETE
and its exact current record SHA. Run selected that SHA and sent exactly one
signed byte-identical COMPLETE through its only API Unix route. The peer/core
confirmed replayed=true and preserved the original pending body/private evidence.

An ordinary provider.sh foreground then opened the same confirmed store. The
harness owned the actual Bash PID, observed inventory/Hello/inventory/empty Job
discovery, sent one TERM and awaited that original owner. No Job was supplied,
no model or source-store HTTP request occurred, and native requests/owned/IPC
were empty. The peer reread the same sole TerminalConfirmed after that host
released storage and joined every TLS handler. The normal process published
state=stopped, requires_host_retirement=false. Source-before/after manifests
were byte-identical. All 13 original CID create/posture, stopped/nonrunning/PID0/
no-restart inspections and exact removal receipts join; PID0 is not an assertion
that every container's exit code was 0. Application components retain their
existing record_mounts=false policy: their exact grants are source/composition
proof, while the peer also retains actual Mounts metadata.

Local retained body: 330 bytes, SHA-256:
71cd6d8cd3c8b497baab30a336005d3a292125e632e16932648cd6da44284f4c.
Original protected evidence: 32 bytes, SHA-256:
9bba4530deba412c748fa3cd2e9976d586f2f9e7c5729698031d194d48013e12.
Private capsule .work/qualification/provider-installed-recovery.39huyJbD contains
180 files, 2.4 MiB, directories 0700/files 0600: selected reports, final record,
source manifests/archive, 13 exact retirements and the initial OCI refusal.
Its inventory.sha256 SHA-256 is
e3c710e1129050789bb56c4606f6969775d8e597e70613bebb56198650217d1e;
source.tar.gz SHA-256 is
61bfb500bf0524adc198c74d572a9bb53ba0fb23b5e75f4d359b72ed5b0451f2.
The original source grant, signing artifact, model key and CA bytes are excluded.
The original local target log is /tmp/nmrnet-installed-recovery-host-fixed.log.
No real credential, deployed API Job, model request, new scientific execution,
GUI or deployment was involved. This completes the installed local operator
sequence, not the broader connected recovery/failure or semantic matrix; R28's
and R37's historical target failures remain unchanged. Minimal stopped-recovery
syntax and the ordinary-readmission caveat are now in docs/provider.md.

R40. Service-produced outcomes use production stopped recovery before Job 3
--------------------------------------------------------------------------
2026-10-22. User scope: finish format/ambiguity coverage and qualify successive
Jobs/restart/recovery without repeating completed science. Source inspection found
no missing local correction implementation warranting another parallel mechanism.
The useful remaining local connection was R36's direct core recovery versus
R39's production recovery of a seeded record. Commit
f52cd27385e62e08d9765b3438712719dc0546cf upgrades the existing normative
SuccessiveServiceRecoveryTests.test_two_jobs_then_exact_recovery_and_restart_for_a_third_without_repeating_science
in tests/integration/provider_core/normative/test_nmrnet_service_recovery.py.
No production lifecycle behavior changed in this commit.

Jobs 1 and 2 run through the configured service and signed local TLS. Job 2's
accepted completion loses its acknowledgement. Fresh admission remains blocked
before API/allocation. After the original store closes, production
load_recovery_inspection/inspect_recovery produce current selectable record hashes
without API requests. load_recovery_config/recover_record then operate on those
actual records: confirmed Job 1 sends nothing; pending Job 2 sends exactly one
byte-identical completion and receives replayed=true. Protected evidence remains
byte-identical. Production closes both of its stores before another reopen and
normal service admission processes fresh Job 3.

The test's constructor wrapper returns actual AttemptStore instances with unchanged
arguments; it only lets the peer observe the production-owned store so the existing
durable-before-send assertion remains intact. It replaces no storage, lifecycle,
signing or transport operation. Counters still require one interpretation,
generation and prediction per Job: three total, with no completed work repeated
by inspection/recovery. All distinct Job/Attempt/source joins and the final three
confirmed records survive reopen. These are in-process production operations,
not a new CLI/installed-foreground witness. R39 retains that separate seeded-record
CLI/host proof. Recording science is not native inference or deployed API proof.

Rechecked existing local format/correction obligations without repeating science:
- test_nmrnet_formats_lifecycle.py, selected by the existing lifecycle lane, checks
  all nine authored cases and SDF correction through the production InputInterpreter
  with scripted model replies; R37 retains the
  native case results and both historical host failures unchanged.
- normative/test_nmrnet_runtime.py checks unknown-unit -> declared nm before one
  reader/prediction, independent0.125nm ->1.25angstrom, and correction of Upload
  inspection/membership/fixed-size refusals before one grant.
- test_nmrnet_interpreter.py checks count, precision, reader-rejection and safe
  problem-report correction, together with all three successful input routes.
- test_nmrnet_interpreter_ambiguity.py checks the four-case probe mechanics only.
  Scripted replies do not establish real-model semantic interpretation.

Focused maintained contained results against the final changed test and unchanged
runtime owners (b4b73e70d4e5e9f0733dcabdbd875393a0940218):
  make test/integration/provider-core/lifecycle:33 tests,0.248s,3 native skips;
  make test/integration/provider-core/interpreter-ambiguity:9 tests,0.227s;
  make test/integration/provider-core/runtime:14 tests,1.853s;
  make test/integration/provider-core/interpreter:24 tests,0.521s;
  make test/integration/provider-core/recovery:20 tests,3.333s;
  make test/integration/provider-core/service:24 tests,4.643s.
All exited0. Ruff0.15.15 lint/format for the sole changed Python file and diff
whitespace passed. Independent lifecycle/U&A, simplicity and fresh review found
no remaining concrete correction. No new target, dependency or generic owner was
needed. Retained selective logs/commands: .work/qualification/input-recovery.jzoLS6Aa
(9 files,80KiB; root0700/files0600). inventory.sha256 SHA-256:
0c193177576023cbae3267b88e25e169d4a38fed7fa40e5ee93723251bb41ea4.
This is a selective local regression record, not a full offline source closure;
tracked commits/locked existing lanes remain necessary to reproduce it. Retain
through003 review/handoff, then assess deletion under the existing scratch policy.

Still open: selected-real-model additional formats/multi-geometry Upload semantics,
real missing-unit/count/record/unsupported-input guidance and correction, and their
actual API/receiver/GUI delivery. R38's four-case paid ambiguity batch remains
unexecuted after the recorded automatic approval rejection; no retry was attempted.
Its problem-only cases cannot qualify a successful corrected preparation. No
native science, production image refresh, external model/API Job or GUI run occurred
in this follow-through. Broader connected fault requirements and full003 remain
open; completed R13b/R15b/R24/R25/R28/R32/R37 scientific evidence is reused.

R41. Owned input limits and phase-delivery resilience
---------------------------------------------------
2026-10-22. a49eb36 makes this Job's own retired selection deadline a durable
public failure, allowing later Jobs while preserving independent operational
failures. 51e0129/9593c50/cd67658 add explicit phase-only continuation after settled
API failure, protected unconfirmed-delivery notice and a fresh allowed lifecycle
read. No phase PUT, model request or science is repeated; condition reports retain
their receipt requirement. Connected recording three-Job and actual foreground
local TLS witnesses passed; full evidence/limits are in note017's final sections.
The provider image was refreshed at cd6765892810d02777ed43a29993424105f88a01;
installed isolation checks passed. Existing scientific observations were reused.

Still OPEN against U27/A11: a recoverable condition-report503 currently latches
failure and stops service. Awaiting acknowledgement need not require first-send
success. Design bounded operation-owned recovery of still-current condition facts,
preserving that gate, original API retirement, one observation owner, budgets,
stop/cancellation and diagnostics. Phase-only continuation does not close this.
External selected-model/actual API/GUI requirements above remain separate and open.

R42. Current awaited conditions recover without repeating work
--------------------------------------------------------------
2026-10-22. ffbd1b0/aa5e914 implement exact settled API retry permission and
bounded recovery of the same sequential current condition, keeping its matching
receipt gate. Production now requires the policy before native allocation and
uses the existing configured API outage envelope. Its real foreground/local TLS
witness observes503, freshly signed same-body retry, matching ACK, then one model
POST. Protected retry/recovered notices and first/latest/expiry receiving evidence
are qualified, including failed-sink redaction. Note017's final sections retain
exact tests, corrections, source rationale and limits. This closes R41's specific
recoverable-condition503 gap; no automatic scientific or interpretation retry.
External selected-model ambiguity/formats, actual API/receiver/GUI and broader
connected qualification remain open as above. Local TLS is not deployment proof.

Installed refresh at dc25708264396178c1765557d8eb3e25bfe08369 produced image
sha256:9e78e4e646b5405b86ec9d78661815a9ef516b9350441a8f6a412bc08ddf8496;
four installed-runtime checks passed. Note017 records the exact tree/lock/record
hashes and local logs. No unchanged scientific matrix or paid call was repeated.

R43. Bounded native prediction recovery ported from Magnet
-----------------------------------------------------------
2026-10-23. User authorized the port and joint discussion with the Magnet owner.
da246454a3b97b3d6b903eef995d2de2c4a31a62 distinguishes admitted prediction
failure from generic worker refusal and owned exchange timeout from foreign
timeouts. 8c3206e4ae015c86fc60fb836988356e79deb497 implements one pure prediction
retry inside the same Attempt: original allocation retired/consumed first,
identical geometry bytes and fixed models, new worker token, protected first-fault
notice even on success. No interpretation, generation or API lifecycle replay.
Input/protocol rejection, cancellation and result assembly cannot trigger retry.
Exhaustion or unsettled cleanup stays operational; no third execution or resource
limit increase. U27/A11 in note013 now distinguish pure native replacement from
prohibited science reruns after lost API/publication replies.

de09db7be2f29c2c6e99897ead3db95634ebfe12 adds the opt-in fixed synthetic cgroup
OOM proof; it exited0. One actual64MiB/no-swap kernel kill, reaped child SIGKILL,
exact engine OOMKilled/exit137, then one clean replacement with identical request
bytes. Both allocations and the controller were retired, both worker histories
archived. Note017 records precise source/image/input/receipt hashes, focused test
results and accepted review corrections. The refreshed installed image passed
four isolation/dependency checks. Separate configured runtime proof shows one
interpretation/generation and one START/COMPLETE despite prediction replacement.

Jointly reviewed portable practices are recorded in note013 and Magnet's note033
at9374f1a79a5b689bfb41a9da771a536006831538. The peer implemented its own narrow
diagnostic improvements there; this owner made no sibling edits. This proof uses
synthetic computation, not released-model/GPU capacity or retry equivalence.
Scientific accuracy evidence is reused. External selected-model ambiguity,
additional format/API/receiver/GUI coverage, resource-retention operating envelope
and other open003 obligations remain as previously recorded; no paid call added.

R44. Existing-result delivery through the deployed GUI
-------------------------------------------------------
2026-10-23. Next product outcome: a recipient can open completed NMRNet science
in the existing GUI and download the exact API result. Reuse R24/R25/R28/R32
results; create no new Job, model request or scientific execution. This is result
delivery, not GUI submission or additional real-model semantic qualification.

Use the GUI's actual credential import and saved-user result route, with its
configured API origin unchanged. Compare formatted JSON, original text and the
completed browser download with a retained actual result-read response whose
base64/length/fingerprint are checked independently. Observe the viewer's own
signed Job/result GETs and compare retained identity metadata. The initial lane
supports GUI/API at the same HTTPS origin, with explicit literal address and
interface. A tiny TCP listener adapter reuses ServicePolicy, ServiceProxyHandler
and the interface-bound transport; it adds no DNS or direct fallback. Browser
host networking and cooperative proxy configuration are not an engine firewall.

Precedents inspected in nmr-gui-v1 at
df172527409cc08d46b3318cd19e961f6c3be432:
https://github.com/numpde/nmr-gui-v1/blob/df172527409cc08d46b3318cd19e961f6c3be432/tests/e2e/signed-result-content-proof.mjs#L4-L30
https://github.com/numpde/nmr-gui-v1/blob/df172527409cc08d46b3318cd19e961f6c3be432/tests/e2e/signed-result-handoff-proof.mjs#L50-L88
https://github.com/numpde/nmr-gui-v1/blob/df172527409cc08d46b3318cd19e961f6c3be432/tests/e2e/signed-job-lifecycle.test.mjs#L55-L63
https://github.com/numpde/nmr-gui-v1/blob/df172527409cc08d46b3318cd19e961f6c3be432/app/src/features/result-viewer/result-viewer-route.ts#L36-L39
The donor's three candidate-molecule assertions do not apply to coordinate shifts
and are omitted. Its certificate-SPKI error exception is selective, not blanket
ignoreHTTPS; it is not a claim that every normally trusted certificate is pinned.

Tests first: the initial contained run failed on missing helper exports before
implementation. Focused normative/adversarial tests cover valid retained bytes,
hash/length/base64 corruption, bounded external-file reads, exact Job GETs,
forbidden mutations/unrelated API reads and literal Make selector admission.
Live sources are captured from a clean committed closure; the browser receives
only user credential, retained result response, certificate and private output.
No provider key, model configuration, source engine socket, HAR, trace, browser
storage dump or raw-stream archive is granted/retained. Both helpers use existing
bounded Docker logging and exact create/retire owners; browser retires first.
The receipt records GUI-reported sourceCommit (null honestly means unavailable),
browser image, source manifest, result identity/hash and observed signed paths.
The first b9a208f live run used the existing512MiB/PID64 helper profile and timed
out at90s. One observation showed154.8MiB/512MiB and63PIDs; OOMKilled=false. This
does not establish the timeout's cause. Its original failed evidence is retained.
The next live caller explicitly selects the established GUI browser envelope:
2GiB/no additional swap,512PIDs,512MiB /tmp and256MiB shared memory. Existing
service/proxy/offline defaults stay unchanged; one shared create/posture/retire
owner admits actual limits before start. Safe stage messages distinguish browser
startup, workspace loading and result opening. No scientific matrix repeats.

R44 receiving evidence, 2026-10-23
---------------------------------
All four read-only target runs exited0 at source
d64ed2702f440da77d75107ff830759ff2477b93. The existing signed GUI reader fetched
one selected Job and one selected result per case; observed status200 and signing
headers, rendered full Job/result/provider/Attempt/hash identities plus schema and
size, formatted JSON, original text and completed download all matched the prior
API response. No new Job, model call, provider mutation or inference was made.
Each scientific population, per-geometry atom/shift content and provenance stays
exactly as previously delivered; neither expected outputs nor tolerance changed.

Retained capsule: .work/qualification/gui-result-readback-eZQRfzif/
inventory.sha256 SHA-256:
3913c80e1b145418e876f36f3f88e1e60d329eb806fb515ebc9dd4a21f31d0f0
The four passed/<case>/sources.sha256 files share SHA-256:
2665823dbe4b503535414f61a952077f9c262f64dc78c8eb5303cb4387f932f2
All18 captured source entries verified independently. Each case retains its own
browser/proxy image/posture/mount/exit/stop/inspect/remove receipts and private
output/{passed.json,downloaded-result.bin}; process streams remain only in the
bounded Docker journal, retrieved by the recorded complete container IDs.

Case              Geometries  Bytes   Download SHA-256
pasted            1           13732   3eb7aba1c2d8334b4843076f779e5ff5c1a38f6a02716a5a4091060a4bbb94cc
smiles            1           16389   574dbf183feb23e9ab28e97ce2fb1bf74cc81b3823f83e84245c532a6cb4ad0a
smiles-multiple   3           26939   8e9c71224697b532f28687163d64d29eb113376329eaf49714bb3b91a3f0c205
upload            1           13507   fd89e9f7033017bcbc4737111719bb3801b28c190e97806c3e39afadc801d5dc

Exact independent byte comparisons use these original actual-API read envelopes:
.work/qualification/api-real-openai-pasted-ab254b9/evidence/client/036-result.response.json
.work/qualification/api-real-openai-smiles-011a248/evidence/client/030-result.response.json
.work/qualification/api-real-openai-smiles-multiple-8f068bd/evidence/client/038-result.response.json
.work/qualification/api-real-openai-upload-68913a0/evidence/client/039-result.response.json
The separate pasted/Upload producer qualifications originally exited2; these GUI
successes do not change those exits, scientific qualifications or their limits.

Browser image:
sha256:2bf69495aecd6dbdde961dc77e33faeed3b6204deafb93f52af49c10201b2499
The actual dev-local GUI container observed during this window was
ac6b65b5ba8cf593301646fe8168ff61d67189915044987433db25fa5597ec09,
image sha256:595d298571389fd0d306263fc811ece458349644b0fb998f00193e208dc45c20.
gui-runtime.json retains selected Docker identity/mount facts without environment
or source host paths. All four GUI sourceCommit observations are null. The mounted
dev source is not a pinned production bundle, and its revision is not established
by this run. Inspected donor source is not substituted for that missing fact.
Origin/port/signatures remained https://storage.example; the explicit mapped
address was127.0.0.1 on interface lo. No DNS-resolution claim follows.

Failed runs remain under failed-original-profile (b9a208f),
failed-deferred-body (b827390) and failed-body-before-download (955f7d3), all exit2.
The latter two reached the actual GUI but a second CDP response-body lookup failed
with Network.getResponseBody/No data found; reordering did not fix that lookup.
The first body-lookup run had already completed exact JSON/text/download checks.
Final proof deliberately asserts identity at the GUI's actual rendered surface;
there is no catch-and-ignore response-body fallback or additional API read. This
is receiving-proof bookkeeping, not evidence of incorrect science or failed API
delivery. Both helpers in all seven runs have exact stopped/removal receipts.

Focused validation:6 contained Node receiver-boundary tests,26 operator-input
tests and29 host ownership/profile tests passed. The added profile/refusal tests
were observed red first. Ruff0.15.15, bash -n and diff whitespace checks passed.
Independent review verified all four downloaded byte sequences,18-file source
closures, private output modes, read-only credential/trust/reference grants and
exact retirement; it found no remaining actionable finding in this slice.

Next product outcomes: real selected-model additional formats/multi-geometry
Upload and actual ambiguity/correction, then actual GUI submission and final
operational handoff. The prior automatic approval rejection of the paid ambiguity
batch still applies; no rejected model call was retried. Native/local scientific
and connected fault evidence already retained is reused where applicable. This
bounded GUI receiving proof closes neither those gates nor full003.

R45. Next real-input qualifications; exact external approval remains pending
--------------------------------------------------------------------------
2026-10-23. R44 closes existing-result GUI receiving. The next ready action is
the already implemented four-case real ambiguity-decision probe, not another
receiver verifier or general fault campaign. No model request has been made.
Its previous automatic-approval rejection remains binding until exact external
destination/data scope is approved; the coordinator has asked the user.

Current selected nonsecret configuration, read without key contents:
endpoint https://model.example/v1;
model gpt-5.6-luna; configuration_id openai-gpt-5-6-luna; reasoning_effort none.
Configuration SHA-256:
398cf74795533adf8205005c072f125a815f9c663b01b01c5b2856628cf14e5f
The authored tests/fixtures/preparation/interpreter_ambiguity.json SHA-256 is
78cb6ed1e347cb3ac7ceeb5e3ef37b614783c75be3039c883d7492c9b7a22ff7.
Only its four public instruction cases, the production prompt/tool declarations
and authored inert attachment metadata go to that endpoint. No real Upload,
authenticated API Job, provider credential or scientific capability is granted.
The existing interpreter key is granted only to the contained interpreter client.

Current bounds are6 turns per case, at most24 model exchanges across4 cases;
65536 request bytes,262144 response bytes,25s exchange and5s retirement.
The existing batch_budget formula therefore gives800s process/820s host budget,
not R38's historical45s/45s illustrative profile. The batch stops on the first
failed case; there is no whole-case retry, endpoint fallback or scientific work.
Any parser correction consumes a turn, but prevents qualification of an
uncoached problem decision. Passing this probe establishes no successful repair
or whole API transaction. Original held-cleanup ownership still overrides time.

Minimal following product story, requiring its own prepared/authorized live run:

1. Extend the existing actual-API Upload witness with one two-record supplied
   SDF, tests first; reuse acquisition, deterministic readers, result assembly,
   source correspondence and the real interpreter. Prefer matching retained
   native evidence. The existing normative/butane_conformers.sdf is a concrete
   authored carbon-backbone case: two distinct4-carbon geometries, supplied H
   absent. This does not independently establish molecular/stereochemical identity
   or complete-butane accuracy. Preserve both C-only lists/order and units, generate neither H nor
   coordinates, return no H shifts and never average records. Its SHA-256 is
   c8007f5a1a80ad080bb972caf005bbb4fedcd5a9bd15b892e1b640d2f01e4374;
   independent coordinate/record expectations already reside in expected.json
   (SHA-2561686803ac341e8502fbc9eaba71dccc1a6ebc04f121af4b0ba513e11e312d5b7).
   R37's mixed_records.sdf native result is not a numerical oracle for this file.
   Qualify this exact new native case before a paid run; retain provenance/finite
   C-population observations separately from independent numerical accuracy.
   Reuse R13b/R15b accuracy/capacity evidence; add no new broad format matrix.
2. Keep successful correction distinct from that ambiguity probe. R24 is already
   an actual corrected pasted-input transaction; R37's SDF correction is scripted.
   Preserve those identities/limits. Do not force an artificial molecular error
   or repeat paid runs until one happens, and do not count an uncoached problem
   report as repair. Any required current live correction witness must exercise
   the same bounded conversation after a genuine deterministic refusal, with
   actionable guidance and no repeated successful preparation or inference.
3. Combine the next real input Jobs with actual GUI submission rather than making
   a second API-only story: normal user credential import, existing project and
   offering, pasted/SMILES/Upload input, submission and receiver readback through
   the now-qualified GUI surface. A requested significant-digit value can also
   qualify the still-open live precision policy. These are new persistent Jobs
   and paid interpretations; prepare exact fixtures/receiving assertions before
   requesting their separate external scope. Current R44 grants no submission.

R46. One supplied carbon-only SDF native witness
------------------------------------------------
2026-10-23. Prepare the exact new native fixture before extending the paid/API
Upload witness. FORMAT_CASES=sdf-carbon-only selects the existing authored
normative/butane_conformers.sdf, records1,2 in order, using the unchanged
expected.json atom/coordinate/source-ID oracle recorded in R45. No new expected
prediction values are created. Two separate4-C geometries must yield8 indexed
finite C rows and zero H rows. Actual loaded-head/artifact evidence must be C-only;
configured selected_models may legitimately retain both H and C artifacts.
Supplied coordinates/atoms remain exact; no generator is allocated, no H added,
and coverage keeps hydrogen completeness not established. Distinct coordinates
do not require distinct predicted shifts, and neither molecular identity nor
complete-butane accuracy is claimed.

The existing FormatsServiceLifecycle/SuppliedLifecycle owns source acquisition,
reader options, binary64/binary32 correspondence, result assembly, protected raw
predictions, confirmed retirement and exact terminal replay. The new case only
adds a fixed source selection and explicit supplied-H coverage assertions.
The original9 cases and their oracles remain; the authored profile now includes
this tenth case. Existing22 active native slots remain unchanged. Per-selected
case180s plus120s startup yields300s for this one-case run; held cleanup still
holds. This is not a new interpreter, worker, network or lifecycle framework.

Tests first: the new fixture test failed with KeyError('sdf-carbon-only') before
implementation. The focused installed lifecycle lane then passed34 tests,
including3 explicit native-only skips, in0.221s (suite time, excluding contained
wheel installation). Pinned Ruff0.15.15, shell syntax and diff whitespace passed.
Independent scientific/ownership/U-A reviewers found no concrete issue.

Next single native invocation, after committing its exact input closure:
  make test/integration/provider-service/formats FORMAT_CASES=sdf-carbon-only
Do not rerun the nine completed format cases. The result, if successful, provides
this case's source/runtime/population/replay evidence, not an independent accuracy
oracle. Paid ambiguity approval remains pending; no external request is made by
this native qualification. Actual result and host exit will be recorded below.

Observed result (2026-10-23): the one-case command exited0 at source revision
7cc0617d20dbe7effba11eaa9c66edc3131c750d. Retained ignored capsule:
.work/qualification/provider-service-nmrnet-native-service-UXc3mVpW/
Its formats/sdf-carbon-only/qualification.json records one reader call, one
scientific execution, records1,2, exact source/oracle hashes above and successful
terminal replay after reopening. scientific-result.json has27085 bytes,
SHA-256 bd5adb6f47ac7b5b739ae4c52ce36d308195bae56b6233c0d07e22918227a3a3.
The eight indexed C predictions, zero H predictions, exact two coordinate lists
and supplied-source positions were independently checked against expected.json.
No expected shifts were manufactured, and no other format case was rerun.

Recorded images (caller-declared identities, separately matched to local pins):
controller sha256:9164d380c00bf0e013d44357cafb03d4b1f64570a93105f74ac4b85b66cf1b49
reader sha256:be4358dd385b280723831950e527e44a87de4ee49afa9020ef8e7e8929bd3bb3
prediction sha256:cabb4fe3e36541b0fefe54ca7c16fb21f9a60112a1e3d47992d4aa18343ecd08
The controller receipt and both native allocations have confirmed retirement;
reader token0b7ea8d608211ae737aa06037872b94b and prediction
token8b8842f760db6c8343ecff00c5d69b22 have consumed/retire markers and archived
host receipts. sources.sha256 fingerprint:
d66cd3eaa667d5aa5382073f40c6206e96f6a35891587ef0a0f345e99f652825.
The API/model/store peers were local scripted TLS peers. This establishes this
case's native source/population/retirement/replay evidence, not external-model
interpretation, deployed GUI submission or independent scientific accuracy.

Next required ingestion seam: normal GUI uploads are ZIP-packaged, including a
single chosen file. Inspected sibling nmr-gui-v1 revision
df172527409cc08d46b3318cd19e961f6c3be432,
tests/e2e/signed-upload-workflow.mjs::prepareUpload and
app/src/features/workspace/upload-zip-writer.ts,
establish that the acquired Upload hash identifies the ZIP, not its SDF member.
Current InputPreparation.prepare_upload sends the complete acquired bytes to
the raw format reader; that cannot implement normal GUI SDF submission.
Do not inject raw API SDF bytes and label it GUI submission. Before extending
the browser lane, adapt the actual bounded archive/member consumer using the
SECS direct/ZIP precedent and existing verified core acquisition. Preserve the
original Job/Upload identity and separate selected member name/hash/byte length.
Keep explicit member selection, decompression limits and correctable selection
refusals separate from operational acquisition/retirement failures. The existing
provider-core tests/fakes/secs_sources.py adapter is evidence, not a production
module to import. This required seam is not permission for a generic archive
framework or any sibling change. R45 external approval remains pending.

R47. Bounded GUI ZIP consumption in the isolated reader
------------------------------------------------------
2026-10-23. First production slice adds Upload inspection and exact named-member
reading to the existing one-use GeometryClient/geometry_worker channel. Original
raw reader calls retain their byte validation and formats. A ZIP supplied as raw
coordinates now requests inspection/member selection rather than reporting a
misleading UTF-8 error. No archive is extracted, normalized into a host path,
recursively decoded or implicitly selected by order/extension. Inspection reports
declared sizes; only a complete CRC-checked read establishes consumed bytes.
The worker returns those immutable member bytes with the complete geometry batch,
so existing prepared_reply derives member hashes and source positions from the
actual parser input. The original verified Upload remains a separate identity.

Production source: nmrnet_provider/upload_archive.py. Algorithm/rationale source:
SECS7356c354368f2355d3ab5cef00cf48c67cea9c2c,
src/secs_inference/provider/source_access.py::_preflight_archive,
_indexed_member, _read_stream and _read_chunk; source SHA-256
04911c122000b0246b844ef3b2567d4e5647effabef4eb0809b2b7bbfa62ef86.
The test adapter is not imported. Keep only exact duplicate-aware selection,
regular/unencrypted content, declared-count preflight, actual-count postcheck and
narrow decoder exception translation. Forged low counts may reach ZipFile's
index construction before postcheck; admitted1 MiB outer bytes and the existing
reader container bound allocation. No second ZIP parser is introduced.

Inspection caps4096 entries and16384 serialized metadata bytes. This is smaller
than SECS's256 KiB discovery listing because NMRNet embeds it in the existing
bounded interpreter request (qualified profile64 KiB), alongside Job/tools/history.
Exact known-member selection remains possible without listing. A selected member
has the existing1 MiB input ceiling, with one overflow-probe byte; the unchanged
2 MiB complete-reply frame includes both source and geometry bytes. Oversize
output rejects the entire batch. No larger frames or chunking protocol are added.

The connected preparation owner will count every inspection/read allocation with
its existing max_worker_calls,
including failures and corrections. Therefore total visible expanded bytes across
an Attempt are bounded by max_worker_calls * (1048576 + 1); inspection consumes a
call but decompresses no content. Original authenticated download byte/request
budgets remain unchanged and truthful. This deliberately replaces the preliminary
reservation idea: no second budget ledger, reset, refund or lifetime registry.
The existing selection deadline and exact worker retirement still govern stalls.

Missing member names permit inspection and correction; duplicate names require
repackaging with unique names. ZIP decoding/integrity/unsupported-version input
failures retain bounded decoder text in the existing protected diagnostic field,
separate from public guidance. Errno-bearing native failures remain operational.
The actual receiving-client CRC witness verifies that the cause crosses IPC.

Tests first: absent module then absent process operations/actionable ZIP guidance
were observed red. make test/unit/provider-geometry-worker passes61 tests,
including structured normative/adversarial ZIP cases and real reader processes.
One new test double was wired to the wrong mock stream and exhausted its512 MiB
test container (exit137); corrected to raise at the actual stream.read, then the
focused lane passed. This was a test defect, not a native chemistry observation.
Pinned Ruff0.15.15, shell syntax and whitespace checks passed. Independent review
found/fixed pre-decode option admission, unsupported-version classification,
declared-count wording and the existing launcher's changed test-pattern assertion.

Next connected slice: InputPreparation inspection/member selection and terminal
ResultPlan provenance, with a GUI-shaped ZIP of the two-record SDF and unchanged
raw input as controls. The interpreter tool is not exposed in this first slice;
no paid model call, new API Job or repeated native prediction has occurred.

R48. Connect Upload members to interpretation and result provenance
------------------------------------------------------------------
2026-10-23. InputPreparation now exposes inspect_upload(upload_ref), acquiring
and caching the same verified Upload used for later preparation. Inspection and
member reading each allocate a fresh existing reader, spend max_worker_calls and
complete channel/host retirement before returning metadata or a candidate.
No separate archive cache or source lifetime owner is introduced. The existing
deadline, busy guard and held-retirement gate still prevent overlapping work or
replacement after unconfirmed cleanup. Wrong member selection permits correction
using the same immutable acquired bytes; acquisition/grant/hash/cleanup failures
retain their operational meaning. Failed attempts do not reset either budget.

The interpreter retains inspect_uploads for authenticated membership, adds
inspect_upload for container/member metadata and accepts member on prepare_upload.
The member is an exact logical name, independent of the selected record numbers.
Omitted/null member selects a direct file, preserving raw callers. ZIPs always
require explicit selection; exact known names need no inventory round trip.
Names are source labels, not instructions. Successful preparation still ends the
conversation without a submit/token echo or repeated successful work.

PreparedUploadMember names the cross-module reader outcome and hides source bytes
and geometry arrays from repr. UploadMemberSource joins member name/length/hash
to its separately verified UploadSource; it does not manufacture a VerifiedUpload
with a different hash. ResultPlan checks the Job and every member-source digest.
Public and durable geometry source facts keep sha256/byte_length relative to the
consumed molecular file, with upload_ref and a separate archive object containing
the outer sha256/byte_length and exact member_name. Direct source shape is unchanged.
Example: the same two-record SDF has member SHA-256
c8007f5a1a80ad080bb972caf005bbb4fedcd5a9bd15b892e1b640d2f01e4374;
its ZIP has a different hash. Atom IDs and record numbers refer to the SDF member,
not ZIP bytes.

Focused receiving/ownership evidence:
- tests/integration/provider_core/normative/test_nmrnet_upload_preparation.py:
  inspection, a missing-name refusal and corrected ordered selection share one
  verified acquisition; all three reader allocations retire before replacement.
- adversarial/test_nmrnet_upload_preparation.py: inspection spends the final
  reader call; a later prepare cannot acquire or allocate again.
- normative/test_nmrnet_interpreter.py: three scripted HTTPS replies inspect
  membership, inspect ZIP and select a member; two fresh reader/host pairs retire,
  and the existing scientific session executes once. This proves tool/session
  plumbing, not actual language-model interpretation or GUI submission.
- tests/unit/{normative,adversarial}/test_provider_uploaded_result.py: both result
  and prepared identity preserve the two hashes; another Job/member hash refuses.
- tests/integration/rdkit_runtime/test_geometry_worker.py: a GUI-shaped ZIP of
  the unchanged two-record carbon-only SDF traverses real RDKit reader processes.
  Both exact geometry request hashes match R46's already executed native inputs:
  d56479cd4fb876dc9c783acffd52dbbe2a01d419aa34b378e1d565fd8ff6ec06
  a752e8d06b653fcfd14b1e247a10d95a2d939de7365f9c90a67ad7e2d1425ccf.
  Both four-C atom lists, source IDs, coordinates and order match expected.json.
  This reuses R46's retained C-only prediction evidence without rerunning shift
  inference to reconfirm packaging. It does not make the scripted service or
  generated ZIP into an actual GUI-submitted Job.

Tests first: new source-type import, absent InputPreparation.inspect_upload and
unadvertised interpreter tool were observed red before their implementations.
Focused contained lanes:43 result tests;40 Upload tests (one explicit native-only
skip);39 interpreter tests;8 native geometry-worker tests. The Upload count excludes
an intermediate run that discovered two temporary duplicate legacy test copies;
new tests now use the structured normative/adversarial directories. Pinned
Ruff0.15.15, shell syntax and diff whitespace checks passed. Independent review
corrected the receiving fixture's accidental reuse of its retired inspector.
Fresh read-only reviews separately covered scientific identity, ownership/bounds,
error recipients, containment/workflow, simplicity and reproducibility; no remaining
concrete finding was reported.

Controller refresh: make provider/image/build exited0 from committed source
1461e2820c45959a52afb1cfdcc6b9a76a04124b, producing
sha256:7a6c27c83563b9e035514974dbfbe7bf716605190bdbbfd21718589e1f91928a.
The build's installed process --help check passed; this does not establish service
readiness or a prediction. Remaining product qualification: prepare actual normal
GUI file submission and receiving with these source/member assertions. Paid ambiguity approval is still
pending. No model request, new persistent API Job, GUI mutation, released-model
prediction rerun or deployment-readiness claim was made by R47/R48.

R49. Keep the pending ambiguity probe's inspection capability complete
---------------------------------------------------------------------
2026-10-23. The production tool list now includes inspect_upload. The probe's
metadata-only capability must support that call too, otherwise a reasonable
model inspection fails with AttributeError instead of measuring input judgment.
_InspectionOnly.inspect_upload resolves only its fixed authored Upload metadata
and reports a direct-file inventory. The synthetic512-byte length/hash are not
observed transfer evidence. No source bytes, molecular record contents, expected
problem category, grant, reader or scientific capability are supplied. Unknown
references get the existing narrow UploadInputRejected selection feedback; any
corrected conversation still cannot qualify an uncoached decision. Preparation
remains forbidden before argument feedback can coach the expected outcome.

The existing attachment receiving fixture now performs membership inspection,
file inspection and problem reporting. It asserts the actual metadata delivered
to the scripted receiver, zero corrections and no preparation attempts. This is
plumbing, not a real model result. New scripted inspection was observed red first;
make test/integration/provider-core/interpreter-ambiguity then passed9 tests in
0.219s. Pinned Ruff0.15.15 and whitespace checks passed. Read-only code/concern
reviews found no remaining concrete issue. No fixture bytes changed: the four
public cases retain SHA-25678cb6ed1e347cb3ac7ceeb5e3ef37b614783c75be3039c883d7492c9b7a22ff7.
The6-turn limit and external approval scope remain unchanged; no paid call, API
Job, acquisition, parsing or science occurred. This qualification-client edit
does not require rebuilding the unchanged controller image recorded in R48.

R50. Qualify normal GUI submission, starting with the two-record SDF
-----------------------------------------------------------------
Intended sequence (2026-10-23): reuse the API witness's admitted foreground
provider, native allocations, mapped/external routes and exact-CID retirement.
A separate opt-in browser action imports only the user credential, selects the
operator's Project/peaks_from_mol offering, and uses ordinary /v1b controls. For
Uploads it selects butane_conformers.sdf; the GUI creates its ZIP, publishes it,
and attaches the resulting Upload to one newly created closed Job. Select only
the admitted provider, then Resume Job once. Pasted input and SMILES use the same
concrete workflow without Upload creation. Keep gui-result's GET-only contract.

Reuse actual owners, not donor test machinery:
  nmr-gui-v1 df172527409cc08d46b3318cd19e961f6c3be432:
  tests/e2e/signed-upload-lifecycle.test.mjs:190-238 (ordinary controls);
  tests/e2e/signed-upload-workflow.mjs:80-125 (prepared ZIP/request observations;
  exclude installUploadProof, Upload proof file and window.uploadProof calls);
  app/src/features/workspace/ColumnWorkspace.tsx (provider selection/results);
  app/src/features/result-details/ResultDetails.tsx (rendered receipt facts);
  app/src/features/result-viewer/result-viewer-route.ts (saved-user viewer).
  Existing local owners: tools/provider_api_qualification.sh, provider.sh,
  provider_gui_qualification.sh and tests/integration/provider_runtime/gui_result.mjs.

Tests first: admit only the selected origin/Project and this one workflow's
mutations; refuse repeats/foreign resources before dispatch. Retain bounded safe
operation references, discovered Upload/Job IDs and confirmed/uncertain response
facts on failure. No whole-case retry or automatic second Job. Read result facts
from the rendered GUI, including full identifier aria-labels; assert JSON, Text
and original download. Compare R46's exact prepared requests, atom order, binary32
inputs and eight C shift rows, not whole result bytes: new Job, interpreter and
outer ZIP identities necessarily differ. Bind actual GUI ZIP length/hash and
original member identity independently. Reuse receiving/launch/retirement owners;
no extra browser-to-Python Job-state bridge or recovery framework.

Local lane implementation and offline checks are authorized. No new paid model
request or persistent API/GUI Job is authorized by this plan. Live evidence must
remain explicitly pending until its exact external-effect scope is approved.

First local component: gui_result.mjs now exports its existing credential import
and JSON/Text/download receiver for the submitter to reuse. Its original wrapper
still compares all received content with the earlier API receipt and keeps the
GET-only route. gui_science.mjs compares invariant science and checks new identities
separately for SDF ZIP, pasted input and fixed-seed SMILES. Pasted source remains
explicitly interpreter-supplied text, not an invented exact extraction from the
Job. Its source hashing/line ownership remains with the deterministic reader.

New structured synthetic tests were observed red for the missing comparator
export, then make test/unit/provider/gui passed13 tests in183.948ms on pinned
browser image2bf69495aecd6dbdde961dc77e33faeed3b6204deafb93f52af49c10201b2499.
Receipt /tmp/nmrnet-gui-unit.NqwFQXXc/evidence; bounded journal container ID
48a936adaa124f19dd7ff0c0a7407e0fe71e2e813fa11017c27293467dec24da.
These authored comparisons are not predictions or a connected GUI submission.
Review removed an invented zero-correction/exact-turn-trace gate: successful
corrected conversations remain valid, with observed turns/corrections preserved.
Only successful operations are recorded by InputInterpreter._dispatch; one final
successful preparation is required, after any bounded metadata inspection. The
comparator consumes the admitted configuration's turn limit instead of owning a
second independent budget. Fresh code/science/ownership/error/simplicity and
reproducibility reviews found no remaining defect within this component's scope.
The next component must bind committed fixtures and actual rendered result facts
to this comparison in the separate normal-submission action; that wiring is not
claimed here. No new controller image or repeated native science is needed for
these qualification-client-only edits.

Second local component: gui_submission_requests.mjs admits the single normal
GUI workflow (three mutations without an Upload, eight with it). It checks the
exact authored Job input, closed initial state, selected provider and exact
GUI-prepared ZIP publication bytes. An absent/refused response stops subsequent
mutations; no second creation or whole-case retry exists. Safe snapshots retain
operation references, HTTP status/correlation and observed/confirmed resource
IDs, excluding request bodies, headers and publication capabilities.

Review corrected an unsupported creation-identity inference: an observed Job GET
path now stays provisional; bindJob requires the scoped GUI's rendered Operation,
Project, Submitter and Input fingerprint before dependent mutations. Upload IDs
seen during the GUI's automatic transfer remain provisional until confirmUpload
correlates final scoped GUI metadata. The normal GUI owns create-response
admission against its reserve operation/user/Project; this witness does not add a
second response interceptor or lifecycle. Upload reference digests are resource
identities, not content hashes. Actual ZIP/member hashes stay separate.

Missing guard export was observed red in the contained lane; final focused
make test/unit/provider/gui passed20 tests. Receipt:
/tmp/nmrnet-gui-unit.H4MPbODO/evidence. Code and six concern reviews found no
remaining concrete defect within the stated normal-GUI ownership. A proposed
second Upload-create response admission was rejected because the pinned GUI
already owns it; early path observations explicitly make no independent creation
claim. This component has no browser caller yet and creates no API effects.
The binder arguments are our safe projections of visible scoped DOM facts, not
raw API responses or the GUI's internal camelCase objects. ColumnUploadDetails
does not show a content hash; final stored-byte identity is deliberately proved
through result.source.archive, rather than invented in the finalization receipt.

Connected local component (2026-10-23): the maintained opt-in target
provider/qualify/gui/submission now connects all three fixed cases to ordinary
GUI controls. GUI_CASE=pasted|smiles|sdf-zip selects one case per invocation;
operator origin, Project, credentials, trust, immutable browser image, explicit
routes and output remain literal command-line selectors. tools/provider_api_qualification.sh
reuses the existing foreground provider, native launch/allocation and exact-CID
retirement owners. A clean committed source closure is captured before effects.
No provider/model key reaches the browser. Its existing host-network cooperative
HTTP proxy is an explicit grant, not an engine-enforced all-transport allowlist;
docs/provider.md records that limitation. No new networking framework was added.

gui_submission.mjs uses normal user import, Project/offering selection, Upload
publication, closed Job creation, attachment/provider selection and one Resume.
It reads complete identifiers from the scoped rendered DOM. The GUI's actual
prepared ZIP bytes are bounded and hashed before publication; the final scientific
source must join that outer identity to the unchanged selected SDF member.
The contained reader owns ZIP decoding; this witness introduces no second decoder
or response/signing/state bridge. JSON, Text and the actual downloaded result
are checked through the existing receiver, then compared with retained science.
New Job/Attempt IDs must differ from the retained result's identities. All exact
scientific values, source/member identities and generated-H correspondence remain
exact; no reference output or numerical tolerance was changed.

Submission observations retain bounded operation/resource IDs, received HTTP
status/correlation and reviewed Chromium transport categories. A failed body after
received headers blocks the next mutation; independent observation-write failure
survives beside that transport cause. No request body, credential, publication
capability or raw header dump is retained. Functional submission observations and
scientific downloads remain private artifacts; process output uses Docker logs.
Transient result GET failures remain within the same Job's readback loop. Visible
failed Attempts expose their public guidance, and timeout retains recent read and
Attempt facts. No mutation or whole case is retried. Browser retirement precedes
route retirement, then the original foreground owner drains its native work.

The browser whole-run limit is1200s; host wait1220s. Job setup must finish in120s
before Resume, leaving the900s readback allowance plus bounded poll/receiving/close
work. Preparation consumes the admitted configuration's turn limit, rather than
an independently invented exact-trace or zero-correction gate.

Focused contained validation only:
  make test/unit/provider/gui BROWSER_IMAGE=sha256:2bf69495aecd6dbdde961dc77e33faeed3b6204deafb93f52af49c10201b2499
    29 tests passed in272.651ms; receipt /tmp/nmrnet-gui-unit.ksB38AVr/evidence;
    journal CID c26e9a8104de5677183c22d38300b6ef22e4a620348c3e9006934dd0fcdf6da6.
    The new-identity regression was observed red before its two assertions:
    receipt /tmp/nmrnet-gui-unit.Xp8oNmXK/evidence;
    CID2ce033410aca78cf87f957ad5655c031b5e80c2fe5f67b293d7a217735e09177.
  make test/unit/provider/api-stage
    14 tests passed in3.339s. Existing fake-owner composition now covers all three
    GUI cases and failed-browser retirement, captured source grants, credential
    separation and1220s host wait. These are orchestration tests, not real API
    effects or native prediction. Fixed its existing ambiguity test fixture's
    missing provider_logging.sh input; no runtime behavior changed for that fix.
  Pinned Ruff0.15.15 checked/formatted the three changed Python files; bash -n,
  Make dry-run and diff whitespace checks passed. No broad suite was run.

Independent current-tree code review and focused scientific, ownership, error,
containment, simplicity and reproducibility reviews were adjudicated. Corrections
included normal parent-card activation, asynchronous read completion, transport
failure after HTTP headers, visible failure guidance and distinct new identities.
An alleged absent retained-ID fixture was stale: gui_science_ports.mjs explicitly
contains job:old/execution_attempt:old. A proposed extra Upload receipt interceptor
and new host-network framework were declined for the ownership reasons above.

Scope of evidence: offline wiring/guards only. No new Job, Upload, paid model
exchange, native inference, image build or deployment occurred in this component.
The controller remains R48's recorded image; these qualification-client edits do
not require rebuilding it. Next live order is the two-record SDF, then pasted and
SMILES through the same target, each with its own explicit external-effect scope.
Paid ambiguity R45 remains separately pending. R44's existing-result receiving
proof does not authorize or prove these new submissions; full003 remains open.

Ready external scope, not executed: implementation commitf13bcd0. The exact
three separate invocations, local credential/trust paths and fresh output roots
are retained privately at:
  .work/qualification/gui-submission-plan-f13bcd0/live-scope.txt
  SHA256631c47195fb8a9fe8be8f2814ad4a25fa562ecb1d650d2fd44e3e6d84821b046.
First request only the SDF case: one persistent Job plus one GUI-created ZIP
Upload, selected provider, ordinary viewer/download and original retirement
owners. Pasted and SMILES remain separate following cases using the same lane;
Selected model is gpt-5.6-luna at https://model.example/v1,
configuration_id=openai-gpt-5-6-luna, reasoning_effort=none; exact TOML SHA256
398cf74795533adf8205005c072f125a815f9c663b01b01c5b2856628cf14e5f.
The admitted6-turn/25s exchange/5s retirement limits apply per Attempt, not a
monetary cap or an invented single-Attempt guarantee for the API's Job lifecycle.
The fixed browser/host limits above bound this witness. Preserve any API-owned
expired/replacement Attempt identity and effect uncertainty; the witness never
resubmits a Job or retries a mutation. Visible failed Attempts stop the witness.

Next concrete gaps are actual newly submitted GUI SDF/pasted/SMILES delivery and
the separately pending uncoached ambiguity decisions. Current fixtures explicitly
request precision17 to permit exact retained comparison; this does not establish
live default/other precision selection. R35 retains that behavior's offline proof.
R36/R40 already qualify successive Jobs and recovery with recording science;
R39 separately qualifies installed stopped recovery/idle restart. These owner
proofs are not a deployed multi-Job/native-restart claim. No further local
mechanism or repeated native matrix is required merely to launch the prepared
normal-GUI witness. External effect approval is the immediate execution boundary.

R51. Compact real-interpreter format-choice probe, offline mechanics only
------------------------------------------------------------------------
2026-10-23. Prepare the smallest missing MOL/PDB/MOL2 semantic observation without
repeating R37's actual readers/predictions or creating another API/GUI Job matrix.
provider/qualify/interpreter/formats reuses interpreter_ambiguity.py's configuration
admission, real ChatEndpoint/InputInterpreter, finite batch, protected receipts,
signals and original model retirement. tools/provider_api_qualification.sh reuses
the same selection/admission/one interface-bound proxy/probe and exact cleanup;
there is no second launcher, engine lifecycle or dependency group.

interpreter_formats.json is authored instructions plus direct-file Upload
metadata, SHA256692ec8fce4887f724ca9065d9a97d909340336b67af6b2275f68834b8aa763e3.
Only its request text and metadata reach the model; expected option fields do not.
Its three unchanged R37 sources/expectations at5525d82 are documented precisely
in tests/fixtures/preparation/README.txt, with byte lengths and original hashes:
atom_order_v2000.mol, single structure; models.pdb, models2 then1;
mixed_records.mol2, records2 then1. All supplied coordinates are declared angstrom.
Source: formats_service.py::load_case, geometry_protocol.py::require_read_options,
pdb.py::_selected_rows and expected.json. Original file bytes are not acquired,
parsed or mounted into the live probe; metadata is authored, not an authenticated
Upload/observed transfer. The production prompt and tools remain unchanged.

_FormatChoiceOnly captures immutable canonical JSON of the actual capability
prepare_upload arguments after production tool admission, then returns None.
That is the method's normal no-value contract; the production dispatch ends the
conversation immediately. No PreparedAnalysis, geometry or scientific result is
fabricated. The probe checks arguments afterwards, using the actual reader-options
predicate before comparing named reference/format/unit/record order. A wrong
captured choice stops the batch with no expected-option feedback or second try.
Production schema/JSON corrections remain recorded in the bounded conversation;
this is argument-choice evidence, not R45's separate uncoached-problem criterion.

Equivalent valid options remain valid: omitted/null member selects the direct
file; models.pdb has only blank alternate sites, so an admitted explicit label
selects identical rows. MOL's real contract requires selection=None; 'all'/[1]
would not be valid alternatives. PDB/MOL2 'all' would change2,1 into1,2 and refuses.
Receipts explicitly say evidence_scope=prepare_upload_arguments,
scientific_preparation_performed=false, authenticated_api_job=false; no raw chat.
Captured argument JSON is bounded by the existing tool carrier and redacted at
the receiving boundary with the existing operator redactor. An owned comparison
refusal retains useful guidance separately from arbitrary exception text. Earlier
endpoint/correction and independent cleanup failures stay with the existing owner;
unconfirmed cleanup remains held. Neither classification nor receipts assert
successful acquisition, molecular preparation, prediction or GUI packaging.

Focused offline mechanics: new mode calls first raised TypeError before their
implementation (13 tests,4 new errors; existing cases passed). Final
make test/integration/provider-core/interpreter-ambiguity passed14 tests in0.418s;
make test/unit/provider/api-stage passed15 in3.315s. The former covers all three
captured choices, wrong but reader-valid record order, wrong source/units/member,
other preparation/problem tools, secret/credential-field redaction and existing
retirement/cancellation/no-coaching rules. The latter proves shared metadata-only
grants, mode selection, one route, no provider/native/result grants and exact
retirement. A receiving test exposed a bare RuntimeError projection; fixed with
probe-owned refusal text instead of generic exception stringify. Pinned
Ruff0.15.15 checked/formatted only the five changed Python files; shell syntax,
Make dry-run and diff whitespace passed. Read-only source and scientific-scope
reviews found no remaining concrete issue, with the harmless PDB option corrected.
No broad suite, acquisition, image build, source/native execution, paid model call,
API Job, retention policy or cleanup occurred. Current controller image remains
R48's; these mounted qualification-client changes require no scientific refresh.

Exact future external scope, NOT executed or approved: one batch of these three
fixed cases against gpt-5.6-luna at https://model.example/v1,
configuration_id=openai-gpt-5-6-luna, reasoning_effort=none. Same TOML as R45/R50,
SHA256398cf74795533adf8205005c072f125a815f9c663b01b01c5b2856628cf14e5f.
Max6 turns/case, at most18 model exchanges total; request65536/response262144 bytes,
25s exchange/5s retirement. The admitted three-case profile gives615s process /
635s probe host wait, separate from finite setup/engine/held-cleanup obligations.
No endpoint fallback or whole-case resend; stop at first failed case. These are
request/time bounds, not a monetary cap. Both configuration and mode/case count
are bound in the admitted profile and rechecked before run. R45 stays four cases
with its original800/820 profile and unchanged fixture hash.



R52. Bounded storage owners and installed controller refresh
============================================================
2026-10-23; local implementation/qualification only. The latest source/proof
status here supersedes R51's final design-only storage wording, without changing
its unexecuted model scope or the pending GUI/ambiguity/format approvals.

Source commits:
  9c0e1231c6bbc710bc9fe411fe9c8daa663dbda4: native allocation sequence;
  61cd567e1236530ac535527f18b45e98f60195a6: awaited native release;
  b8dde428464039064f0657b0bfb166a383bf98ec: finite confirmed history/batch;
  6deb6b745fc01e1b959607e17b723eaa25bc23c9: launcher checks/preservation.
Note017's final sections record rationale, rejected alternatives, exact owners
and focused failure/recipient evidence. Production requires explicit positive
confirmed_history_records (authored example64); no implicit/unlimited mode or
in-window preservation exemption exists. Copy needed evidence outside store
history BEFORE expiry. Existing stores/capsules/installations were not purged.

The complete maintenance order is clean controller/lifetime -> whole confirmed
archive -> exact host release ACK -> expiry -> fresh admission. One original task
owns an admitted batch through stop/cancellation, bounded drain and settlement;
stop before its inventory gate starts none. Unresolved work holds dependencies.
History keeps newest receipt.committed_at/filename records; only expiry admits
ALL old payloads, one at a time, before unlink. Stopped active recovery is not
blocked by an unrelated malformed historical payload, while that payload still
blocks ALL expiry. Partial delete/sync failures retain phase, observed removals,
uncertain target, original cause and unconfirmed sync, without retrying deletion.
The steady/history-plus-active/staging logical bounds are in017 and operator docs;
fstatvfs remains an observation, not reserved blocks or a filesystem quota.

Focused contained results: native allocation57/21.776s; store/admission36/0.510s;
service46/10.148s; receiving/process64/34.282s; core diagnostics8/0.002s;
required config lane passed; repository/provider-core49/1.619s. Three independent
read-only lenses challenged ordering, recovery/preservation and policy/callers.
The final small native test joins the ACTUAL Python release helper to the same
recording host after all five original consumed/archive/channel-retirement
assertions pass; it receives frontier5, empty history and the sole stable ACK.
Three request slots/five creates/five exact removals are unchanged. This is a
protocol witness with recording engine, not released-model or deployed proof.
Ruff0.15.15 and diff whitespace pass. All expiry roots are disposable fixtures.

One offline controller build at6deb6b7 produced:
  sha256:e0c953f63a1c3ad51250aff8c5e03b40876053d6684b39beefb0e67f0a357330
Committed provider-input Git-tree SHA256 (also admitted by installed lanes):
  dde514d04341990fce9cd9ca62477aeffe629464d1f01ccd514a0a6383843ef8
Image-ID record .work/provider/image-id SHA256:
  9d1eabfcc8b7e5f1a65268ace025fec3c9472a6fb54c56da51fc321cad4bdeb0
requirements/provider-core.lock unchanged SHA256:
  79c90c01283941561cbc6f5838f700f5dd932388890ba7510e55bf5d23a11dac
make test/integration/provider-runtime passed4/0.721s; make
test/unit/provider/api-stage passed15/3.434s against this image. The latter
generates and admits fresh synthetic provider TOML including required history64
through the maintained staging/config owners, preserving scoped key/CA grants,
budgets and real-versus-scripted profile selection. Actual private GUI config is
staged afresh by its maintained lane after authorization, not copied from R48.

No paid model/API/GUI call, scientific rerun or deployment occurred. Existing
R13b/R15b/R37/R46/R48 scientific evidence remains unchanged and is reused within
its recorded applicability. This installed-runtime and local ownership evidence
does not close003's actual GUI submission or real semantic-decision gates.

R53 observed first API run: blocked before Job creation
------------------------------------------------------
2026-10-23T04:49:08Z, committed caller ee5347a; unchanged controller
sha256:e0c953f63a1c3ad51250aff8c5e03b40876053d6684b39beefb0e67f0a357330.
Private source/functional receipts:
  /tmp/nmrnet-api-sdf-ee5347a-20261023
The staged config used the refreshed required confirmed-history setting. The
provider admitted startup and published Hello before the client dispatched.

Observed effects: directoryGET200, Upload reservationPOST201, publication grant
POST200, exactly one original byte PUT returning502. No finalize, Job creation,
provider selection/open, model call, native allocation or scientific prediction
followed. The finite client exited1 and the outer Make lane exited2; this is a
FAILED external run, not a delivered SDF result or a new scientific reference.
Original Upload:
Reservation operation_ref:
  nmrnet-upload:6a284776f5e8484d97fc7aaf44e2af26
Actual deterministic ZIP:1150 bytes, SHA256
  d86346eef612e88d7d1895f64594676a9d87593c32e3c704a2578b0a1ad751fc
Member remains the pinned1010-byte SDF above. No mutation was retried.

One additional signed GET of the ORIGINAL Upload through the captured Client
and existing contained host lifecycle owners returned200: content_hash null,
finalized_at null, byte_length1150. Functional request/head/body evidence is at
reconcile/output/001-original-upload.* beneath the original private root. This
establishes reserved/unfinalized, not whether bytes reached durable storage.
The one-off read command is /tmp/nmrnet-read-original-upload.sh; it performs no
publication/finalization/Job operation. Request diagnostics contain no key,
bearer or transcript; separately granted staged credentials retain their existing
private owner and permissions.

Exact client, selection, stage, startup-capture, controller, API/store/model
proxies and the reconciliation reader all have successful original removal
receipts. The native request/history and durable active state stayed empty.
The original client CID58d1560f10ddbc7bb2a9ee71426508333fb3cc82d0f96cde31e8ea0671909ed4
retains its failure in bounded Docker journald. Its owned AssertionError reports
HTTP502 and explicitly warns that bytes may have arrived; no downstream
mutation/retry was performed. No ordinary stdout/stderr dump was created.

Next prerequisite: the external service owner restores the Upload transfer
service and establishes the original Upload's byte state. Any continuation must
use this original identity and exact ZIP bytes; a new reservation/Job or repeated
PUT is not inferred from failure. Ambiguity/format batches remain unapproved.
003 remains open; no browser submissions are required to replace this API proof.

R53 continuation authorization and original-Upload reconciliation
-----------------------------------------------------------------
The user subsequently authorized restoring the ordinary stopped local transfer
service and following the SAME Upload's documented recovery; the earlier failed
run is not erased. No duplicate Upload/Job, remote deployment or other model batch
is authorized. The original container had clean shutdown logs, exit143, noOOM
and no engine error. A service-only Compose start under the API stack's existing
lifecycle lock and project/network admission restored the same c4428b31f373
container/image at2026-10-23T04:56:58Z. No rebuild, replacement, credential write,
sibling source edit, migration or whole-stack up occurred. The command reused
Makefile owners through /tmp/nmrnet-resume-upload-store.mk; this is a one-off
invocation of their existing service contract, not a new stack authority.

Verified LIVE public and transfer modules (both /workspace/nmr_api) against the
inspected sibling source:
  upload_transfer_http_contract.py SHA256
    d6e735a289d1d9d01bd5fa155d190ad33e7f41942b5be07d2d7e29eb5e8a6e8c
  public/routes.py SHA256
    116f6436cd1a993b2c458ec762afec7667968a8ce096635618bffb868e9296a8
The former lines173-183 distinguish existing immutable bytes from uncertain
publication; the latter lines702-708 explicitly permits a fresh capability for
the SAME Upload, with a possible lifetime extension. Neither implies a new Upload
or another Job. Live LocalUploadStorage.inspect under the original Upload's
exclusive lock, with5slock/20sprocess bounds, returned AbsentUploadInspection,
state absent. Exact functional result: original root's
reconcile/storage-inspection-state.json. The earlier bare{} inspection result
omitted its property/type because the absent dataclass has no data fields; it
was not treated as evidence of absence. The explicit owner-state result is the
causal basis for another transfer, not content_hash null or the gateway502.

The same maintained SDF target now accepts explicit command-line-only
UPLOAD_RECEIPT, granted as one read-only original reservation artifact. Its
current command selects exactly original client/upload-created.json; this
operator-selected artifact is the reservation authority, never a model choice.
The client verifies the same ref/owner/project/length/creation facts against a
fresh API GET and refuses changed/finalized input before capability issuance.
It reuses the existing grant/PUT/finalize owner without Upload creation, then
uses the original Job creation/attachment/selection/open owner once. The target
still requires a fresh private OUTPUT, exact scientific preflight and unchanged
900/1200/1220sbudgets. No automatic retry or generic recovery framework is added.
Independent review accepted this explicit operator authority after challenging
whether a second caller-selected request file would add a real proof; it would
only duplicate the operator's selection. No claim is made that null metadata
alone authorizes publication. Focused continuation checks and actual outcome are
recorded after their observation below.

R53 successful API delivery, 2026-10-23T05:04:19.258459Z
-------------------------------------------------------
Continuation caller source154be58af09a0d87bca566464ce6250d477ced8c; unchanged
controller e0c953f63a1c3ad51250aff8c5e03b40876053d6684b39beefb0e67f0a357330.
Private original continuation root:
  /tmp/nmrnet-api-sdf-original-resume-20261023
Compact preserved functional evidence (no credential, bearer or stream dump):
  .work/qualification/api-real-openai-sdf-zip-154be58
Manifest .work/qualification/api-real-openai-sdf-zip-154be58.sha256, SHA256
  44a26ae02362df880c7011ce21699aae6685bd42bfb9ebedd73feff371cdd854
The capsule retains scientific/API request and response facts, confirmed terminal
record, source/image declaration, exact host removals and native release ACK;
74 files/436KiB on this filesystem. The first502 and subsequent explicit absent
inspection are retained alongside success. Original private runtime/config roots
remain separate; no whole credential-bearing tree was copied into the capsule.

The renewed capability named the ORIGINAL b3400b6c...b2c87dc Upload; exactly one
new PUT of the identical1150-byte/d86346ee...ad751fc ZIP then returned201, and
finalization200 at2026-10-23T05:03:58.361600Z bound that hash/size. This was an
explicit evidenced recovery, not a blind automatic retry. No new Upload
reservation was sent. One Job was created, attached, selected and opened:
Specification fingerprint:
  sha256:82151a9ca7e2433ff5b4a23dfebd0345ba63056456a62793b654deda847f889a

The API final history reports exactly one succeeded Attempt. Its result read
(response049) decodes byte-for-byte to client/scientific-result.json,15646 bytes,
SHA2568a4f2e51ec4356ffcaa9169eb006e08416bfc4add32733837e242b98fae2ec62.
The independently received confirmed terminal receipt retains that same result
identity/fingerprint at05:04:19.258459Z. client/passed.json SHA256
  46fa5aa27148993cfa8bcd50314313be3ae70d7cf0709e7c9858c147e6419844
reports real interpretation, scientific_repeatability true, gui_exercised false,
49 API/transfer requests including bounded GET polling. It is not49mutations.

Real GPT-5.6 Luna interpretation used3turns/0corrections, operations exactly
inspect_uploads -> inspect_upload -> prepare_upload, one selected endpoint.
Configuration identity SHA256:
  71471bf0f3eb021c90994c89e8065dcf50e708004cd0cb125127957d14b6e12f
This records selected-model file/member/record decisions on this instruction;
it does not establish the separately pending ambiguity/other-format decisions.
Both carbon-only records retain atom IDs1..4, source record1then2 and the exact
1010-byte member hash. No H atoms or coordinates were generated, records were
not averaged, and supplied H completeness remains unestablished. All geometry
IDs, request hashes, atoms/order, prepared/binary32 coordinates, preparation,
coverage, predictions, selected models, native image/runtime facts equal R46
EXACTLY. Ordered prepared request SHA256s:
  d56479cd4fb876dc9c783acffd52dbbe2a01d419aa34b378e1d565fd8ff6ec06
  a752e8d06b653fcfd14b1e247a10d95a2d939de7365f9c90a67ad7e2d1425ccf
No reference output was regenerated or tolerance widened. This is native/API
repeatability, not a new independent experimental accuracy assessment.

The normal host/finite client returned0 and all eight original host components
have exact successful removal receipts. Three native allocations settled;
requests/.release-history and receipts/.history-released agree on frontier3,
with empty native history/owned/IPC and no active Attempt record. Confirmed
terminal history retains the result. The separately restored API transfer service
remains with its stack owner; it is not a disposable NMRNet-owned worker.
Capture manifest SHA256a5b463957b796b4012fd81bb81fe2e0cc67229c4d0787e0281836e81c46686c2;
execution declaration SHA25610e87b37c4c9a4ba38acadb776a2809fb0e7ca38bb0ce9336fc1af73e71b2bc7.

Observed warning, retained rather than erased: host shutdown printed "Cannot
release native history: the current handoff must be a private regular file."
The successful already-released ACK fast path returned0 without clearing its
transient pre-validation diagnostic. It was NOT an unconfirmed deletion: the
exact frontier3ACK and empty history independently establish release. Shell-only
fix087a090 clears that transient diagnostic only after the private request and
existing ACK both match the previous frontier; failure latch/negative paths are
unchanged. Its existing repeated-service test now asserts an empty diagnostic.
Independent review confirmed cause/fix. No paid/native/scientific rerun followed.

Focused continuation validation: client36/0.727s; stage/composition15/3.840s;
operator-inputs26/6.750s; Ruff0.15.15 and bash/diff checks pass. The later57-test
allocation lane had56passes and one unrelated50ms retirement-observation timing
failure. Only that test and the changed repeated-release regression were rerun
contained:2/2pass in2.109s, with no timeout/tolerance changes. That broader failed
exit remains recorded; it is not described as an all-green57-test run.
Independent source-aware review and read-only actual-result review confirmed
byte/hash joins, both ordered exact R46 geometries, original Upload and one
Job/Attempt, three real-model turns, and no scientific/GUI overclaim.

003's current remaining product observations are the separately unapproved
ambiguity and MOL/PDB/MOL2 argument-choice batches. They need no new full
scientific/API matrix. User correction removes browser submission from this
provider qualification; prior GUI readback remains its own narrower evidence.

R54: real ambiguity and remaining-format decisions, 2026-10-23
--------------------------------------------------------------
The user explicitly authorized BOTH remaining batches with "Ok, run". Both were
executed once through their maintained Make targets; they are no longer pending
or merely offline-tested. Caller source revision:
  e211390fbf1bc18d5f106f46b871f77d8008bc9a
Controller image:
  sha256:e0c953f63a1c3ad51250aff8c5e03b40876053d6684b39beefb0e67f0a357330
Explicit endpoint: https://model.example/v1, configuration_id
openai-gpt-5-6-luna, model gpt-5.6-luna, reasoning_effort none, max6turns/case.
Fragment SHA256398cf74795533adf8205005c072f125a815f9c663b01b01c5b2856628cf14e5f;
admitted endpoint SHA25671471bf0f3eb021c90994c89e8065dcf50e708004cd0cb125127957d14b6e12f.
Batches had separate roots and no shared conversation/state.

Process/host budgets800/820s, exchange/retirement25/5s. Actual batch passed4/4,
outer exit0; each conversation had zero corrections/preparation attempts:
  table-unit-missing        source_unit_unclear          1turn
  smiles-count-missing      conformer_count_unclear      1turn
  upload-record-unspecified record_selection_unclear     3turns
  unsupported-input         other_input_problem          1turn
All four original selection/admission/probe/proxy containers have successful
exact-ID removal receipts; no unresolved model connection required host salvage.
Source-hash manifest SHA256:
  db918157294fd12700c9f8860d3201e46581c8b0aea4d0c6133361a0165a87df
probe/result.json SHA256:
  7ee014449650f8ef9a4aff6a4a67f3e4c0fbb0124f2e42dde1af19153414258f
Preserved compact functional capsule:
  .work/qualification/interpreter-ambiguity-e211390
Adjacent manifest .work/qualification/interpreter-ambiguity-e211390.sha256:
  SHA2562e3445f06e43338731005331204298b1269b47e59a69050ec246668d903123d9

Formats command: make provider/qualify/interpreter/formats with the SAME explicit
fragment/interface/resolvers and fresh OUTPUT:
  /tmp/nmrnet-interpreter-formats-e211390-20261023
Process/host budgets615/635s, exchange/retirement25/5s. Actual batch passed3/3,
outer exit0, zero corrections. Each chose prepare_upload exactly once:
  mol:  source_format mol,  source_unit angstrom, selection null, 2turns
  pdb:  source_format pdb,  source_unit angstrom, selection[2,1], 3turns
  mol2: source_format mol2, source_unit angstrom, selection[2,1], 2turns
Each selected the authored direct-file Upload; member omitted/null. PDB alternate
location was null; the predicate also permits other admitted labels that cannot
change the fixture's blank-site atoms. These are actual observed arguments,
not outputs fabricated by the probe. All four original helper containers have
successful exact-ID removal receipts; no held connection required salvage.
Source-hash manifest SHA256:
  efee7b9bd8dd923b3e55c2f80f952aeb5901fa74f022dcae73e30f917aa22837
probe/result.json SHA256:
  b8cca2784cd628f5bf7d1f25835b9c191e318eabe18f5b5856d583e1bf368b18
Preserved compact functional capsule:
  .work/qualification/interpreter-formats-e211390
Adjacent manifest .work/qualification/interpreter-formats-e211390.sha256:
  SHA2566e763cda00e368dd289f0fac934dbdd18d943c725a381e363f499fef4f5e7650
Both capsule manifests verify. They retain admitted profile, case observations,
source/image facts and exact helper posture/removal receipts, without copying
keys, bearer credentials, raw transcripts or stdout/stderr dumps.

Rationale and proof scope
-------------------------
The seven cases address concrete gaps, not repeat the scientific matrix:
- Earlier successful cases supply the needed units/count/selection. They cannot
  establish whether the interpreter guesses missing values or notices that no
  supported molecular input was supplied. These four explicit omissions require
  a safe owned input-problem outcome before preparation. Problem categories are
  existing user-actionable tool choices; the check does not demand exact wording
  or a particular free-form explanation.
- Earlier XYZ/SDF/SMILES decisions and deterministic reader tests cannot establish
  real-model selection of MOL/PDB/MOL2 options. These formats have different
  record/model/alternate-site conventions; wrong format or [1,2] instead of the
  explicitly requested[2,1] can fail or change the scientific input. The three
  cases test those reader-specific arguments using real option admission.
  The single MOL uses the existing null-selection tool contract. They do not
  prescribe arbitrary explanatory wording, model inspection counts or a PDB
  alternate-site label that cannot affect this fixture.
The model was not told expected_issue, expected argument dictionaries or outputs.
No corrective preparation feedback was supplied. Successful format choice ends
selection without another model submit/token exchange. Counts above describe
these observations, not a prescribed dialogue length.

Both targets use authored instruction/inert attachment metadata with synthetic
Job/Upload refs: authenticated_api_jobs=false, scientific_work_performed=false.
Format preparation is INTERCEPTED after actual argument selection: no Upload
transfer, file-byte acquisition/parsing, RDKit generation or NMRNet prediction
ran. The four ambiguity decisions use6real exchanges total; the three format
choices use7. Total13paid exchanges,7cases, no new API Job or scientific rerun.
These qualify this selected endpoint/configuration on these authored instructions,
not arbitrary phrasing, universal language understanding, truthful chemistry in
free-form reports, or a full per-format deployment matrix. The model's raw
explanation remains explicitly unverified in its protected case evidence.
Existing R37/R46 native science and R53 authenticated API composition retain
separate authority; no expected output or tolerance was changed.

Scientific-guide receiving handoff
----------------------------------
The already observed R53 directory response001 contains provider_description
with https://numpde.github.io/nmrnet-repro/. It was received from the signed API
before that one Job; no new API read/Job/model call was made for this handoff.
Preserved exact response:
  .work/qualification/api-real-openai-sdf-zip-154be58-provider-description.json
  SHA256cdea8be4e00beab8e889693a60f83cb2dd533ff52c89b63dc7f0c7a14805efc3
Offering description remains "Coordinate shifts"; the scientific link belongs
to the NMRNet-owned provider description, not a generic provider-core fallback.
Current docs/index.html and notes003/017 distinguish observed API/native science,
real argument/problem decisions and separate existing GUI readback. No browser
submission is required under the user's correction. This completes003's current
required local outcomes and documentation/evidence handoff; operating/scientific
limits at the top remain. It makes no remote deployment or additional consumer
integration claim. No implementation, new tests or broad audit was needed for
these runs; independent review checked the retained outcomes and their scope.