011: Repository-check ports for discussion

Dated design and evidence record. Original wording, line order and historical source identities are preserved; use the current guides for operation.

011: Repository-check ports for discussion
=========================================

Scope
-----
Port potentially applicable conventions from sibling repositories without
weakening predicates, hiding failures, adding waivers, or repairing production
code to satisfy them. Repository violations remain red for discussion. Changes
to the test launcher only expose required public read-only source inputs and
caller identity; they do not install tools or change model execution.

Source and adaptation records
-----------------------------
The authoritative assertion crosswalks, source revisions, immutable source
links, local mappings, and reasons for domain-specific exclusions are:

- repository_checks/quality/PORTS.md
- repository_checks/science/PORTS.md
- repository_checks/fixtures/containers/source_crosswalk.md

Check modules also document their source and adaptation in place. Source
discovery covered sibling repository_checks, repo-checks, tests/checks,
tests/repository, and tests/repo_checks conventions. The copied project snapshots
under openai-build-week-2026-07 were considered alongside the current standalone
repositories. Application-specific assertions do not create absent providers,
Compose deployments, checkpoint volumes, chemistry parsers, or layered locks.
Their dispositions remain reviewable rather than being counted as passing tests.

Execution boundary
------------------
Use make test/repository. Python, behavioral shell probes, archive fixtures and
Git fixture operations execute inside its offline contained lane. Its grants
remain caller UID/GID, read-only root/public source inputs, no capabilities,
no-new-privileges, two CPUs, 512 MiB memory without swap, 64 PIDs, and a 64 MiB
noexec/nosuid/nodev scratch tmpfs. No engine socket or network is granted.

The host launcher records immediate root-entry types and names with find.
Checkers compare this independent inventory with the mounted public source
tree. A future public source path or cache that is not mounted fails visibly.
Private/control roots .git, .agents, .codex, .aws and acquisition/runtime .work
are classified without disclosing their contents. Only the temporary inventory
file is mounted from .work; the launcher removes it on exit, including failure.

The existing Python base image is reused without pulling or installing. Git,
GNU Make and Ruff 0.15.15 are missing contained prerequisites for some checks.
Scientific Git proofs also require a reviewed read-only Git object database
grant, which the current launcher deliberately does not provide. These failures
must not be interpreted as passing mutation proofs or repository violations.
Tool/image provisioning and Git metadata grants belong to the discussion.

Review and evidence
-------------------
Implementation was delegated by convention family, followed by independent
reviews of a different family. Accepted corrections strengthen the ports:
distinct fake engine ownership identities, actual empty-discovery execution,
strict staging-directory absence, archive-byte parent binding, exact historical
producer inventories, and stronger build-context observations. No production
exception was added to make a check pass.

The first contained run is retained at
.work/qualification/repository-check-port-20261014/initial.log and initial.status.
It ran
224 tests, with 60 failures and 33 errors; it preceded port corrections and is
not the final inventory. Errors include missing contained prerequisites and
port fixture defects, which are distinguished from genuine repository reds.

The unchanged contained unit lane passed all 155 tests after launcher changes.
No checkpoint inference, download, dependency installation, or publication was
performed for this check port.

Reviewed port result before production fixes
-------------------------------------------
The suite contains 261 test methods: the existing 8, plus 129 general, 43
scientific, and 81 container/build/operator checks. The reviewed contained run
finished in 13.422 seconds with 81 failure records and 22 error records; Make
returned 2. Unittest subtests can contribute several failure records from one
method, so these counts must not be subtracted to invent a passing-method count.
Evidence: .work/qualification/repository-check-port-20261014/reviewed.log and
reviewed.status.

All eight effective kernel posture tests, complete public-source visibility,
early shared guard coverage, and the seven-lane native runtime grant matrix
passed. Detector fixtures, corrected Docker continuations, exact ZIP binding,
historical producer inventory mutations and attribution mutations also passed
where they did not require unavailable Git. Independent review of the corrected
code and completed run found no remaining port fixture defect in that pass.

The red results fall into three different categories:

- Failed proof prerequisites: contained Git, Make and Ruff are unavailable;
  committed/historical source proof also lacks Git database grants. Native EOF
  and descendant-retirement scenarios lack a reviewed adapter to a supported
  deadline control, so they fail before dispatch. An outer fixture timeout does
  not establish an operator deadline. No blocked scenario is claimed as passed.
- Observed behavior differences: mutable authored build context and mode/byte
  drift, missing observed import-image admission, inherited engine/proxy/auth
  configuration, malformed container ID authorizing attempted effects, private
  native diagnostics, interrupted status reclassification, split lock/advisory
  publication, raw zero-test discovery, permissive declaration fields and proxy
  port/header/resource/protocol behavior. Some are source or offline injected
  proofs; they do not certify real network routing or live builder behavior.
- Repository-policy gaps: help/default/Make ownership, Python defaults and AST
  posture, caches, Dockerfile/frontend conventions, absent workflow, stricter
  lock header, and missing source/context/attribution declarations. Imported
  checker code is included in applicable scans and can itself be red. Missing
  facts are not fabricated merely to satisfy a schema.

Authorized obvious fixes
------------------------
After reviewing progress, the user authorized delegated obvious fixes while
leaving the remaining choices for discussion. Initial bounded fixes are ordinary
Make help/default behavior and literal ARCHIVE/STAGE admission, closed artifact
and source declaration fields, and proxy destination-port/header handling.
Independent review follows each small coherent change. No blanket style edits,
source-manifest generation, attribution facts, dependency installation, deadline
architecture, or publication is implied by this instruction.

The Make discovery slice adds help to the phony inventory and declares help as
the ordinary default goal. Existing target names and execution recipes stay
unchanged. Its only recipe is shell printf, with no Docker or Python call.
The source checks have a literal overlap conflict: dapp hygiene recognizes only
bare `.DEFAULT_GOAL := help`, while API recipe ownership requires the override
form plus shell/recipe flag overrides. The slice uses the bare explicit default.
It neither duplicates default-goal authority nor changes the imported predicates.
Hostile MAKEFLAGS override policy remains red for discussion.
Host verification ran actual `make` and `make help` with Docker, Python and UV
replaced by rejecting sentinels. Their output was identical; all 19 targets were
advertised and phony, and no sentinel was called. This is command-discovery
proof, not a contained Make prerequisite fix or a model execution claim.

Completed fixes and added regression checks
------------------------------------------
- Make unexports all seven raw selectors: ARCHIVE, STAGE, WLAN_INTERFACE,
  LABEL_ATOL, ATOL, RTOL and RUN_ID. Origin/value aliases preserve command-line
  inputs literally. ARCHIVE/STAGE shell consumers now use only their aliases;
  stage-apply guidance points to the maintained Make command. Unexporting also
  closes GNU Make's implicit export expansion of the already-admitted variables.
  Tolerance numeric validation still belongs to contained baseline_run.py;
  literal preservation does not claim pre-engine numeric validation.
- Release and Uni-Core source loaders reject unknown/missing declaration fields
  before acquisition. Their existing identity and publication semantics remain.
  Duplicate JSON fields, additional metadata value policies and receipt producer
  requirements were not silently claimed as repaired by exact-key validation.
- Proxy destinations require ports 1-65535; explicit HTTP port zero cannot select
  a scheme default. The 64 KiB limit counts header bytes through CRLFCRLF and
  preserves coalesced body bytes. Error diagnostics retain only phase and class.
  Forwarding is marked before its first write attempt, preventing a second HTTP
  status after uncertain writes or CONNECT setup. DNS/deadline/capacity/half-close
  and readiness refinements remain separate discussion items.
- Acquisition startup requires a full lowercase container ID agreeing with its
  regular nonsymlink CID receipt. Receipt comparison is byte-exact: 64 hex bytes,
  optionally one LF. Bash's NUL stripping cannot admit a malformed receipt.
  Interrupted creation can recover identity from its private owned receipt before
  stdout assignment; disagreement between nonempty identities cannot fall back.
  Cleanup refuses an unadmitted ID, retains uncertainty evidence, and retires and
  joins its owned attach client if a started worker's receipt becomes invalid.
- Removed only the observed untracked tools/__pycache__/package_lock.cpython-312.pyc
  and its empty parent. No acquired/model/result evidence was deleted.

Three new repository methods cover literal raw-selector export and actual
ARCHIVE/STAGE delivery. Two further repository methods came from independent
review findings: exact 65-byte NUL-bearing CID rejection and cancellation after
a started worker's receipt is corrupted. Both reach the actual lifecycle phase;
fixture timeout cleanup cannot make them pass. Original assertions and source
predicates remain intact; positive launcher fixtures use the admitted alias
contract rather than restoring ambient input acceptance.

Independent review followed each small implementation bit. The CID byte and
cancellation findings were fixed and exercised before two final independent
reviews found no remaining actionable issue in those changes. This does not
claim the broader remaining repository policies are satisfied.

Final contained evidence after obvious fixes
--------------------------------------------
The maintained unit lane passed all 182 tests in 5.309 seconds, exit 0:
.work/qualification/repository-check-port-20261014/obvious-unit.log and
obvious-unit.status.

The maintained repository lane ran 266 methods in 15.592 seconds, with 75 failure
records and 20 error records; Make returned 2:
.work/qualification/repository-check-port-20261014/obvious-repository.log and
obvious-repository.status. Counts include subtest records, not distinct failed
methods. Its inventory is 8 original, 129 general, 43 scientific and 86
container/build/operator methods. Both new CID regressions, proxy port/header/
failure handling, closed declarations and ordinary Make help/default checks
pass where their execution prerequisites are available.

Focused real-Make evidence used an already-loaded sibling checker image,
sha256:59691117caaac50ea089b0ccc4c27afadf666a6b1b58a78a92540232afcce5b5,
with ten OperatorInputTests passing. The command was Python -B -m unittest -v
repository_checks.test_operator_inputs_port.OperatorInputTests, with entrypoint
python3, workdir /workspace and read-only tools/tests/repository_checks/containers/
Makefile mounts. The container had no network/socket, no image pull, read-only
root, UID/GID 1000:1000, dropped capabilities, no-new-privileges, two CPUs,
512 MiB without swap, 64 PIDs and 64 MiB noexec/nosuid/nodev scratch. The guard,
no-bytecode marker and PYTHONPATH=/workspace were supplied explicitly. Engine
selection used the same four-variable scrub and local Unix endpoint as the
maintained lane. This is a separate focused proof, not a maintained-image change.

Twenty focused launcher/guard/network-gate tests also passed in the maintained
pinned Python image with only tools/tests read-only grants. These two earlier
focused runs were retained in tool output only, not in standalone log files;
their success must not be cited through invented artifact paths. The later full
unit and repository logs above are the retained final evidence. No dependency
installation, acquisition, real checkpoint inference, publication or push was
performed. The code-input hashes are retained in the adjacent source.sha256.

Remaining discussion items
--------------------------
Failed prerequisites remain explicit: Git and its reviewed object-database
grants, Make in the maintained checker image, Ruff 0.15.15, and a reviewed adapter
to supported native deadline control. Blocked Git mutation and native EOF/
descendant scenarios have not become passing proofs.

Remaining behavior differences include mutable inference build inputs and image
admission, engine/proxy/credential environment inheritance, interruption status
handling, lock/advisory publication as one transaction, the empty-discovery
exit-status contract (observed 5 versus imported required 2),
and the unimplemented proxy transport/resource/readiness obligations. Remaining
policy questions include Make override ownership, source/context/attribution
declarations, strict lock header and tool provisioning, Dockerfile frontend/base
notation, missing workflow, Python style/default conventions and Ruff scope.
Some source policies conflict literally or flag newly imported checker code;
those findings are visible for adjudication, with no added waivers.

Concrete log examples and their limits are preserved in
notes/012_repository_check_log_findings_20261014.txt. In particular, empty
discovery already fails; its recorded red is not a successful zero-test lane.

Discussion order
----------------
1. Separate failed prerequisites and port defects from repository-policy reds.
2. Address observed boundary failures: image/engine identity, cleanup and private
   diagnostics, mutable build inputs, proxy behavior, and lock/advisory publication.
3. Decide applicable scientific source/producer/context and lock conventions.
4. Discuss general Make/help/discovery, defaults, AST style, cache and Ruff policy.
   Preserve the original predicates until those decisions are explicit.

The remaining discussion topics are not authorization for broader production
repairs. The obvious fixes above are complete; the working changes remain local
for discussion.

Evidence relocation (2026-10-14)
-------------------------------
The completed check-port captures now reside under
.work/qualification/repository-check-port-20261014/. Captured commands, scripts,
logs and receipts keep their original bytes and embedded historical paths; use
maintained Make commands to rerun checks. The relocation map, before/after hash
inventories and protected-evidence verification are retained in
.work/qualification/tidy-20261014/.

Historical lifecycle observation
-------------------------------
The tidy audit found two running acquisition proxies paired by private CID
receipts with workers that had already exited. Fresh receipt, ownership, mount
and consumer checks admitted retirement of those four containers and their two
private scratch directories. Subsequent independent engine inventory confirmed
their absence. This is an observed historical leftover, not proof of a current
cleanup bug; these receipts do not identify the original executing launcher bytes.

Local evidence is .work/qualification/tidy-20261014/orphan-resources/:
pair-{1,2}/before.txt:1-2, admission.txt:1-5 and after.txt:1-3, with copied CID
receipts and removal-order.txt. summary.txt:1-5 has SHA-256
77abebbfbb9f1004cc50f93bfbedffdc3d4001ffe0642c4ebff4bc4008f67159.

Foundation goal and acceptance (2026-10-14)
-----------------------------------------
Complete the foundation before slice 002. Every applicable repository check and
the unit suite must pass, with independent review and affected qualification.
Treat each check as having a purpose: trace its original obligation and local
owner before changing applicability, assertions or fixtures. Reshape checks only
as necessary for durable local contracts; document the reason and retain the
negative proof. A red requires an explicit disposition, never a silent waiver.

CI is deferred. When introduced, it will cover minimal critical checks. The
imported mandatory-workflow assertion needs an explicit applicability decision
consistent with that deferral; workflow safety obligations remain relevant when
workflows exist. Judge default/style findings by meaning and intent, especially
the distinction between hidden operator choices and justified internal defaults.

Sequence:
1. Provision the dedicated contained Git/Make/pinned-Ruff checker and reviewed
   read-only Git inputs. Acquire dependencies through an explicitly selected
   interface, verify their identities, build offline and record the image ID.
2. Authenticate source/build inventories and actual producer bytes. Preserve
   historical receipts/reference bytes; missing historical proof needs reviewed
   qualification, not invented execution facts.
3. Freeze build inputs and admit observed image identities. Recover paired
   lock/report publication on handled failures without overstating crash or
   concurrent-reader atomicity.
4. Close native execution, environment and proxy findings, then applicable Make,
   discovery, lint and default-policy findings by their actual obligations.
5. Run the complete applicable gate, independently review, repeat affected
   qualification, document exact sources/results and commit coherent slices.

Implementation is delegated in small owned changes, with independent review
after each meaningful bit. All Python, package/archive/model execution and tests
remain contained. Host actions are shell/Git/engine orchestration with explicit
input/output grants; no host dependency installation or implicit acquisition.

Foundation: handled lock/report publication recovery
---------------------------------------------------
The first production repair prepares both candidates and snapshots predecessor
bytes/modes before replacing either fixed output. A handled publication failure
restores consumed members or their original absence. Failed recovery retains
private evidence and annotates the original exception; failure inspecting one
candidate cannot erase that exception or abort recovery of the other member.
This guarantees handled-failure recovery, not atomic concurrent reads or crash
recovery. The source comments cite the exact SECS staging and NMRPeak retained-
tree precedents and explain why their fixed-path/tree contracts differ.

Independent review identified and corrected the candidate-inspection boundary;
focused tests also cover missing expected backups, after-rename interruption,
preparation failure, predecessor modes/absence and cleanup uncertainty. The fresh
maintained contained unit lane passed 201 tests in 5.667 seconds, exit 0, including
the separately implemented checker-admission tests. Evidence:
.work/qualification/foundation-20261014/unit-first.{log,exit,started,finished}.
Post-run checkpoint fingerprints are retained in first-slices.sha256 alongside
that log; they are not a pre/post execution binding. The base image and grants
are the maintained unit lane's. Later frozen-source qualification must bind the
complete executed checkout before the foundation is declared closed.
The original LockPublicationTests repository case and six workflow-scope checks
also passed in a focused offline non-root container with only tools/checkers
read-only inputs. That seven-test result is retained in tool output only.

Foundation: source closure and orthogonal implementation
-------------------------------------------------------
Source, checker wiring and native execution use separate file ownership in the
same checkout. Each small bit receives independent review before integration.
The complete source declaration authenticates all 37 pinned LICENSE/uninmr blobs
and declares ten authored image inputs. The historical image's actual source
bytes were inspected offline: its immutable ID/revision and 37 hashes match.
A retrospective supplement binds that observation to the unchanged reference;
it does not claim an original frozen build context. Both historical producer
Gitlinks and bytes remain authenticated. artifacts/SOURCES.md records exact
sources, attribution unknowns and the qualification method/limits in place.
Independent fresh review passed 17 mutation proofs and five actual gates. The
committed authored-context gate remains pending the reviewed commit.

The dedicated checker was acquired through the explicit admitted interface and
built offline from the verified 20-artifact closure. Installed Git 2.39.5, Make
4.3 and Ruff 0.15.15 matched their pins. Image ID:
sha256:014805dcdfe7e9814bc45e19bef58d9ab7a15db08ece9c68b86306828d3adcee.
Exact materialization/version/retirement evidence is retained under
.work/qualification/checker-foundation-20261014/materialization/.
CI remains deferred. The first aggregate after checker wiring is an inventory of
remaining failures, not foundation closure; logs/exit are under
.work/qualification/foundation-aggregate-20261014/.

Reviewed frontend ownership is the selected local engine's built-in frontend.
An external syntax directive could fetch independently of network-none/pull-false
and would add an unrequested registry authority. A real offline named-context
and RUN-mount capability probe passed before checker installation. This does not
pin the engine compiler across hosts. Recipe FROM identities are now literal
unchanged digest pins, and the lock recipe has an explicit nonroot default.
The frontend gate rejects both pinned and unpinned external syntax directives;
its other generic hardening predicates remain intact. Four focused import-order
and recipe-hardening checks passed; retained log is
.work/qualification/foundation-policy-20261014/current.log.

The Ruff policy retains all selected prefixes and authored trees. PT009/PT027
map to the actual unittest owner; the early-guard E402 exception is paired with a
strict independent late-module-import gate and rejection fixtures. Other lint
and formatting findings still require repair. This is a purpose-based adaptation,
not acceptance of the current red aggregate. See science/PORTS.md for the exact
source crosswalk and rationale.

Foundation: native execution review and reaping
----------------------------------------------
The native inference boundary observes image identity before import/publication,
retains at most 8 MiB of private output (0700 directory, 0600 log), drains excess
output and preserves actual client/cancellation/validation outcomes. Build/import
budgets are explicit 900/120 seconds by default; --timeout overrides that main
client only. Metadata admission has its own 30-second deadline and wheelhouse
preflight has 120 seconds. These are client budgets, not an engine-side work
cancellation guarantee or a total workflow deadline.

Independent review found and reproduced a TERM-resistant writer retaining a
pipe after its monitor expired. The ownership anchor now survives TERM until
whole-group retirement, with a separate expiry fact so late success cannot turn
an expired budget green. A published terminal receipt cannot be overwritten by
later expiry. Cancellation traps precede spawning; raw build preflights now use
the same private bounded boundary. Nine focused methods passed with exact
executed-source binding in the pinned contained Python base; original 0.1-second
operator probes and actual recorded descendant checks remain intact. Evidence:
.work/qualification/inference-native-slice-20261014/focused-final.*.

The first prepared-checker aggregate ran 285 tests in 493.863 seconds, exit 1,
with 53 failure records and 43 errors. After enough process-group probes, Git,
Make and Ruff reported inability to fork/start threads. Python as container PID 1
does not reap arbitrary orphaned descendants. Test/unit and test/repository now
use --init rather than raising the 64-PID limit. The fresh maintained unit lane
passed 230 tests in 26.308 seconds, exit 0, including 40 sequential native calls
in one caller under that same limit. Exact pre/post sources, command and log:
.work/qualification/inference-native-slice-20261014/maintained-unit.*.
The earlier aggregate is retained as diagnostic evidence; it does not qualify
post-init behavior. Final full repository verification remains outstanding.

Foundation: first proxy and runtime-proof bits
---------------------------------------------
The proxy header phase now owns one absolute 30-second budget, including a
post-read deadline check; coalesced body bytes remain available to forwarding.
Interface names are admitted through the native lookup before transport. Review
found a phase-handoff bug: a nearly expired header timeout leaked into response
writes. A fresh bounded 120-second transport timeout is now installed on both
sockets before the first write; fixed admission-error responses have one second.
The actual near-deadline GET/CONNECT regression and all 16 focused checks passed.
Independent re-review found no actionable issue. Exact source anchors cite
Magnet's image-build-proxy.py at 2d4ee50b0359e71900fce9289ea01f46d0f41249;
retained local captures are .work/qualification/proxy-foundation-20261014/.
Transport DNS/relay/capacity/readiness work remains outstanding.

A separate runtime-proof cleanup deleted an unused source-layout ROOT and fixed
expected-first assertions/keyword diagnostics. Every original kernel/resource
predicate remains intact. Eight actual runtime methods, Ruff and the original
root/assertion/message detectors passed in the prepared checker with --init and
unchanged bounds. Independent review found no added waiver or predicate change.
Evidence: .work/qualification/quality-runtime-proof-20261014/.

Foundation: transport and canonical lock adjudication
----------------------------------------------------
Proxy DNS now uses device-bound IPv4 queries, bounded aliases and a shared
DNS/TCP connection budget; relay preserves returning responses after a client
half-close. Review reproduced late successful I/O accepted after DNS/TCP/relay
deadlines in both the local copy and its exact Magnet source. Post-I/O checks
now reject those outcomes before returning a connection or renewing inactivity.
Three new repo-checks retain the original 21 proxy methods and prove 3.1/30.1/
120.1-second late returns are rejected. The 27 focused tests passed; independent
re-review found no actionable transport finding. Capacity/readiness and actual
contained resolver-grant qualification remain separate work.
Evidence: .work/qualification/proxy-foundation-20261014/slice-2-late-success.*.
The repository test module's explanatory prose changed after that focused run;
it is not claimed as a complete current-byte execution binding.

After the source/recipe changes were committed, the actual exact ten-input
context gate passed against committed blobs/modes through sanitized Git object
grants. Its selected before/after hashes match. Evidence:
.work/qualification/source-context-committed-20261014/gate.{log,exit},
before.sha256 and after.sha256. This verifies declared committed/live inputs,
not yet a builder's frozen dispatch: that implementation remains outstanding.

The NMRPeak embedded-header requirement does not match the actual qualified
NMRNet producer: stage explicitly suppresses the generated header and index.
The local canonical grammar will accept only that headerless representation,
retain every pin/hash/order/continuation/text/budget predicate, and independently
require the exact PyPI selection in inference.in with no build.in override.
A contained invocation of the maintained producer, with synthetic offline uv
and advisory ports, must prove actual argv/output/report behavior. A synthetic
fixture must never be labelled as the discarded historical raw uv output.

The qualified Torch block also repeats its one admitted CPU wheel hash because
the producer adds the URL-fragment hash before uv's identical emitted hash.
Review favors fixing that producer and the CURRENT canonical representation,
retaining strict duplicate rejection. Historical Git, retained stage, original
reference/image/prepared bytes and qualification captures stay intact. Before
operational adoption, independently prove the same 59 package/version/unique
allowed-artifact sets. Keep original advisory date, scope and package payload;
only a transparently recorded lock binding may change. Actual wheelhouse bytes
must be checked before recomputing a current receipt, with the prior receipt
retained. The current image then needs offline rebuild/import and affected
qualification because baseline admission compares its embedded lock bytes.
No new resolution, package/model transfer or fresh advisory claim is required.
This is an approved plan, not evidence that normalization/adoption has run.

Foundation: reviewed headerless producer contract
------------------------------------------------
The source-specific header adaptation retains NMRPeak's producer/index purpose:
its nmrpeak_lock.py:138-146 at f8055ab1065795fd46f8c1539e894cf9773f5495
requires a generated command/index header. NMRNet's maintained stage instead
explicitly suppresses headers, index and find-links output. The parser now
requires the local headerless representation, rejects top-level headers/options,
and checks exactly one explicit PyPI index owned by inference.in, with no
build.in resolver override. All strict package/hash/text/order/continuation,
direct-input and advisory bindings remain; duplicate Torch hashes still fail.

The producer now converts only a declared two-line Torch CPU URL/hash block to
the exact CPU pin and the existing single hash. Declared/generated URL, hash and
ABI must agree; only the filename's %2B/+ spelling may vary. Unsupported output
fails before advisory requests or publication. The actual stage regression uses
clearly synthetic offline uv/advisory ports to prove complete ordered argv and
real output/input report hashes. It is not retained historical resolver output
or a historical producer attestation. No operational lock/report/wheelhouse
receipt bytes were changed by this source contract bit; the approved adoption
and current-image qualification plan above remains outstanding.

Foundation: adopted current lock normalization
---------------------------------------------
Completed 2026-10-14T13:08:44Z from checkout HEAD
d1b0565f2ad2083b08a3e3860c1406106cb0f45e. The reviewed normalization is now
applied to the CURRENT lock/report/receipt. This completes the adoption portion
of the plan above; current-image rebuild/import/numerical qualification remains
pending. Execution evidence and exact frozen source hashes are retained under
.work/qualification/lock-adoption-20261014/. No resolver, advisory query or
artifact transfer ran.

The lock loses only one 85-byte continued Torch hash line. The old and new
independent semantic inventories contain the same 59 package/version/unique
allowed-SHA256 sets. Actual inventory checks read all 59 wheel files plus the
one Uni-Core source archive; the recomputed receipt retains their exact hashes.

Full SHA256 identities, old -> current:
requirements/inference.lock:
3abca8de5f3b3e18041bbab50e5caef1763c9bbb8801a1567574ba9ed30e80f5
7a4ee5bbf4dbc7b6adcbe364fbd887674d2075e3837d3dd0e9f069f06b01b34a
requirements/advisories.json:
8eb8c301463d7557f3d18aa4260356ec66b7d9fefe8dc6c02470a9efded9bf9c
9ed127c4a427d948fa60c7a15c1a8d7a9a31ce52c17e2b00ffdc9efb9f2626ed
.work/wheelhouse/cpu/.complete:
d94272750d90db2f0bdcea019db89ce4fa4433a68719034ca6fe84d4dd934d2b
00de8a24da0bc3d6e7924169b62dad773af5bc4db1ada7b0877d6031c47e776a

The advisory report changes only its lock_sha256 value. Its original checked_at
2026-10-13T17:54:07.461093+00:00, scope "PyPI exact-version advisory metadata;
not a complete security audit", three direct-input hashes and full package
payload stay unchanged. The package-payload SHA256, using JSON sorted keys and
compact separators, is
5557344e9948b069c6826b62244b019b105d5dafb6d7d0d78bba263d08c859e8.
This is representation normalization, not a new advisory audit.

The actual maintained make packages/lock/apply STAGE=lock.SN7gSaRx ran in a
clean environment with an explicitly empty owned Docker client config; exit 0.
The new stage is .work/packages-stage/lock.SN7gSaRx. It carries the historical
resolver image-id only for the existing apply admission, and ORIGIN.txt states
that this normalization did not run that resolver. Original lock.E9LWYeIu stays
unchanged. Exact predecessor lock/report/receipt bytes are additionally retained
in lock-adoption-20261014/predecessors/. The maintained apply owns paired-file
recovery; receipt replacement is a separate phase, not a three-path transaction.

The contained receipt publisher independently verified actual wheelhouse bytes,
wrote/fsynced one owned same-directory temporary receipt, replaced .complete,
fsynced its directory and ran the maintained current wheelhouse check; exit 0.
Contained science.check_lock/check_advisory_binding passed for the applied pair;
59 packages. A separate actual python3 -B -m tools.wheelhouse check invocation
also passed; 60 artifacts. Its exact argv is maintained-wheelhouse-check.command.
The Make packages/wheelhouse/check target was not executed: its maintained
module ran in an explicitly confined validator with --init. This disposition
supersedes the procedure's proposed Make invocation without changing validation.

Actual Make apply grants: nonroot 1000:1000, --init, read-only root, network none,
pull never, drop ALL capabilities, NNP, 2 CPU, 2 GiB memory/swap, 64 PIDs,
/tmp 1 GiB noexec/nosuid/nodev;
three intent/source files RO, reviewed stage RO, requirements directory RW, and
package_lock/guard modules RO. The receipt/scientific validators use nonroot
1000:1000, --init, read-only root, network none, pull never, drop ALL capabilities,
NNP, 2 CPU, 512 MiB memory/swap, 64 PIDs, /tmp 64 MiB noexec/nosuid/nodev. Only receipt
publication grants wheelhouse/cpu RW for atomic entry replacement; other artifact
checks read it RO. Exact remaining file/output grants are captured in *.command
and REPORT.md. All Python ran inside the pinned base image:
sha256:593bd06efe90efa80dc4eee3948be7c0fde4134606dd40d8dd8dbcade98e669c;
observed image ID
sha256:9cb180cb36bd45dc786105b834d3cb5f3b1d69a6a63c79ca10fc64f108aa649a.

All 27 protected anchor hashes match before/after, including all nine files in
the historical source-qualification capture, original reference/supplement,
retained historical stage, current image record, four prepared provenance
receipts, and normalization evidence/source/output snapshots. Prepared/model
archives and original images never enter writable grants. The original numerical
reference remains
8268206ad12003dea5ef57e1a7392de69325e110b54f2b91ee0f6314c4fef5ae;
the current image record remains
208ed81368b2022120849d16aec1e537d0efdbfb12efbe7ac13453ac8b6087cc.

Proof-label correction is retained in
.work/qualification/lock-normalization-20261014/correction.json. The observed
old image's embedded lock equals its retained predecessor and differs from the
candidate. Maintained baseline rejection is inferred from baseline.sh:131-138;
the launcher was not executed in that observation proof. Original executed
source, JSON, report and manifest remain intact; corrected metadata is not a
new execution attestation.

Precise source refs for this adoption:
https://github.com/numpde/nmrnet-repro/blob/426955c5a037bc693fa35d45e2fbf2eddb38e227/tools/package_lock.py#L57-L64
(old hash-injecting producer; rationale for the one-line correction).
https://github.com/numpde/nmrnet-repro/blob/511f67b999acfb26f5e77fcfc74f6d20f30e5f44/tools/package_lock.py#L45-L80
(corrected bounded Torch normalization; no broad deduplication).
https://github.com/numpde/nmrnet-repro/blob/62353af49f21c9a9a0145045d934a12e5f56982d/tools/packages.sh#L98-L131
(reviewed maintained worker --init grant and offline apply composition).
https://github.com/numpde/nmrnet-repro/blob/d1b0565f2ad2083b08a3e3860c1406106cb0f45e/Makefile#L92-L93
(executed public target).
https://github.com/numpde/nmrnet-repro/blob/d1b0565f2ad2083b08a3e3860c1406106cb0f45e/tools/wheelhouse.py#L87-L123
(actual complete artifact inventory and receipt validator).
https://github.com/numpde/nmrnet-repro/blob/d1b0565f2ad2083b08a3e3860c1406106cb0f45e/repository_checks/science/dependency.py#L126-L170
(strict direct-input and advisory binding checks).
https://github.com/numpde/nmrnet-repro/blob/d1b0565f2ad2083b08a3e3860c1406106cb0f45e/tools/baseline.sh#L131-L138
(source-derived old-image admission consequence; rebuild/qualification pending).

Foundation checkpoint and Uni-Core convention bit, 2026-10-14
----------------------------------------------------------
The maintained aggregate at d6fdb6fdca0aa6d4aaf3e6c9d8933841cdd728a5
passed all 250 unit tests (50.981 s). Repository checks ran 316 tests
(27.333 s), retaining 22 failures and one error. The former PID-exhaustion
cascade did not recur. Tracked authored source hashes were identical before
and after both lanes. Exact logs, exit records and source inventories:
.work/qualification/foundation-aggregate-20261014/post-d6fdb6f/.
This is a diagnostic checkpoint, not foundation completion.

The build_unicore.py convention bit retains the 16 MiB expanded-byte and
2048-member limits, rejection ordering/messages, hash-before-parse admission,
and offline pip argv. The two constant exceptions explain the bounded
allocation/extraction authority in place; accepted-domain predicates and
formatting change no admitted archive. Five existing SourceTests pass with
pip mocked, together with scoped Ruff, constants, guards, defaults and import
checks. No real install/build/transfer occurred; sparse runtime coverage is
not claimed. Independent review found no actionable issue in frozen source
7ffb8332e1fb2945737934a2252d3fb468cc754500b9232da0cad332f0f6a497.
Evidence: .work/qualification/build-unicore-convention-slice-20261014/;
manifest d7d866b2663373f78a391e7d182c6730c42b3933780da79ace5d3b039e64bb92.
Concurrent disjoint convention edits mean these scoped proofs do not establish
the current aggregate status. Actual frozen-image rebuild and numerical
qualification remain pending.

Five-file convention integration, independently reviewed
-------------------------------------------------------
The copied convention fixture now includes the sourced Docker client helper.
The independent container-support inventory admits exactly
containers/inference/image-inputs.txt; no suffix/wildcard exemption was added.
Three repository checks use the existing shared ROOT; the checker-launcher
unit fixture uses the maintained /workspace working directory without new
source grants. Assertion operand/message corrections, imports and formatting
retain predicates and negative fixtures. Fifty focused tests, seven isolated
checker-launcher units and full five-file Ruff/format checks pass.
Evidence: .work/qualification/convention-repairs-20261014/REPORT.md.
After a0feacc, independent review reran the previously omitted committed-input
gate with fresh sanitized Git metadata: pass, source hashes stable. Its
original /tmp/nmrnet-convention-review.v51lc9I3 capture is also retained verbatim
under convention-repairs-20261014/independent-current/. No aggregate-green
claim follows from these scoped results.

Optional contained proxy resolver grant, independently reviewed
--------------------------------------------------------------
Magnet's original host proxy reads /run/systemd/resolve/resolv.conf before
/etc/resolv.conf; its exact revision/path/rationale are beside the new grant
in tools/docker.sh. The contained caller now grants that one fixed file RO
when it is a readable regular non-symlink file. Absence preserves behavior;
unsafe existing inputs fail before engine calls. The worker receives no new
mount; no surrounding directory or arbitrary configuration is granted.
Explicit interface selection remains mandatory. Forty-two focused tests and
the new test's full Ruff check pass; Bash syntax and before/after hashes pass.
Independent review found no actionable issue. Exact proof and limitations:
.work/qualification/proxy-resolver-grant-slice-20261014/REPORT.txt;
proof SHA256 03cfc0042fea2d854ba41525f2d5f270ef85ac5d6fe32ba4fcbbb539286df22c.
This qualifies file authority only. No actual proxy startup, DNS query or
transfer occurred; started routing usability remains unqualified.

Acquisition image-inspection status correction, independently reviewed
---------------------------------------------------------------------
tools/docker.sh now preserves native inspection 124/137 with an owned safe
diagnosis and 130/143 silently; ordinary unavailability remains status 2 with
the existing preload instruction. Native stderr is suppressed at this boundary.
The original four-status predicate is unchanged. Two added regression methods
verify private diagnostic suppression and ordinary absence/preload behavior.
Eight focused methods and Bash syntax pass. Full lint remains red with the
same four pre-existing import findings, compared against the committed module;
no whole-module or aggregate-green claim is made. Independent review found no
actionable issue. Exact source-bound commands/results:
.work/qualification/acquisition-inspect-status-slice-20261014/;
proof SHA256 4785ea1e17b22ebe0d865e299296f66b1e17dac947f05edaa203aa644e8bc09f.
The owning comment records the exact Magnet admission precedent and local
regression rationale. No transfer, proxy startup or lifecycle migration occurred.

Guard and network unit convention cohort, independently reviewed
---------------------------------------------------------------
tests/test_guarded_baseline.py, test_guarded_tooling.py and test_network_gate.py
retain all 16 host-denial, marker, explicit-interface and mount-grant scenarios.
Imports, explicit subprocess check=False, expected-first assertion operands,
keyword diagnostics and formatting close their convention findings without
changing command/grant authority. All 16 existing units, full three-file
Ruff/format policy and both assertion posture detectors pass. Source/consumer
hashes match across execution; independent review found no actionable issue.
Exact commands, results and the next-cohort diagnosis are retained in
.work/qualification/test-convention-next-20261014/COHORT_REPORT.md and PROPOSAL.md.
The other test/check files remain subject to their original full policies.

Scientific model-unit convention cohort, independently reviewed
--------------------------------------------------------------
tests/test_baseline_model.py retains all nine scientific scenarios, values,
argv and rejection expectations. Import/assertion/format changes preserve
behavior. List unpacking preserves the fixture sequence; named_buffers=list
matches validate_model's actual zero-argument call and creates a fresh empty
list per call. Nine original units, full scoped Ruff/format and both assertion
detectors pass. Source and four consumer hashes match; independent review
found no actionable issue. Exact proof and consumer rationale:
.work/qualification/baseline-model-conventions-20261014/REPORT.md.
This is unit evidence, without native-inference or aggregate-green claims.

Lock-publication unit convention cohort, independently reviewed
--------------------------------------------------------------
tests/test_package_lock.py changes four visible literal expectations to the
first operand and applies the pinned formatter. All 19 original scenarios,
callbacks, exact stage bytes/modes and publication/recovery fault seams remain
intact. Nineteen units, full scoped Ruff/format and assertion posture checks
pass; source and two consumer hashes match. Independent review found no
actionable issue. Exact proof:
.work/qualification/package-lock-unit-conventions-20261014/REPORT.md.
Resolver/advisory responses remain synthetic; this adds no acquisition or
aggregate-green claim.

Baseline preparation unit convention cohort, independently reviewed
------------------------------------------------------------------
tests/test_baseline_prepare.py retains its 21 record/pickle, selection/order,
eligibility, source-binding and failure scenarios. Eight literal expectations,
three same-key/value/order dictionary literals, four equivalent ordered
subTest/assertRaises contexts, imports and formatting close scoped findings.
Twenty-one original units, full scoped Ruff/format and assertion posture checks
pass. Source and three consumer hashes match; independent review found no
actionable issue. Exact proof:
.work/qualification/baseline-prepare-unit-conventions-20261014/REPORT.md.
No callback/producer change, native execution or aggregate-green claim is made.

Make ownership-gate applicability correction, independently reviewed
-------------------------------------------------------------------
Both Dapp and Vote Make collectors retain their broad raw matchers and original
fixtures, discovery and default inventories. One shared classifier admits only
a complete exported immediate assignment: command-line origin for VARIABLE,
literal value of the same VARIABLE, no else branch or additional expression.
This recognizes input ownership forwarding, without granting a replacement
value. Alternate origins/values, nested/appended expansions, recipe indentation
and trailing payload remain findings. Makefile is unchanged; no alias ledger
or general Make parser was introduced. Exact precedent/rationale is beside the
classifier. Twenty-four focused tests and full scoped Ruff pass, including
both production collectors, 15 adverse forms and native GNU Make literal
handoff. Source/caller hashes match; independent review found no actionable
issue. Exact evidence:
.work/qualification/make-origin-policy-slice-20261014/REPORT.txt;
manifest c26b806611d8045ffefb966c3dea55bf8118ac9b763ff2feba645f69eacaac27.
Four broader Dapp Ops/Python failures remain visible in retained-reds.log;
this is neither a default waiver nor an aggregate-green claim.

Baseline run-unit convention cohort, independently reviewed
----------------------------------------------------------
tests/test_baseline_run.py retains all 11 invocation, precision, raw-output
pairing, exclusive-run and failure-evidence scenarios. Assertion/import/format
changes, one same-value ordered options dictionary and two equivalent ordered
contexts preserve behavior. Three unused fake parameters gain underscore
prefixes only after checking actual positional consumers; label_atol, stdout,
stderr and check keyword contracts remain intact. Eleven original units, full
scoped Ruff/format and assertion posture checks pass. Source and seven consumer
hashes match; independent review found no actionable issue. Exact proof:
.work/qualification/baseline-run-unit-conventions-20261014/REPORT.md.
These mocked units do not qualify actual model execution or the full aggregate.

Captured native lifetime repair, review finding fixed and re-reviewed
--------------------------------------------------------------------
tools/inference_native.sh retains its timed caller API, first-8-MiB private
capture/drain and exact image-ID admission. A checked ready/release protocol
admits a live held process-group owner before native dispatch. Operation
budgets start at admitted dispatch; the ownership handoff has a separate
10-second startup bound. Confirmed expiry remains 124, genuine native 137
remains 137, and HUP/INT/TERM retain cancellation status. Checked publication
and byte-exact status admission prevent reporting faults from escaping before
retirement. The group is retired/joined before the drain and cleanup; caller
traps are restored. Unknown ownership retains evidence without guessed group
effects. These statements concern local clients, not engine-side cancellation.

Independent review found that FIFO receipts could block cmp/head. Deadline,
completion and release readers now require regular non-symlink files before
reading; finite FIFO/directory/symlink mutations verify prompt rejection and
retirement. Re-review confirmed closure with no new actionable finding.
All 16 new methods and five unchanged NativeClientTests pass against current
source (21 tests, 62.791 s); scoped Ruff/format and Bash syntax pass. Exact
commands, source hashes, limits, logs and preceding failed attempts:
.work/qualification/proxy-foundation-20261014/captured-native-type-handoff.md.
Helper SHA256 bc97ecda1f1746c7c9e1c0e277abb5b9e1b6c7060b5541ce89414644dc258563;
test SHA256 021a174f3083404af2cc714b7dca6d8040d5426cfdef35d86741cdd4855c5b9a.
The original repository 0.1-second descendant probes' startup race remains
separate evidence; this proof does not qualify those probes or the aggregate.
No actual build, model run, transfer or baseline/client migration occurred.

Native repository-probe calibration, finding fixed and re-reviewed
-----------------------------------------------------------------
The newly repaired owner exposed a Python-fake-engine startup race in the two
original 0.1-second repository probes. New-repair evidence is retained in
proxy-foundation-20261014/captured-native-second.log and
captured-native-dispatch.log; earlier historical green proofs are not relabeled.
The repository probes now explicitly allow 1 second, retaining the 3-second
outer cleanup bound and unchanged direct-native 0.1-second tests. This is
fixture scheduling calibration, not unchanged original timing coverage.

A fixed exact-mode marker is published after EOF actually closes both output
descriptors, or after spawning/recording the descendant before exit 7. Probes
require actual entry plus exact EOF status 124 or failure status 7, while
retaining descendant-retirement and no-outer-timeout checks. Expected-status
adapters with missing/wrong markers cannot certify a scenario. Independent
review found that a marker assertion could skip recorded-child cleanup; the
failure path now retires the exact recorded child before fixture teardown,
preserving the marker failure. Ordinary retirement checks use pre-cleanup
state, so cleanup cannot make a failed proof pass. Real-child negative cases
verify rejection and SIGKILL retirement. Re-review found no new actionable issue.

Eleven current focused methods pass (9.315 s); all seven bound source hashes
match across execution. The earlier 29-method proof retains one baseline
inspection privacy failure and is labeled previous-review, without a rerun
claim. Thirty-seven pre-existing scoped lint findings remain unchanged.
Exact source-bound proof, rationale and limitations:
.work/qualification/native-fixture-calibration-20261014/REPORT.txt;
manifest 2d81930b4e8a59f5c6d0e8ce018ce3481da262e43d57ade21ff9a014ba4a838c.
No production budget, fake-engine mode or live engine operation was added.
The native unit module keeps mode 100755 because it also supplies executable
mv/head/rm fault doubles through PATH symlinks, matching test_docker_client.py;
its discovery and executable roles both run inside the contained proof lane.

Saved-output unit convention cohort, independently reviewed
----------------------------------------------------------
tests/test_baseline_output.py preserves its is_special keyword contract with
an explained parameter-local ARG002 exception: the finite double models symbol
indices, with boundary IDs supplied separately. Exact local/upstream consumers
and the limited responsibility are documented beside the exception. Pinned
Ruff positive/negative probes verify that other unused parameters still fail.
Two list-unpacking changes preserve values/order; formatting preserves all ten
dictionary/atom/output/failure scenarios. Ten original units, full scoped
Ruff/format and assertion posture checks pass. Source/five consumer hashes match;
independent review found no actionable issue. Exact proof:
.work/qualification/baseline-output-unit-conventions-20261014/REPORT.md.
No production, policy or numerical-reference change occurred.

Maintained aggregate checkpoint at b600686, 2026-10-14
---------------------------------------------------
Both actual maintained Make lanes ran concurrently at clean
b60068635e2972fd82615ccf5efd6c01d79f3b68, with their default reviewed grants
and no extra test selection. Unit: 266 tests pass, 105.968 s, Make exit 0.
Repository: 328 tests, 15 failures, no errors, 35.279 s, Make exit 2
(unittest exit 1). All 136 tracked authored-source hashes match before/after;
HEAD and clean status remain unchanged across execution. Source lease was
released only after both lanes and the final comparison completed.
Exact commands, image/grant provenance, logs, exits and hash inventories:
.work/qualification/foundation-aggregate-20261014/post-b600686/REPORT.txt;
manifest eea50866371a9c578a0463167417775fd1cbadeb1c7cbf5da3ed8783b9a70b35.

The remaining failures are seven silent-default checks, two assertion posture
checks, module constants, tuple construction, guard posture, baseline native
inspection privacy, full Ruff and formatter policy. Native calibrated probes
pass; prior startup and PID-exhaustion failures are not current findings.
The remaining policies stay active. This checkpoint is not foundation closure
or a physical image/model qualification; those still require further work.

Next baseline metadata bit follows the reviewed proposal at
.work/qualification/proxy-foundation-20261014/baseline-ownership-proposal-f59f605.md:
reuse the existing native owner for separate private metadata, exact saved and
observed identity/revision admission, cleanup before scientific dispatch, and
inert PRINT. Peer corrections require rejection at either 4096-byte receipt
boundary even on native success, signal/EXIT ownership before scratch, and
honest unconfirmed-removal reporting. Common config migration waits for explicit
untimed execution and owner-produced retirement truth; no scientific deadline
is inferred from build/import budgets. Implementation and its finite external
CLI projection remain pending review, without a closure claim.

Concrete before/after examples of check effects
----------------------------------------------
These excerpts come from the indicated Git parent and committed result; displayed
indentation and surrounding context are omitted. They distinguish runtime repairs,
readability conventions and a checker correction. The guard predates the imported
repository gate, which subsequently made that protection repository-wide. These
examples do not establish that the remaining repository aggregate is green.

1. Put execution admission before operational imports.
   tools/baseline_prepare.py, before:
       import argparse
   After:
       from tools.container_guard import require_container

       require_container()

       import argparse
   The missing/invalid marker stops the supported import before scientific
   dependencies or deserialization. The maintained launcher owns the actual
   container grants. repository_checks/test_conventions.py,
   RepositoryConventionTests.test_authored_production_sources_require_the_shared_guard
   now enforces the early call across authored production sources; its detector
   fixtures reject late, conditional and rebound guards.
   Exact parent/result:
   https://github.com/numpde/nmrnet-repro/compare/8fb7b03d038ae94e804dce666d82cc57c12e63ae...d30f7c293b35dfd252a098d1accf7647eafa1382

2. Make descendant-retirement proofs sustainable within the existing PID limit.
   tools/container.sh, before (end of common container grant):
       --workdir /workspace)
       case "$1" in
   After (the three explanatory comment lines are omitted):
       --workdir /workspace)
       if [[ "$1" == test || "$1" == test/repository ]]; then
           command+=(--init)
       fi
       case "$1" in
   The init process reaps orphaned descendants instead of exhausting the unchanged
   64-PID budget with zombies. Repository native EOF/descendant tests exposed the
   lifecycle issue: repository_checks/test_operator_inputs_port.py,
   NativeCommandPostureTests.test_failed_leader_and_held_pipe_retire_surviving_native_descendant.
   Companion units assert --init and exercise 40 sequential calls:
   tests/test_launcher.py, LauncherTests.test_test_lane_is_offline_and_reads_only_tools_and_tests;
   tests/test_inference_image.py,
   NativeClientTests.test_repeated_native_calls_do_not_exhaust_the_contained_pid_budget.
   Exact parent/result:
   https://github.com/numpde/nmrnet-repro/compare/3e7627ae89f2b5423eb16b6f2ddbd1b55b9d5071...f4a269b0e2f589e11383a2959d9807dc94c46f0a

3. Preserve interrupted inspection status and keep daemon diagnostics private.
   tools/docker.sh, before (admission condition; following branch exited 2):
       if ! "${engine[@]}" image inspect "$image" >/dev/null; then
   After (success/failure capture and status dispatch excerpts):
       if "${engine[@]}" image inspect "$image" >/dev/null 2>/dev/null; then continue; else inspect_status=$?; fi
       case "$inspect_status" in
           130|143) exit "$inspect_status" ;;
           124|137)
               printf 'Cannot start acquisition: pinned-image inspection was interrupted (status %s). No acquisition was started.\n' "$inspect_status" >&2
               exit "$inspect_status"
               ;;
       esac
   Timeout/kill/cancellation outcomes remain 124/137/130/143; ordinary unavailable
   images still receive preload guidance and status 2. Native stderr can contain
   private configuration, so this boundary emits its own diagnostic. The checks
   are repository_checks/test_operator_inputs_port.py, EngineEnvironmentTests.
   test_identity_inspection_preserves_bounded_interruption and
   test_acquisition_inspection_interruption_suppresses_private_native_diagnostics.
   Exact parent/result:
   https://github.com/numpde/nmrnet-repro/compare/20470d198fc7b28884104a713bf832c2017e8d89...83cb834daea673115cd7b8bffe98a64a74569c6a

4. Show the expected result and label the assertion diagnostic explicitly.
   tests/test_guarded_baseline.py, before:
       self.assertEqual(result.returncode, 0, result.stderr)
   After:
       self.assertEqual(0, result.returncode, msg=result.stderr)
   Success remains exactly return code 0 and the diagnostic text is identical;
   the change makes the failure comparison easier to read. It changes no runtime
   admission or model behavior. The two checks in
   repository_checks/quality/test_assert_equal_argument_order_posture.py are
   AssertEqualArgumentOrderPostureTests.test_repository_assert_equal_calls_put_visible_expectations_first
   and test_repository_assertion_messages_are_keyword_arguments.
   Exact parent/result:
   https://github.com/numpde/nmrnet-repro/compare/83cb834daea673115cd7b8bffe98a64a74569c6a...c5ecd7d49c1c61c129d6c84e6e9a39ef42f05e5e

5. Use the contained source-root owner instead of inferring it from check layout.
   repository_checks/test_scientific_lint.py, before:
       ROOT = Path(__file__).resolve().parents[1]
   After:
       from repository_checks.quality.sources import ROOT
   The existing owner in repository_checks/quality/sources.py declares:
       ROOT = Path("/workspace")
   The launcher pins that working/source directory. Moving a check within the
   check tree must not silently redirect its source inventory. The enforced check
   is repository_checks/quality/test_repository_root_posture.py,
   RepositoryRootPostureTests.test_python_does_not_infer_repository_root_from_source_layout.
   Scientific lint selection and its late-import rejection remain unchanged.
   Exact parent/result:
   https://github.com/numpde/nmrnet-repro/compare/a0feacc753684ae924d77afef6dd0d9980b65a78...73969a75bdd8744b17913c1160bdb19edef2465b

6. Correct a fallback finding by recognizing the existing literal input owner.
   Makefile contains the same assignment before and after this checker change:
       export NMRNET_ARCHIVE_INPUT := $(if $(filter command line,$(origin ARCHIVE)),$(value ARCHIVE))
   repository_checks/quality/silent_defaults/test_make_empty_defaults.py,
   before (collector loop):
       for source, line_number, line in _make_surface_lines():
           for match in MAKE_FUNCTION_DEFAULT_RE.finditer(line):
               findings.append(f"{source}:{line_number}: {match.group(0)}")
   After:
       for source, line_number, line in _make_surface_lines():
           if is_literal_make_origin_gate(source, line):
               continue
           for match in MAKE_FUNCTION_DEFAULT_RE.finditer(line):
               findings.append(f"{source}:{line_number}: {match.group(0)}")
   This complete gate forwards the same variable's literal command-line value;
   absent owned input supplies no replacement. The raw fallback regex still
   matches it, but both production collectors classify that exact whole-line
   ownership form. Else values, different variables/origins, nested/appended
   expressions and recipe-indented lookalikes remain findings. Makefile needed
   no rewrite or alias ledger. The collector checks are MakeEmptyDefaultsTest.
   test_make_surfaces_do_not_use_function_fallbacks and test_ops.py,
   OpsSilentDefaultsTest.test_ops_files_do_not_publish_silent_defaults. The
   independent test_make_origin.py, MakeOriginGateTests, covers accepted gates
   and those adverse forms while proving the original raw matchers still match.
   All three check modules above are under repository_checks/quality/silent_defaults/.
   Exact parent/result:
   https://github.com/numpde/nmrnet-repro/compare/e14a972985931f88b8537a32f129b4e6a883c7e0...0215e904fbf1f5e73d6783d6aedbe213b97ab5e0

Finite image-metadata fixture projection, review finding fixed
------------------------------------------------------------
The shared Docker double now accepts complete image-inspect argv for its four
supported forms: unformatted, .Id, the old revision-label template, and the
combined ID|revision template. Unknown forms/counts/trailing tokens reject 97
before modeled status/private-error/response effects; attempted-call logging
remains observational. Existing selector/fault behavior is retained. The new
three-test module exercises normal projections, nine malformed requests and
five native failure statuses across all four forms. Independent review found
two positional assertion diagnostics; both now use msg= and re-review confirmed
closure without a projection finding. Three final tests, both scoped assertion
collectors plus two original detector fixtures, and new-file Ruff/format pass.
The earlier 23-method integration proof is retained against its exact baseline
caller hash; final fixture changes only diagnostic emission spelling. Thirty-
three predecessor fixture lint findings remain unchanged, without a waiver.
Exact source-bound proof chain, limits and retained failed harness attempt:
.work/qualification/engine-metadata-fixture-20261014/REPORT.txt;
manifest 2a09b7483c5f0ca3dcbf4d64c789e5ff5671876ce641bb1cdf00da4d65568dff.
This qualifies the finite double, without a live-engine or aggregate-green claim.

Capture/discovery/resolver assertion cohort, independently reviewed
-----------------------------------------------------------------
test_inference_inputs.py, test_discovery_port.py and test_proxy_resolver_input.py
retain every exact Git/Docker rejection, captured input/byte/mode/wheel predicate,
empty-discovery status 5/NO TESTS RAN, resolver grant and canary. Twenty-four
diagnostics use msg=; remaining changes are imports and formatting. All 21
original tests (12+4+5), full scoped Ruff/format and assertion posture checks
pass. Three source and 26 exercised-consumer hashes match. The copied baseline
launcher is explicitly outside this lease because this cohort never executes
it. Independent review found no actionable issue. Exact proof:
.work/qualification/captured-discovery-resolver-conventions-20261014/REPORT.md.
No production, policy, detector or shared-fixture change belongs to this cohort.

Package-lock producer convention bit, independently reviewed
----------------------------------------------------------
tools/package_lock.py retains its three declared dependency inputs as one
explained, explicitly reviewed constant binding. Its accepted-domain length
predicate preserves the built-in 8 MiB metadata cutoff, ordering and diagnostic.
Imports/formatting and the advisory docstring preserve strict headerless export,
exact Torch URL/hash normalization, advisory binding, paired rollback and offline
argv. Twenty-eight existing producer/apply/strict-detector tests and scoped
Ruff/format/constant/guard/default/import gates pass. Six actual operational
input/report/receipt hashes and consumed source/policy hashes remain unchanged;
independent review found no actionable issue. Exact proof:
.work/qualification/package-lock-convention-slice-20261014/REPORT.md;
manifest 8d572066ef2538847d3b62516b20a1215286270b9ccc2c825e7040d3086cf574.
Two harness failures (missing declared input and an unusable mount destination)
remain preserved; final proof uses a read-only declaration projection. Neither
failure is relabeled green. No query, resolution, install or publication occurred.

Baseline metadata admission, cancellation correction independently reviewed
-------------------------------------------------------------------------
tools/baseline.sh now admits the saved immutable image record as exact 72-byte
original bytes, observes that same identity (and the run revision label) in one
native inspect, and checks separate private regular, nonlink stdout/stderr
receipts below 4096 bytes. The existing native owner supplies the 30-second
metadata deadline and one-second TERM escalation. Admission failures retain
receipts; interrupted removal reports uncertainty about effects. The scientific
command block remains byte-for-byte unchanged.
Independent review caught a real cancellation handoff race: deferral remained
active after the queued-signal check. Deferral now ends immediately when rm
returns, before that check. A private-copy regression verifies physical removal
then injects HUP/INT/TERM before dispatch: current results are 129/130/143, with
no output-parent creation or scientific call. Restoring only the old ordering
produces exactly three failures, all actual status 0. No production fault hook.
All 28 launcher/admission tests, four original baseline posture methods, full
scoped test Ruff/format and Bash syntax pass at the frozen sources. Independent
re-review found no actionable issue and verified evidence/source hashes.
Exact proof: .work/qualification/proxy-foundation-20261014/baseline-handoff-race-review.md;
SHA256 a2fde0e403ccb97a11f29f84c4b42d8f0a386e6d928d7d3b5b500fff56c4a350.
This qualifies metadata admission with finite engine doubles. Common Docker
configuration and scientific-process ownership remain a separate pending slice;
there is no live-engine, model or aggregate-green claim here.

Diagnostic defaults proposal rejected at independent design review
-----------------------------------------------------------------
The proposed comment exception for one AST comparison-symbol conditional would
have kept the original raw matchers and added tokenized, one-node reason tags.
Independent review found that matching the expression's syntax cannot establish
prior type admission or diagnostic-only consumption: the same tagged value can
feed an operational decision. The additional tag machinery therefore does not
prove its promised ownership boundary and is disproportionate to this node.
Disposition: leave the silent-default detector unchanged. Implement and qualify
finite inverse comparison rendering at its existing source owner, preserving
original admission and diagnostic bytes; this source change is pending, not a
passed proof. Exact rejected proposal and its pinned Dapp/API sources:
.work/qualification/python-classification-proposal-20261014/PROPOSAL.md;
manifest d5987fa5b5eed053609cc3747959acb5690d3cdb60b8dcf4198544771ec68a9c.
Other scientific, operator and proof-inventory defaults remain separately open.

Inference configuration assertion cohort, independently reviewed
---------------------------------------------------------------
repository_checks/test_inference_client_config.py retains all eight original
unsafe-input, empty owned configuration, publication, native failure/deadline,
cancellation and cleanup-effect predicates. Twenty-two equality assertions put
expected first; thirteen diagnostics use msg=; imports/format follow pinned
Ruff. Callback defaults, fault-function bytes, 0.1-second import budget and
two-second cancellation bounds remain unchanged. All eight tests pass, as do
full scoped Ruff/format and both existing assertion collectors. Twenty-eight
consumer/policy hashes match before/after; independent review verified the
executed source, predecessor diff and evidence manifest with no actionable issue.
Exact proof: .work/qualification/inference-client-config-conventions-20261014/REPORT.md;
evidence manifest 1b7668d437f35de180074e3c6bcf0502bffcb635878acbb4d618c196aee61222.
The initial engine-socket sandbox denial is retained; the authorized contained
rerun passed. No launcher, policy, fixture, operational artifact or runtime
configuration behavior changed; no aggregate or real-engine qualification claim.

Scientific root iterable ownership, independently reviewed
--------------------------------------------------------
verify_extraction and context_digest now pass entry-name generators directly
to live_paths. That single-pass consumer owns the resulting path list; the
intermediate tuples had no consumer requiring immutability. Valid inventory,
byte/mode/hash, archive/selection and producer/source-provenance rules remain
unchanged. Invalid context roots now reach live_paths' existing ValueError
before directory iteration: missing/file roots previously raised filesystem
exceptions, and links could be enumerated before rejection. This intentional
owner-order correction is qualified for missing, regular-file and link roots.
The contained probe records Python 3.12.12's actual pathlib.py implementation
and entry-name snapshot behavior; it makes no atomic file-content snapshot claim.
All 27 selected original provenance/source/tuple fixtures and scoped probes
pass. Six previous lint findings and one formatter failure remain identical;
there is no broad green claim. Independent review verified the two-line diff,
single-pass contract, source/consumer hashes and retained proof with no issue.
Exact evidence: .work/qualification/scientific-root-iterables-20261014/REPORT.md;
manifest 19b839a51df1397b618c4fa31df896e1f6dd1e018cd0d4f0465c65af24fc0d49.
Two failed private entrypoint attempts remain labeled failed; their correction
changed no tracked code or execution grants. No operational artifact or model
was processed. Existing tuple-detector rules and fixtures remain unchanged.

Guard diagnostic rendering closure, independently reviewed
----------------------------------------------------------
The existing guard checker now renders finite inverse comparison/Boolean
symbols from their admitted AST grammar, preserving isinstance precedence and
original diagnostic bytes. This replaces three conditional-rendering defaults
without changing the defaults scanner, guard admission, raw fixtures, source
inventories or repository gates. The unused inherited API-root binding is
removed; the self-check path and ordered AST grammar retain the original narrow
constant tag with concrete intent. Imports/formatting stay in this owner.
Ten focused and thirteen scoped tests, full-file Ruff/format, six complete
predecessor diagnostic comparisons and two unsupported cases pass. Seven
exercised owner/consumer/policy hashes match. Independent review found no
competing authority or actionable defect and verified the proof manifest.
Exact proof: .work/qualification/inverse-comparison-rendering-20261014/REPORT.txt;
manifest 126e5359ec86317d06a4e632f5f96b611e92abd8372a2a81c4f8b610fb3c4d8b.
Earlier lint and scoped-policy failures remain preserved. The unchanged
whole-production guard gate is still pending; these results claim this owner's
qualification only. Exact pinned API/Dapp source references remain in the owner
and report. The rejected general diagnostic-tag policy was not implemented.

Runtime/tuple checker convention cohort, independently reviewed
--------------------------------------------------------------
The two original posture modules keep their detector predicates, discovery,
exception-tag grammar, adversarial payloads and numeric finding-line contracts.
Expected-first assertions, imports and formatting follow the unchanged pinned
policy. Three empty NodeVisitor callbacks use unused-argument names; the exact
Python 3.12.12 positional dispatch and absence of keyword callers were checked.
Unicode escape spelling preserves the decoded non-ASCII migration-path fixture.
Ten selected original/tuple tests, four scoped assertion checks, full Ruff/format
and bounded AST preservation pass. Normalization covers only those specific
unused callbacks, import order and equality-operand order. Seven leased hashes
match; independent review found no issue. Exact proof:
.work/qualification/runtime-tuple-conventions-20261014/REPORT.txt;
manifest 7234ad14301f0939084f6e80d31ad052e0bfa081fc233ffc0f6434ac36fae491.
The full tuple result is an observed snapshot; orthogonal artifact-source drift
is preserved. Production constants remain red in seven observed bindings. These
are not immutable whole-tree qualification or aggregate-green claims.

Native retirement/untimed API, earned lifecycle proof after review
----------------------------------------------------------------
inference_native exposes one per-invocation local retirement fact, false before
asynchronous birth and true only after confirmed held-group retirement and both
joins. Callers initialize/read that same slot; after false they retain resources
and stop before another call. The internal untimed budget dispatches beneath
the same held anchor without an operation deadline. Numeric deadlines, startup
admission, status/cap/privacy behavior and public output policy are unchanged.
Independent owner review found no defect. A proof reviewer requested missing
lifecycle evidence before commit. All five requested cases now have earned
contained assertions: timed/untimed HUP/INT/TERM disposition parity; first-child
inherited false before parent PID capture; admitted-anchor loss with a surviving
recorded descendant and retained caller sentinel; native7 and return-handoff
signal cleanup preserving primary status; interrupted anchor-join retry with
false until confirmed retirement/joins. Three private negative mutations fail
as intended. The final 32-method run, five affected probes, pinned Ruff/format
and Bash syntax pass. Test mode 0755 remains necessary for PATH fault doubles.
Re-review verified source/projection/handoff hashes and exact command/grant/exit
receipts with no new issue. Endpoint hashes are labeled endpoint evidence,
not a continuous whole-tree freeze. The full run records orthogonal artifacts.py
import-dependency drift; the affected/negative/lint projections match fully,
and selected NativeClientTests call no artifact behavior. Exact proof:
.work/qualification/proxy-foundation-20261014/native-api-proof-review-handoff.md;
SHA256 48163f975782d5eb628d01c3eba6ea8f68d7cfd3e87c07e4c25eb554c74ff8bb.
This qualifies the primitive. Caller configuration/output migration and real
engine/scientific qualification remain separate pending work.

Artifact producer convention closure, independently reviewed
----------------------------------------------------------
tools/artifacts.py retains its three fixed streaming/ZIP resource limits with
explained original constant tags. Accepted-domain guards change only where the
existing integer authority is earned: exact declaration-int admission, parsed
unsigned ZIP fields, lengths, validated extraction limits and conforming file
positions. Thresholds, short-circuit order and diagnostics are preserved.
Imports/formatting, an unused already-validated ZIP signature name and explicit
JSON+LF stdout writes preserve helper signatures/defaults, archive verification,
path safety, staged extraction, descriptor reuse and publication ordering.
All 35 original artifact tests and 14 original policy fixtures pass; full scoped
Ruff/format pass. CLI predecessor/current output is identical at 86/158 bytes.
Fourteen executed source/consumer/policy hashes match. Independent review found
no actionable defect; arbitrary NaN-returning fake streams violate the actual
file/IO contract and require no new validation or waiver. Exact proof:
.work/qualification/artifacts-conventions-20261014/REPORT.md;
SHA256 94417015671052abd4840a53f15793e8729cbb5647714a376649b6438fb29af2.
Three direct declaration-size guards remain unchanged for separate helper-
contract adjudication. Production calls select exact positive-int declarations
from load_declaration; direct fixtures construct integer sizes. Current scoped
guard reds are documented, not hidden. No actual release archive, model, fetch
or publication was performed; source references remain in place.

Fresh maintained aggregate at 23e92c0
-----------------------------------
Exact clean revision 23e92c05d271bbc6f4754813c167178deda80b9d ran the actual
make test/unit and make test/repository lanes in parallel with default grants
and no selectors/overrides. Unit: 291 tests pass in 221.111s. Repository: 334
tests, 15 failure records, no errors, in 53.990s. All 138 tracked authored hashes,
HEAD and clean status agree before/after. Both live handles closed and the global
source lease was released only after comparison. Exact proof:
.work/qualification/foundation-aggregate-20261014/post-23e92c0/REPORT.txt;
manifest 1a033a508ea9e03cc0010ce0ce58ac6ac06d396d370ba3b5d7ee6b2db4a45b92.
Seven defaults failures, two assertion failures, constants, guard posture and
full Ruff/format remain. Two new baseline grant subcases fail because native
admission exits 1; their private receipts were inside the completed --rm worker
and cannot be recovered from that run. The exact diagnostics remain preserved.
A separate contained diagnosis subsequently earned the shared-fixture log/file-
limit cause; this checkpoint is not retroactively relabeled green.

Artifact declared-size authority, independently reviewed
-------------------------------------------------------
The remaining three artifact count/offset guards now express accepted byte
counts. Existing helper docstrings record the positive built-in integer size
precondition: operational admission belongs to load_declaration, and direct
fixtures simply provide field-conforming integer sizes. No repeated admission,
schema or exception waiver was added. Supported canonical CLI behavior, phase
selection, reads, errors, writes, digests and publication remain unchanged;
incidental arbitrary custom-comparator semantics are not a promised library API.
All 35 artifact tests, 14 policy fixtures and owner collectors pass, with zero
owner guard findings. Full Ruff/format pass; CLI bytes remain 86/158-byte exact.
Fourteen executed hashes match. Independent review verified the caller/domain
facts and source-bound proof with no issue. Exact evidence:
.work/qualification/artifact-size-contract-20261014/REPORT.md;
SHA256 7a0e2766376dfcd09df3add3eb291b5c59ca69e3e3b8cd7c3fb78cac794f25a1.
Preparation-only policy-copy permission errors are retained; subsequent explicit
comparisons prove the read-only copies already match current policy. No release
archive, model, fetch or publication occurred in this qualification.

Per-lane native grant fixture isolation, independently reviewed
-------------------------------------------------------------
The fresh aggregate exposed two baseline subcase failures. A contained diagnosis
reproduced both: earlier lanes grew shared engine.jsonl to 7053 bytes; baseline
inspection inherited its production 4096-byte file limit, and fake-client log
append raised OSError 27 before inspection dispatch (303 private stderr bytes).
A private fresh-fixture variant passed all seven original grant profiles.
Each NativeRenderedAuthorityChecks lane now owns its fixture/prerequisites and
baseline-run inputs. Profiles, prepare rename/restore, call slicing, success/
single-run assertions and every extra-authority/tmpfs negative remain unchanged.
The production cap and finite engine are unchanged. Mechanical imports/format,
assertion conventions and equivalent list unpacking follow the pinned policy.
All ten original module tests, both assertion collectors and full Ruff/format
pass. Independent review verified the source/frozen consumers/predecessor proof
and found no issue. Exact evidence:
.work/qualification/native-grant-fixture-isolation-20261014/proof.md;
SHA256 3eb8c7e68334ec4978de394e7353608beb90462bd59a24779b87233aaa93a756.
This fixes interference in proof setup, preserving the resource-grant test's
purpose. No runtime grant, live-engine behavior or model result was relaxed.

Core AST posture conventions, independently reviewed
---------------------------------------------------
The assertion-order, error-transparency and root-posture owners change one
live assertion operand order plus imports/formatting. Source-inventory owner
is unchanged. Complete AST comparison normalizes only import order and live
equality-operand order; embedded adversarial source strings, detector/discovery
rules, cases and numeric expectations remain intact. Twenty-seven original
fixture/scoped tests, four assertion checks and all four files' Ruff/format pass.
Thirteen exercised hashes agree; independent review verified predecessors/diff
and proof without an issue. Four grant-dependent inventory properties remain
unchanged and explicitly outside this focused proof. Exact evidence:
.work/qualification/core-ast-conventions-20261014/REPORT.txt;
SHA256 451291f2a3d777c7de857aee2ed0efcf9571dd69e8e8e3a0079a0f16d8cda0dc.
Other actors advanced HEAD independently; this qualifies the frozen cohort,
not an immutable whole checkout or complete repository check run.

Fixture call-log authority, independently reviewed
-------------------------------------------------
LauncherFixture exclusively creates its owned empty engine.jsonl; calls()
requires and parses that file. Empty owned evidence proves zero calls; missing,
malformed or preexisting evidence fails through the native filesystem/parser
exceptions. Four new cases cover those boundaries and a real first projection.
The finite append writer and grants are unchanged. Deletion followed by writer
recreation can still lose history; this is not a tamper-proof ledger.
Twenty-eight focused tests pass. Test-module Ruff/format and scoped posture
pass; existing shared-fixture import/format reds remain byte-identical.
Fifty frozen inputs agree before/after, including native snapshot 6433f794;
later native changes are outside this proof. Independent review found no issue.
Exact commands, grants, endpoints and limits:
.work/qualification/fixture-call-log-authority-20261014/REPORT.md;
SHA256 4fdf6a6ed6dc50c2699898df7bb6bd1fa30a68ae060f1e4836df10e48cc31913.

Model contract conventions, independently reviewed
-------------------------------------------------
The unchanged fixed CONTRACT now carries the exact module-constant exception
and its upstream ABI qualification rationale. Two guard complements preserve
already admitted integer domains and short-circuit type admission. Scientific
imports remain after receipt/identity/bounds checks with two narrow PLC0415
exceptions; moving them would cross that execution boundary. JSON stdout bytes
and inference argv are unchanged. Nine original model tests plus nineteen policy
fixtures pass; scoped collectors, full Ruff including RUF100, and format pass.
Mocked CLI output is exactly 90 bytes including LF. Scientific preflight was
mocked, so this proves no actual model execution. Independent review verified
caller/domain facts and all twelve frozen endpoints without an issue.
Exact source trace, commands, grants and evidence:
.work/qualification/baseline-model-conventions-20261014/REPORT.md;
owner SHA256 95ced85ddf0c4356583323962cde65afdd0d02fede1904d779f6633604a2f1fa.

Client cleanup effect truth, independently reviewed
--------------------------------------------------
A nonzero rm result cannot establish which bytes remain. The shared client
cleanup diagnostic now names the attempted path; state and status precedence
are unchanged. The executable fault double really deletes the directory before
returning 23. New subcases prove native success yields cleanup status 23, while
native failure 19 remains primary. The predecessor fails both wording checks;
all fifteen candidate client tests pass in the pinned offline checker. Frozen
source endpoints, commands and grants were independently reviewed without an
issue. Exact proof:
.work/qualification/cleanup-effect-truth-20261014/result.txt.

Silent-default detector conventions, independently reviewed
---------------------------------------------------------
Eleven of thirteen detector-package files change imports/formatting. One SIM103
tail returns its unchanged Boolean condition directly; actual ast.parse owners
give builtin-string equality and builtin-bool isinstance results. Complete AST
comparison admits only import order and that exact named tail transformation.
All matcher/fixture strings, adversarial classifications, inventories, discovery
and numeric expectations remain unchanged. Thirty-eight original focused tests,
four assertion checks and all thirteen files' Ruff/format pass. Independent
review verified predecessors and frozen endpoints without an issue. Seven
historical whole-source defaults reds remain unchanged and outside this proof.
Exact commands, source references, grants and limits:
.work/qualification/default-detector-conventions-20261014/REPORT.txt.

Result/output conventions, independently reviewed
-----------------------------------------------
Four result/output owner and test files now satisfy pinned Ruff/format and
scoped guard/assertion conventions. Three strict zips consume pairing established
by existing count guards or labels built from the same selected indices. Guard
complements preserve type admission, comparison order and thresholds; no duplicate
validation was added. Two narrow deferred-import exceptions preserve scientific
loading after preflight. Alignment, LMDB reads, pickle trust and cleanup remain
unchanged. Twenty-one original tests, fourteen detector fixtures and scoped gates
pass. Old/new probes match 636 outcomes, including inf/inf tolerance acceptance
and label-subtraction overflow rejection. Mocked inspection emits the exact same
126-byte JSON plus LF. Twenty-one frozen input hashes agree; independent review
found no issue. This is no real scientific-execution qualification. Exact proof:
.work/qualification/result-output-conventions-20261014/REPORT.md.

Make convention cohort, independently reviewed
---------------------------------------------
The Make parser and its two test owners now satisfy pinned Ruff/format and
assertion conventions. Eight narrowly reviewed sites flatten nested contexts,
use equivalent subprocess capture, make the original ValueError cause explicit,
or raise the configured TestCase failure directly at missing-target terminals.
Complete AST proof admits only those named sites and import order. Grammars,
fixture strings, messages, discovery and policies remain unchanged. Nineteen
original parser/help/dry-run/Make tests, four assertion tests and full scoped
Ruff/format pass; thirteen frozen hashes agree. Independent review found no
issue. Four whole-tree/visibility properties remain unchanged and outside the
narrow projection's proof. Exact evidence:
.work/qualification/make-conventions-20261014/REPORT.txt.

Fixed Docker environment inventory, independently reviewed
--------------------------------------------------------
The existing path/instruction/name/value inventory now records eight fixed
image contracts: container guard markers, bytecode suppression, copied-source
import path and two-thread CPU settings. These are runtime contracts, rather
than missing operator choices. Rationale sits beside the exact inventory; raw
matchers and all other inventories remain unchanged. The original two fixtures,
exact Docker inventory equality and twenty-four changed-value/new-path/ENV-to-ARG
negatives pass, alongside full owner Ruff/format. Twelve frozen inputs agree;
independent review found no issue. Whole-ops and other defaults properties remain
outside this focused proof. Exact references, commands, grants and endpoints:
.work/qualification/docker-env-inventory-20261014/REPORT.md.

Native stdio ownership and quiet return, independently reviewed
-------------------------------------------------------------
The internal stdio disposition inherits native stdout/stderr directly under the
same held lifetime and retirement fact. It creates no output log, FIFO, drainer,
pump or replay store; scientific untimed operation remains untimed. Stdin stays
/dev/null for the supported noninteractive Docker lane. Unknown retirement can
leave public writers alive; owner exit alone never proves EOF.
Independent wait-before-drain probing found that the helper's own failure printf
could hang on full stderr after native retirement. Confirmed-retirement stdio
now cleans controls quietly and returns status/fact without adding stream bytes.
Control removal failure changes only success; native/cancellation status remains
primary. Six stdout/stderr HUP/INT/TERM cases wait for exit before any pipe drain,
including actual deletion followed by rm23 and a suppressed stderr canary.
Full forty-three-method qualification passes in 132.422s, including all eleven
stdio methods, exact native bytes, cleanup precedence and existing captured modes.
Restoring the diagnostic reproduces three unread-stderr timeouts. Ruff/format/
syntax and frozen endpoints pass; fresh owner and proof reviews found no issue.
Earlier draining-only green evidence does not earn unread-consumer completion.
An earlier affected fourteen-method run remains red for an unchanged captured-
birth five-second timeout. Same-source isolation and the later full pass do not
establish its cause; this is an unresolved reliability caveat. The formatter-
runner error that produced an empty return2 test projection and failed receipts
is also retained. No budget widening or production workaround was introduced.
Exact commands, grants, predecessor limits, negative proof and endpoints:
.work/qualification/proxy-foundation-20261014/native-stdio-return-handoff.md;
SHA256 be1f5cb3d57d8ea165f07131c46f03c27f02e00164bebcab757da051566018c6.

Explicit preparation inputs, independently reviewed
--------------------------------------------------
Preparation requires all seven CLI paths/bounds and all three helper selection
bounds. No defaults move elsewhere. The canonical launcher already passes them;
both direct test callers now state their former values. Guard complements retain
exact-int admission, thresholds, errors and integer filesystem-size authority.
Read-only contexts retain ordering; the writer transaction stays nested so sync
still follows transaction exit. Three narrow deferred scientific-import sites
retain their existing execution boundaries. Selection, solvent categories,
trusted pickle, identities and publication are unchanged. Fifty-four focused
tests include seven omission subcases; scoped gates and full Ruff/format pass.
Sixteen exercised hashes agree; independent review found no issue. Compatibility
is with frozen baseline.sh 718bf83 at packet revision 2dfbf473, before its caller
migration. Two solvent-category findings and fixture protocol=4 remain visible.
The scanner-path orchestration mistake and corrected run remain recorded.
Historical scientific artifacts stay untouched. Exact proof:
.work/qualification/prepare-explicit-inputs-20261014/REPORT.md.

Artifact test conventions, independently reviewed
------------------------------------------------
Artifact/wheelhouse test imports, formatting and assertions now meet the pinned
policy. Eight contexts flatten with identical ordering, two positional-only
fixture consumers permit unused read-size renames, and two Path.readlink calls
preserve their former Path(os.readlink(...)) results. Four functools.partial
bindings capture each loop's fault value without new defaults or factories;
invocation timing, arguments and effects remain unchanged. Bounded AST proof
preserves every original payload, case, assertion value and event sequence.
All thirty-five artifact and fifteen wheelhouse tests, four assertion checks
and full scoped Ruff/format pass. Twelve frozen hashes agree; independent review
found no issue. The initial import/local-name collision and corrected run remain
recorded. No production owner, acquisition or scientific artifact changed.
Exact evidence and source contracts:
.work/qualification/artifact-test-conventions-20261014/REPORT.txt.

Explicit checker proxy admission, independently reviewed
-------------------------------------------------------
Checker acquisition uses explicit absence semantics and one short-circuit
accepted-domain gate: present loopback proxy, valid port, matching HTTP(S)
spellings and absent/empty bypass values. No ambient/direct replacement is
chosen. Denial precedes staging/network effects; completed verified inventories
still return without proxy configuration. Package/count guards consume existing
integer authority. Progress bytes, LF, flush timing, completion JSON and digest
bytes match the predecessor. Forty-five focused tests include sixteen required-
proxy and twelve bypass states; scoped gates and full Ruff/format pass. Sixteen
frozen hashes and protected dependency/image anchors agree; independent review
found no issue. Accepted proxy cases stop at mocked staging and transfers remain
mocked. One unchanged synthetic fixture default finding remains visible.
No transfer, install, advisory refresh or image build occurred. Exact proof:
.work/qualification/checker-explicit-proxy-20261014/REPORT.md.

Proxy conventions, independently reviewed
----------------------------------------
Six unchanged runtime limits carry existing exact constant tags and ownership
rationale, with pinned upstream values verified. Five accepted-domain guards
consume integer byte-count, offset or recursion-depth authority; floating
_remaining behavior stays unchanged. Two required-argument case helpers own
their original scenarios; unused callback renames retain positional callers,
and context/assertion conventions preserve ordering and meaning. Exact bounded
AST proof preserves all other production behavior and the entire unit-test AST.
Thirty-seven original tests plus twenty-three policy fixtures, scoped collectors
and full Ruff/format pass. Twenty frozen hashes agree; independent review found
no issue. Defaults remain visible at production/unit/posture counts 8/4/11.
Injected DNS/socket/time tests establish no real routing qualification. The
failed formatter/copy attempt and restoration remain recorded; corrected source
hashes, AST and final checks cover the recovered files. Exact proof:
.work/qualification/proxy-conventions-20261014/REPORT.md.

Finite engine fixture conventions, independently reviewed
--------------------------------------------------------
Twenty-two text prints now write identical bytes/LFs to the same streams; binary,
NUL and newline-free outputs remain intact. Path operations preserve generated
normalized-path behavior and string environment values. The signal callback
retains positional dispatch, and SystemExit97 explicitly chains its OSError
cause without changing CLI output/status. Exclusive call-log ownership, raw
grammar, defaults, aliases, CID control and recorded events are unchanged.
Bounded complete AST proof, fifty-five byte-for-byte protocol comparisons,
fifty-six original integration tests and full Ruff/format pass. The explicit
b435f415 public-source projection's 131 hashes/modes and two overlays are stable;
independent review found no issue. Frozen baseline718bf83/native4a219f5c qualify
this cohort; the concurrent baseline caller change is outside it. The initial
relative/absolute manifest-label mismatch remains recorded, then comparison uses
identical labels. No real image build, transfer or model operation occurred.
Exact commands, grants, source references and endpoints:
.work/qualification/finite-engine-conventions-20261014/REPORT.txt.

Baseline client ownership, independently reviewed
------------------------------------------------
Baseline prepares the common private client configuration after input/Git
admission, uses it for metadata and scientific work, and keeps its shell through
untimed native stdio dispatch. EXIT removes configuration only after confirmed
local retirement, before potentially blocked reporting. Unknown metadata stops
before a next helper call; unknown scientific retirement retains configuration
and can leave public writers. Native/cancellation status stays primary; failed
removal reports its attempted path. Scientific argv/grants, 72/113-byte identity
admission, private 4096-byte receipts, 30s/1s metadata policy and inert PRINT are
unchanged. No replay, pump or mirrored retirement authority was added.
Original twenty-eight plus seven new tests pass in 113.411s with actual outer
exit0; four original grant predicates pass in 2.373s. Scope lint/format/syntax
and frozen endpoints pass. New probes earn binary live streams, six owner-exit-
before-drain cancellations, both unknown-retirement retention cases, same empty
0700 configuration, poisoned-environment scrubbing and delete-then-rm23 effects.
Original launcher tests assert UID:GID argv; new config cases do not separately
assert configuration ownership UID. Two ownership mutants fail as intended.
Fresh source and proof reviews found no issue. Shared fixtures use original
98c392/61240 snapshots; combined qualification with the new styles remains due.
Earlier imported-TestCase discovery, missing mounts, mode126 and mutable-harness
exit2 attempts remain recorded. The actual append errno27 at 7354 log bytes is
fixed by fresh per-case fixtures, preserving the metadata cap; an intermediate
trace-reset experiment is not final qualification. No real engine/model action
or engine-side cancellation is established. Exact proof:
.work/qualification/baseline-client-ownership-20261014/HANDOFF.md;
SHA256 4be88f833be589db5f211b751fd66afccc1f6aff2f39f90167be7438fb8bf85f.

Fresh maintained aggregate at d5684a5
-----------------------------------
Exact clean revision d5684a5841d7c8df06a614ab38a8053e5252abad ran the actual
make test/unit and make test/repository lanes in parallel, with default grants
and no selectors/overrides. All 315 unit tests pass in 279.506s, exit0. Repository:
339 tests, ten failures, no errors, in 46.360s, Make exit2. All 139 tracked authored
hashes/modes, index, HEAD, clean status and submodule pin/head agree before/after.
Both handles closed before releasing the global source lease. Combined current
baseline/new shared-fixture qualification passes in these maintained lanes.
Remaining failures cover five defaults properties, two assertion properties,
one guard, full Ruff and formatting. The sole guard is baseline_run's finite/
nonnegative predicate; Ruff has 64 diagnostics in thirteen files, formatting
nineteen. This is a fresh remaining-work inventory, not foundation closure.
Exact commands, full failures, protected endpoints and evidence manifest:
.work/qualification/foundation-aggregate-20261014/post-d5684a5/REPORT.txt;
SHA256 fec13f7b948981576a99541afe2762ca06705e460d4ddf049cebd19906990c67;
evidence manifest acf3bf682b64e01b1a97dd8eabeb5c7a5cc2a57d5857ce694fe93e42df709928.

Baseline run conventions, independently reviewed
----------------------------------------------
The final tolerance guard states its exact accepted type/finite/nonnegative
domain, preserving short-circuit order, thresholds and errors, including bool,
NaN, infinity and large-integer conversion behavior. Imports, one combined
preflight log/stdout/stderr context and JSON plus LF output meet pinned style;
journal, identity, subprocess, comparison and failure effects remain unchanged.
Eleven original tests plus twenty-three fixtures, scoped collectors and full
Ruff/format pass. The existing invalid-tolerance table now covers twenty-seven
rejected field/value cases. Mocked run forwards identical inputs and emits the
same 228 bytes. Twenty-one frozen hashes agree; independent review found no issue.
No actual scientific execution occurred. Exact proof:
.work/qualification/baseline-run-conventions-20261014/REPORT.md.

Runtime probe conventions and actual kernel proof
------------------------------------------------
The runtime probe retains all original UID/GID, capability, no-new-privileges,
cgroup, read-only filesystem and offline-network assertions. Its caught network
error check now explicitly raises AssertionError with the original OSError cause
for unexpected errno; this is a runtime probe, with no pytest dependency added.
Imports/formatting and JSON plus LF output meet the pinned policy. Actual
maintained make test/probe passes before and after, using unchanged default
grants and the pinned 593bd06e base digest observed as image9cb180cb. Both runs
emit identical 258-byte stdout and empty stderr, including output ownership.
Twenty-three original policy fixtures, scoped collectors and full Ruff/format
pass; current/formatted/exercised hashes agree. Fresh independent review found
no issue. No scientific inference, download or image build occurred. Exact proof:
.work/qualification/runtime-probe-conventions-20261014/REPORT.md.

Inventory and check-support conventions, independently reviewed
--------------------------------------------------------------
Seven support owners satisfy pinned imports/format/assertion conventions.
Named repairs preserve checked Git byte capture, environment scrubbing and
causal errors; a local reference-artifact binding is renamed without touching
the shared source module. An unused import is removed while its module import
remains. load_declaration moves to ordinary imports: its guarded stdlib-only
module adds no operational work or cycle, and the original complete release/
selection property exercises that dependency. Exact bounded AST proof preserves
all roots, exclusions, grammar, provenance fields, strings, guards and messages.
Forty-eight existing methods, scoped collectors and full Ruff/format pass;
thirty-seven/forty input hashes and modes agree, with owner modes unchanged.
Fresh independent review found no issue. The d5684a5 dependency snapshot excludes
concurrent edits; whole-tree properties remain explicitly outside this proof.
Exact sources, commands, grants, Git probes and formatter outputs:
.work/qualification/inventory-support-conventions-20261014/REPORT.md;
SHA256 680e28516f6b61e1c5317c65e1950080a3cc42b1829894fc697083b8f99fda80.

Engine/build test conventions, independently reviewed
---------------------------------------------------
Two fixture/test owners now meet pinned import/format/assertion conventions.
Two nested Boolean gates merge in the same evaluation order, three text writes
preserve LF, five contexts flatten in the same order, and literal list unpacking
preserves values. Six explicit check=False calls retain the prior default and
caller-owned status/diagnostic assertions. Bounded AST proof preserves every
original fault string, case, mode, cap, status, publication value and 0.1s budget.
Seventeen original inference, seven checker-consumer, five guard and four
assertion tests pass; ten engine protocol comparisons preserve all bytes/status/
evidence. Full Ruff/format pass. The d5684a5 public source projection's 132 hashes/
modes and two overlays agree; fresh independent review found no issue. Current
worker changes are outside this snapshot qualification. No real build, model
or network action occurred. Exact sources, commands, grants and endpoints:
.work/qualification/engine-build-test-conventions-20261014/REPORT.txt.

Scientific contract test formatting, independently reviewed
----------------------------------------------------------
Four test owners meet pinned formatting with identical complete ASTs, without
normalization. All 28 original methods pass, including dependency ownership,
complete Docker inventories, historical producer/reference verification,
attribution, synthetic extraction mutations and pinned solvent categories.
Full Ruff/format pass. Qualification uses the complete committed 793680ce public
projection and pinned upstream source, with immutable historical Git objects
read-only; hashes/modes and protected endpoints agree before/after. Independent
review found no issue. Policies, historical receipts and scientific results are
unchanged. No actual scientific execution or live aggregate is established.
Exact commands, grants and evidence:
.work/qualification/scientific-contract-test-conventions-20261014/REPORT.md;
SHA256 0808b3d4ad4e61aa4630ffc08d75f974f9b31af0214f59cef7042db8b170617a.

Caller test conventions, independently reviewed
----------------------------------------------
Three caller test owners meet pinned formatting/assertion/import conventions.
Fourteen named subprocess calls state check=False, preserving the previous
default and caller-owned status/diagnostic observations; one stderr write keeps
the exact LF bytes. Existing checked cleanup syscalls, binary writes/flush,
fault strings, cases, caps and deadlines remain intact. All 35 original methods,
four assertion fixtures, bounded full-module AST proof and eight predecessor/
current binary protocol comparisons pass. Full Ruff/format pass. Frozen 793680ce
public inputs, overlays, proof hashes and modes agree before/after. Independent
review found no issue. Finite doubles and local retirement establish neither
real-engine behavior nor scientific qualification. Exact proof:
.work/qualification/caller-test-conventions-20261014/REPORT.txt;
SHA256 9dd7a2d8199e72fdfd172e2a158619257ee49496a29f7826e47bbb4856ee713b.

Input port test conventions, independently reviewed
--------------------------------------------------
Three input/Git/build test owners meet pinned import/format/assertion conventions.
Named changes retain the Docker instruction grammar, adjacent context ordering,
observed Git statuses and finite path set; stdlib imports follow the guard.
All 57 original methods plus two assertion fixtures pass in 24.166s, with full
Ruff/format and scoped guards green. Every fault string, case, cap, mode, deadline
and publication/retirement assertion is preserved. Frozen 1283f755 dependencies
exclude concurrent owners; hashes/modes agree before/after. Independent review
checked the actual diff: the AST normalizer alone is broader than the named
sites and is not sole proof. No actionable issue was found. Tests use finite
engines and actual contained temporary Git, without real builds or science.
Exact sources, commands, grants and evidence:
.work/qualification/input-port-conventions-20261014/REPORT.md;
SHA256 e708720c24c9dca3b85cff642b18d2abc10ef26ef7d0227b9a18a74d8e77615b.

Fresh maintained repository qualification at f2fa1b94
--------------------------------------------------
Actual make test/repository at clean f2fa1b94bde83e7e7f053d69f79b257cb1516c6d
ran all 339 tests: seven failures, no errors, 51.334s, Make exit2. Full selected
Ruff, formatting and guard posture pass. Five defaults properties remain red;
the other two failures identify fourteen expected-first and two msg spellings
in tests/test_baseline_launcher.py. Those last assertion repairs remain due.
HEAD/status/index, every tracked authored hash/mode and submodule pin/head agree
before/after; no source change occurred during the maintained default-grant lane.
The native handle closed before releasing the lease. No unit rerun occurred:
the earlier maintained 315-test pass and newer focused passes retain their own
revision/scope. This is current check evidence, not foundation closure.
Exact commands, full diagnostics, endpoint comparison and verified manifest:
.work/qualification/foundation-aggregate-20261014/post-f2fa1b9/REPORT.txt;
SHA256 7b787a0533b2aec38270500e5d9682179c486801755140a07579f1e752a5c32f.

Remaining baseline launcher assertion conventions, independently reviewed
------------------------------------------------------------------------
Exactly fourteen visible expectation swaps and two msg= spellings close the
fresh aggregate's assertion findings in tests/test_baseline_launcher.py.
Restricted proof rewrites only those named original calls; every remaining AST
node, case, string, number, default, grant and fault assertion is unchanged.
All fourteen original module tests, four assertion fixtures, full Ruff/format
and hash/mode comparisons pass. Independent review found no issue. Initial
private proof selection and one extra swap were corrected and retained as
failed attempts, not final evidence. No production or default policy changed.
Exact frozen f2fa1b94 sources, commands, grants and evidence:
.work/qualification/baseline-launcher-assertions-20261014/REPORT.txt;
SHA256 a2823994fc999376fdda18932b22c3f78314e2f675429479d06b46017d3a7b37.

Shell assignment publication applicability, independently reviewed
----------------------------------------------------------------
The inherited Dapp blank-assignment regex treated private shell lifecycle state
as published environment. Its regex, original fixtures and all other detectors
remain unchanged; .sh applicability now uses literal source export candidates.
Every blank assignment to an exported name still fails, even when corrected
before export. Dynamic/uncertain export, set or shopt publication keeps original
raw coverage. This is conservative lexical policy, without execution tracing;
inherited export state and command indirection remain outside its contract.
Before: directory= triggered "blank env assignment" despite no source export.
After: that private reset passes; TOKEN= followed by export TOKEN still fails.
Dotenv, Compose, workflow and Docker checks retain their publication duties.
Twenty-eight original/new fixture methods pass, including seventeen discovery
and twenty-one actual-property subcases; full Ruff/format, original AST boundary,
hash/mode comparisons and fresh independent review pass. Peer-found dynamic
set/shopt gaps were fixed and re-reviewed. Host owner mode664 is unchanged;
the committed dependency projection's mode644 is a separate recorded fact.
The other three Ops properties were exercised: Make passes, two remain red,
with fifteen expansion/silent-success findings and no private-reset findings.
No allowance inventory or syntax hiding was added. A separate preexisting gap
remains: a multiassignment export can hide an individual blank value, including
the intentional deny-all GIT_ALLOW_PROTOCOL contract in inference_inputs.sh.
Precise pinned sources, rationale, failed attempts, commands and frozen proof:
.work/qualification/shell-env-applicability-20261014/REPORT.md.

Inference image client ownership, independently reviewed
-------------------------------------------------------
The launcher adopts the shared owned Docker configuration/environment policy.
The native helper's fact gates every config/capture/unpublished-record removal;
unknown retirement stops before another helper can replace it. Six original
scientific native calls, offline argv/grants, 120/900/30 budgets, byte admission,
immutable capture and publication remain unchanged. One original fixture gains
the required common-client copy; all its other AST nodes are identical.
Quiet removals precede reporting; failed removal names attempted path/status.
Testing caught three full-stderr cancellation timeouts in builtin printf even
after resources were removed. A proposed plain publisher PID also had a reuse
race. The fix reuses the existing held native owner for one fixed diagnostic
program only after confirmed retirement, then exits immediately. Removal-phase
cancellation finishes quiet removals and exits before starting that program.
Before: rm failure could say "retained" after deleting its target, and a blocked
printf prevented its cancellation trap from running. After: diagnostics state
attempted-path truth, and the held reporting owner returns129/130/143 on cancel.
Final eleven client methods (eight original, three new), seventeen original
image methods and twenty posture fixtures pass, with full Ruff/format/syntax.
Actual KILL-denied retirement retains config/capture/raw evidence and stops at
one engine call; unchanged image record bytes/inode are observed. Unpublished
record retention is source-gate proof, not a fabricated first-call runtime fact.
Delete-before-failed-rm preserves0->9,7->7,130->130. Six unread-stderr cases prove
single-signal removal cancellation and blocked-reporter cancellation before any
drain, including owned descendant disappearance. Success output and scientific
PRINT tails match exact predecessor bytes; extra poisoned engine fields scrub.
Frozen 91fb2d71 source/helper hashes and modes agree. Fresh source and proof
reviewers found no issue. Prior unknown/pre-return blocked diagnostics remain
an explicit limitation; shared native captured cleanup truth needs its own fix.
No real image build/import or scientific execution occurred. Exact evidence:
.work/qualification/inference-client-ownership-20261014/REPORT.txt;
SHA256 89ebbca1fd2a8fe5d22f9e1053a4a3e764b0a82087494c4b0bb65da23537250f.

Maintained combined qualification at ed429f17
-------------------------------------------
Actual make test/unit and make test/repository ran in parallel at clean
ed429f1759d8f245436e2619ffd574892df2491c with default grants/discovery.
All 315 unit tests pass in 276.491s, Make exit0. Repository: 344 tests in60.078s,
seven failures, no errors, Make exit2. Five defaults properties remain red;
the other two are subcases expecting the old capture cleanup diagnostic in
test_inference_inputs.py:203. Observed status predicates pass; updating that
assertion to the truthful attempted-path wording remains due. Ruff, formatting,
assertion roles and guard checks pass. All139 authored hashes/modes, HEAD/status/
index and submodule pin/head agree before/after. Both handles closed before the
source lease was released. Pause interrupted only report finalization; the
resumed report uses the completed evidence and does not claim the later mutable
checkout was frozen. No runtime/scientific readiness is inferred. Exact proof:
.work/qualification/foundation-aggregate-20261014/post-ed429f1/REPORT.txt;
SHA256 095aa728bd5c97c9f744dfd0a9e5168e0ee3b828209fce765982c99dee5458b0.

Capture diagnostic expectation alignment, independently reviewed
--------------------------------------------------------------
One literal in test_inference_inputs.py now expects the truthful attempted-path
cleanup diagnostic. Every other byte/AST node, original status predicate and
retained-capture filesystem assertion is unchanged. All twelve original methods
pass, including the two stale0/7 subcases; twelve posture fixtures, full Ruff/
format and frozen hash/mode comparisons pass. Independent review found no issue.
Exact ed429f17 dependencies exclude concurrent launcher edits; no broader gate
or scientific execution is claimed. Precise commands and evidence:
.work/qualification/capture-diagnostic-expectation-20261014/REPORT.txt;
SHA256 3959e99c4f4abdd1e51d9bbcb7808c9a31848cd3032c77707391d2dab8ae07ce.

Explicit launcher input presence, independently reviewed
-------------------------------------------------------
Seven launchers test argument presence before reading optional print/timeout
positions; acquisition tests interface presence/nonempty before binding it.
Before: ${1:-} manufactured an empty value to inspect a missing argument.
After: [[ $# -gt 0 && "$1" == --print ]] states the presence condition directly.
Missing timeout/interface and selector diagnostics retain their original bytes,
status and zero-effect behavior. No helper, setting, selector inventory or waiver
was introduced. Complete source restoration proves all other bytes unchanged.
Ninety-two predecessor/current CLI pairs preserve raw status/stdout/stderr,
zero engine calls and inode/mode/mtime/content effects, including twelve valid
previews. All120 original methods across eight full modules pass in76.996s;
all seven syntax checks and four original defaults fixtures pass. Both unchanged
raw Dapp/Vote matchers find zero recognised expansions in these scripts.
Frozen ed429f17 dependencies exclude concurrent owners; hashes/modes agree.
Independent source and proof reviews found no issue. Two private fixture mistakes
were corrected without source changes and retained separately. This is focused
input qualification, not whole-repository closure. Exact sources and commands:
.work/qualification/explicit-launcher-presence-20261014/REPORT.txt;
SHA256 b9eccf061c060c4820d2fa95ab3526fbed56cf55bbe92933f3d9ed13c38b5fc6.

Optional subset absence ownership, independently reviewed
-------------------------------------------------------
baseline_model removes only redundant default=None from its optional subset
action. The pinned UniCore root parser and stdlib store action already own that
absence; its later SUPPRESS model group does not change the existing action.
Exact factory reference is recorded in place. Qualified UniCore source:
https://codeload.github.com/dptech-corp/Uni-Core/tar.gz/ace6fae1c8479a9751f2bb1e1d6e4047427bc134
archive SHA256 ae240ff27dfc4c698081260d58ce4bee30d4f437fef23bed89d4033625f21583;
unicore/options.py member SHA256 ef2eaf74a91d71c9919410d4d81238060d20dddf763250ecfb8c18bd6345c509.
Factory/default precedence and exact member lines are documented in
.work/qualification/subset-absence-analysis-20261014/REPORT.md.
Nine original tests, scoped posture, full Ruff/format and whole-module AST proof
pass; omitted/supplied/empty/missing-value parser results and diagnostic bytes
are identical. Frozen 9eb0d53 dependencies exclude concurrent work. Independent
review found no issue. This is source/stdlib equivalence, without scientific
parser/model execution. The solvent-category expression remains unchanged:
rewriting it merely to evade a matcher is not earned and can change unhashable
or custom equality/hash behavior. Exact implementation evidence:
.work/qualification/subset-absence-conventions-20261014/REPORT.txt.

Shared captured cleanup diagnostic truth, independently reviewed
---------------------------------------------------------------
Exactly one native-helper printf literal now reports attempted path/status after
successful captured execution followed by failed evidence-directory removal.
Before: "retained path" could be false when rm deleted the directory then failed.
After: the attempted-path diagnostic states only the known removal outcome.
Every other helper byte, status/cancellation override, trap, stdio branch and
product deadline is unchanged. All38 original discovered identities remain;
one earned method adds cleanup signal coverage. Full39 discovery passes in
128.842s, with twelve original posture fixtures and full Ruff/format/syntax.
Focused sixteen subcases observe actual before/after rm23 effects,0->23/7->7,
and twelve signal/effect/native-status combinations preserving129/130/143,
confirmed retirement and actual directory effects. Frozen ed429f17 bytes/modes
and final proof hashes agree; independent source/proof review found no issue.
The private outer120s wrapper expired before discovery completed, without an
assertion failure; its retained attempt is separate from the final180s wrapper.
No product budget was widened. Host/projection modes are separately recorded.
Captured pre-return diagnostic blocking remains unchanged; no broad closure
or scientific execution is claimed. Exact evidence:
.work/qualification/native-captured-cleanup-truth-20261014/REPORT.txt;
SHA256 a960f05832e8ffde3bae7d0c81ba4f89acc15b83d3a0c93520fb258e7c229455.

Fresh maintained repository qualification at c60f5fad
---------------------------------------------------
Actual make test/repository at clean c60f5fad12382b5efe456fc408e0a6eb48c33b0a
ran344 tests in63.172s: three failures, no errors, Make exit2. Capture diagnostic,
assertion, Ruff, formatting and guard checks pass. Remaining properties cover
six acquisition-shell silent-success sites,143 Python-default findings and the
proxy CLI's implicit port0. Counts overlap and are detector findings, not143
adjudicated defects. No unit rerun occurred; earlier315 and newer focused120/
39/9 proofs retain their own scopes. All139 authored hash/mode entries, HEAD/
status/index and submodule pin/head agree before/after. The native handle closed
before releasing the source lease. This is current check evidence, not closure.
Exact default-grant commands, diagnostics and verified manifest:
.work/qualification/foundation-aggregate-20261014/post-c60f5fa/REPORT.txt;
SHA256 1512b3158c6019d68d857dce8f5d375e8f4f8113202db5ad6fdf80fd26e56176.

Explicit proxy port ownership, independently reviewed
---------------------------------------------------
The internal proxy CLI now requires --port; its canonical launcher explicitly
supplies0, preserving kernel-selected listener allocation and readiness routing.
No public Make selector is added. Direct callers omitting --port now receive
parseerror2; the deliberate compatibility change and --port0 usage are explained
in place. Explicit0/nonzero behavior and all transport/grants/readiness code
remain unchanged. Forty-four methods (forty-two original, two new), twelve
posture fixtures, seven raw-default fixtures and full Ruff/format/syntax pass.
Omission rejects before interface/socket/server/file work; mocked startup proves
bind arguments and actual readiness bytes, not real kernel routing. Existing
method identities and ASTs remain, apart from the two explicit caller argv sites;
canonical preview bytes differ only by --port0. The whole frozen operator-env
collector is green; one raw Python finding disappears, seven other proxy-owner
findings remain honestly recorded. Frozen c60f5fad bindings exclude concurrent
package work, with stable hashes/modes. Independent source/proof review found
no issue. Precise precedent, compatibility rationale and failed attempts:
.work/qualification/explicit-proxy-port-20261014/REPORT.txt;
SHA256 76781451b9820fd7fbf6d5c8c41c626bcd8e9df8634d0ec196c273ad558cf763.

Explicit Make-control revocation, independently reviewed
------------------------------------------------------
The fixture's make() removes inherited MAKEFLAGS, MFLAGS and MAKEOVERRIDES from
its fresh environment copy. Before: environment.pop(name, None), unused return.
After: if name in environment: del environment[name]. The old behavior was
correct; the new spelling makes idempotent revocation explicit without choosing
an operator replacement value. Actual producers supply fresh builtin dicts;
the change makes no claim about custom mappings or concurrent mutation.
All17 original operator/metadata methods pass in3.302s; four predecessor/current
probes preserve incoming environment, argv, status/stdio, caller dictionaries,
missing-Make rejection and real finite GNU Make effects. Twelve original posture
fixtures, scoped configured Ruff/format, and exact one-site byte/AST proof pass.
The unchanged defaults detector removes this one finding; five other fixture
findings remain. Frozen aea9346 dependencies exclude concurrent package changes;
source/projection hashes and modes agree. Independent source/proof review found
no actionable issue. This is focused fixture qualification, not repository-wide
or scientific qualification. Exact sources, commands and retained evidence:
.work/qualification/make-control-revocation-20261014/REPORT.txt;
SHA256 a70f4755e292650ad28c5801b5b76fa09f1a5604a1d4da1b9a965f83e327a180.

Package build/apply client ownership, independently reviewed
----------------------------------------------------------
Packages-owned build/apply now use the existing private Docker configuration
and held native owner. Before: ambient client configuration could affect both;
build ran in command substitution and published arbitrary quiet output as its ID.
After: fixed BuildKit/default-builder policy and direct parent-owned execution
require exactly72 immutable-ID bytes before publication; offline apply preserves
its argv, grants and output. Native retirement gates quiet configuration cleanup;
primary/cancellation status survives cleanup failure and diagnostics state only
the attempted removal outcome. Unknown retirement retains evidence and stops.
Review reporting after the separate stage controller returns also uses the held
owner: a blocked public stdout write must not postpone cancellation and cleanup.
All9 new tests pass in35.294s, including actual blocked Review publishers under
held process groups, one HUP/INT/TERM each, and completion before either pipe is
drained. All66 original package/operator/build methods pass in17.088s; four
original detector fixtures, scoped collectors, configured Ruff/format and syntax
pass. A required native-helper copy was also added to the guarded tooling
fixture; all9 of that module's original methods pass in1.846s, with exact one-
tuple-change proof and scoped Ruff/format. This source-deduced dependency gap
was corrected before aggregate qualification. Original consumers were not
needlessly rerun after test-only observer and fixture-copy changes.
Frozen b6dfc53 dependencies exclude concurrent changes; source/projection hashes
and modes agree. Independent source/proof review found no actionable issue.
Retained failures distinguish a disappearing procfs child from the subsequently
corrected proof gap: a live publisher alone had not established a blocked write.
Stage acquisition remains docker.sh's separate authority. These finite doubles
do not prove live acquisition, immutable package build context or independent
observed-image admission; those remain open. Exact evidence and failure history:
.work/qualification/packages-client-ownership-20261014/REPORT.txt;
SHA256 fb64a1c2404d9c66090f3b41a7e562c0ee57969195ffb250b679f3780cb53feb.

Cancellation CID candidate extraction, independently reviewed
-----------------------------------------------------------
Two acquisition cleanup reads now request64 characters and clear a failed short
candidate, replacing read-to-newline followed by unconditional success. Complete
64-hex IDs ending at EOF remain valid. The existing ASCII grammar and exact
whole-receipt byte comparison remain the sole authority for container effects;
candidate extraction alone grants nothing. Bash counts characters and skips NUL:
this is not a64-byte I/O cap for arbitrary malformed streams.
All25 original cancellation/launcher/network-gate methods pass in14.647s;
the four original TERM birth cases remain and two no-newline positives are
added. Twenty-two predecessor/current cleanup probes preserve status143,
diagnostic bytes, removal order and evidence effects for both container roles,
including short/long/NUL/multiline/extra-newline/link/FIFO/mismatched receipts.
Twelve original policy fixtures, scoped collectors, Ruff/format and syntax pass;
exact source proof permits only the two reads and their two intent comments.
Frozen843fa29 dependencies exclude concurrent package changes; hashes/modes
agree. Independent source/proof review found no actionable issue. Four other
acquisition silent-success sites and native lifecycle work remain open; no
general cleanup or live-engine qualification is claimed. Exact evidence:
.work/qualification/acquisition-cid-candidate-20261015/REPORT.txt;
SHA256 950b3ccbb2904cf8241e20ecf5c5e4b90480493de02097dc2048013bb7b76b7d.

Maintained combined qualification at9eedc20, with integration failure
------------------------------------------------------------------
Actual make test/unit and make test/repository ran concurrently at clean
9eedc20601f2180797e190fffdc0587e48877d6d with default discovery and grants.
Unit ran319 methods in314.421s, Make exit2: one failed-import placeholder;
the other318 methods pass. The new package-client module imports a repository-
check fixture that the narrower unit lane intentionally cannot read. Its nine
methods did not execute here; earlier focused evidence cannot replace discovery.
Repair belongs at test ownership, without widened grants or duplicated fixtures.
Repository ran344 methods in59.738s, Make exit2: two failing checks, covering
four acquisition-shell suppression sites and147 raw Python-default findings.
Other repository checks pass. These counts are evidence, not defect adjudication
or foundation closure. Both original handles were observed terminal before the
after snapshot and source lease release. All140 authored hashes/modes, HEAD,
clean status, index and submodule pin/HEAD agree. The failed run is retained:
.work/qualification/foundation-aggregate-20261015/REPORT.txt;
SHA256 a121717c11120ba6701cb120302e8bf6ebd854f5ac04f696e8f5b79bff49d1ad.

Upstream boundary, reaffirmed2026-10-15: NMRNetplusplus code and its pinned
revision remain unchanged. Bring any necessary change there for discussion
before editing or moving the gitlink. Current work belongs to this repository's
launchers, checks and qualification. Two further source-reviewed native gaps are
the final build/import success printf calls in tools/inference_image.sh: public
stdout backpressure can defer EXIT cleanup. Their correction and actual blocked-
publisher cancellation proof remain pending, not established by this run.

Package-client check ownership correction
----------------------------------------
The new package-client module moves byte-for-byte from tests/ to
repository_checks/test_packages_client_config.py, matching the shared fixture's
existing repository-lane owner. Executable mode755 and source SHA256
dc4b8f6146f660078a2d0ca2db98a33299b3720621363eb58a49157c35f810c9
are unchanged; no mounts or fixture copies are added. All nine methods and their
dynamic executable paths remain intact. Source review approves the boundary;
maintained discovery/runtime qualification must still run after this correction.
The failed9eedc20 run remains historical evidence. Exact move and source proof:
.work/qualification/packetownershipfix-20261015/REPORT.txt;
SHA256 a2836dfcaf462ef8e95497746a3c7d3fb118f9313655a1121de462eb064bbf13.

Maintained qualification after ownership correction at3adde8a
------------------------------------------------------------
Actual default-grant make test/unit passes318 tests in322.217s, exit0, at clean
3adde8a08eac817de7c27b9752f6899d6c499155. Actual make test/repository runs353
tests in98.535s, exit2: all nine relocated package-client methods are discovered
and pass; two existing policy checks remain red (four acquisition shell sites,
147 raw Python findings). No unit grants were widened and no test methods lost.
Both original handles were observed terminal before after snapshots and lease
release; all140 authored hash/mode entries, HEAD/status/index and submodule
pin/HEAD agree. Upstream internal status is clean. The prior failed import run
remains preserved separately. This proves maintained test ownership and affected
runtime behavior, not foundation or scientific qualification closure.
Exact commands, raw logs, terminal receipts and verified evidence manifest:
.work/qualification/foundation-aggregate-20261015-test-owner/REPORT.txt;
SHA256 9b1cc9ae9f06dbacde14ac8982f449a5130f015695aafa72842a69b0824c53c7.

Remaining reporting scope also includes tools/inference_native.sh's captured-
mode diagnostics after confirmed local retirement: synchronous public stderr
writes can block before returning to caller EXIT cleanup. Native failure7,
malformed identity2 or failed evidence removal can trigger this with a full
unread stderr pipe. Configuration/capture cleanup liveness therefore still needs
an owned failure-report boundary and undrained-pipe cancellation proof. This is
source-reviewed, distinct from unknown retirement and final success reporting;
passing tests above do not establish that missing behavior. Next delegated
changes cover offline wheelhouse client ownership and final inference success
reporting; acquisition lifecycle, package capture/image admission, defaults
adjudication and actual scientific qualification remain separately open.

Inference success reporting, independently reviewed
--------------------------------------------------
The final build/import success messages now use the existing held native owner
with untimed stdio and fixed printf literals/explicit arguments. A full unread
stdout pipe can therefore be cancelled before EXIT retires config/capture.
All other launcher bytes remain unchanged except verified intent comments;
scientific argv, grants, budgets and image admission/publication are preserved.
The build record is already committed when reporting starts and remains truthful
after report cancellation or uncertain retirement; no rollback is claimed.
All28 original methods plus two earned methods pass in27.080s. The final two
methods pass in4.520s after stronger observers: six build/import signal cases
observe the actual blocked writer and sole live anchor before one HUP/INT/TERM,
then129/130/143 and retired config/capture before drainage. Two actual KILL-denial
cases instead retain owned state and the committed record, without another call.
Twenty original posture fixtures, scoped collectors, Ruff/format, syntax and
exact-source/original-method proofs pass. Successful output and complete PRINT
bytes match. Closed stdout has a deliberate raw wait distinction: predecessor
SIGPIPE(-13) becomes normal exit141 after owned cleanup; shell conventional141
and observed state effects agree. No compatibility self-signal shim is added.
Frozen3adde8a dependencies exclude concurrent changes; hashes/modes agree.
Independent source/proof review found no actionable issue. Shared captured-mode
pre-return stderr blocking remains open. Exact commands, failed setups and proof:
.work/qualification/inference-success-reporting-20261015/REPORT.txt;
SHA256 e31d5438f8aed2e4db835db94dcb6cf947671cd1b0d9914e3113c422447380fb.

Wheelhouse offline client ownership, independently reviewed
---------------------------------------------------------
Offline check replaces the ambient bare engine/exec with the existing private
client and held untimed stdio owner. Confirmed retirement gates quiet cleanup;
unknown retirement retains configuration without another owner. Cleanup reports
attempted-path truth and preserves primary/cancellation status. Download remains
the acquisition controller's separate owner; all worker argv/grants/budgets and
output remain unchanged. The new six-method repository module passes in14.240s,
with four original policy fixtures, scoped collectors, Ruff/format and syntax.
All34 original consumers were exercised:33 passed and one rejected a comment
mentioning packages.sh. The comment now accurately cites inference_image.sh's
same cleanup pattern; the failed method then passes. Runtime bytes are unchanged
by that correction. This is split qualification, not a claimed exit0 full34 run.
Frozen3adde8a dependencies exclude concurrent work; final141 projection hashes
and modes agree. Independent source/proof review found no actionable issue.
Full-pipe cleanup reporting is supported by the reused native-owner contract,
without a new wheelhouse-specific pipe probe; no live engine/download claim.

A proposed dependency-check comment projection was rejected before integration:
physical # lines may be multiline quoted data or escaped-LF continuations;
Python newline normalization introduced further false acceptance. Fixing those
ad hoc would require an unearned Bash parser. The original strict checker and
all fixtures were restored byte-for-byte; no waiver or weaker classifier lands.
Rejected candidates, failed proof and rationale remain with exact final evidence:
.work/qualification/wheelhouse-client-ownership-20261015/REPORT.txt;
SHA256 e28d2f678992c73db5c6fa1109474c75cdeacd783c67a744a859aa71df70531f.

Package observed-image admission, independently reviewed
-------------------------------------------------------
Before: the resolver build's returned image ID was published directly to the
stage record. After: the same private client independently inspects that exact
candidate through the existing held native owner, with the inference launcher's
fixed30s metadata budget; only exact canonical equality permits publication and
controller dispatch. Build remains untimed. Recipe, worker grants, PRINT and
paired lock/advisory publication are unchanged. The local precedent is
tools/inference_image.sh's build/observed-ID admission; this establishes observed
local identity, not image contents or immutable package build-context capture.

Before:
    lock_image=$inference_result
    printf '%s\n' "$lock_image" > "$stage_directory/image-id"
After, between those statements:
    inference_native 'package built image admission' "$image_admission_timeout" image-id \
        "${engine[@]}" image inspect --format '{{.Id}}' "$lock_image"
    # Reject unequal observed and built IDs before publishing either result.

Final14 package methods pass in76.958s, including malformed/unavailable/mismatched
observations, three actual cancellation signals, actual unknown-startup retention
and a two-caller rescue isolation case. All9 original method bodies are unchanged;
75 original consumers pass in24.171s, and four original policy fixtures pass.
The final test-only rescue refinement does not change those75 dependencies.
Scoped posture checks, Ruff/format, syntax, source restoration and141 frozen
file hash/mode endpoints pass. Independent source and final evidence review found
no actionable issue. Failed-probe rescue was corrected after review: historical
call logs alone cannot authorize signals; retain the unreaped caller identity,
observe its death, admit only matching live held anchors and prove group retirement
before authorizing retained-path removal. The earned two-caller test exercises it.

New mismatch stderr still shares the explicitly open post-configuration reporting
gap; shared captured-mode diagnostics, immutable package context and actual engine
qualification remain separate work. This focused run does not replace the earlier
combined qualification or establish current scientific inference. Exact commands,
projection, review corrections, receipts and limitations:
.work/qualification/packages-observed-image-20261015/REPORT.txt;
SHA256 5d08c05269d19037fe4df1c5683b5823ca871ba26f35841622e585eff936c436.

Remaining checker/launcher ownership gaps, source audit
-----------------------------------------------------
The contained checker's existence does not establish ownership of every native
client that prepares or admits it. Current tools/checker.sh still constructs a
partial environment scrub without an operation-private Docker configuration;
offline verification, build and combined image-ID/input-label inspection lack
the held native-client owner used by inference/package lanes. Its command
substitutions and unconditional capture cleanup therefore do not prove retirement
under cancellation. Repair the offline checker owner without changing the
download controller, recipe/dependency pins, captured input-label algorithm or
exact identity-plus-label admission. Preserve original detector/test coverage.

Separately, tools/container.sh's checker_image inspection uses a standalone
timeout before native_pid is established. A parent HUP/INT/TERM during a slow
inspection can reach cleanup with no native anchor recorded, permitting private
configuration/receipt removal while the inspection client still runs. Existing
tests/test_launcher.py:test_repository_rejects_nonexact_observed_receipts_and_keeps_native_failure
proves malformed receipts/native status/cooperative timeout, but not cancellation
during inspection or cleanup with an unread diagnostic pipe. This requires a
launcher-owner repair and affected runtime proof. These are reviewed source
findings, not live failure demonstrations or qualification already achieved.

Inference caller-owned rejection reporting
-----------------------------------------
tools/inference_image.sh now formats its eleven explicit post-preparation
rejections into one presentation payload. EXIT completes all permitted quiet
removals before its existing held reporting owner prints that payload followed
by cleanup diagnostics. The payload owns no retirement or cleanup fact. PRINT
keeps direct inert presentation; unknown retirement retains resources and never
starts another native owner. Pending cancellation during removals still exits
without starting a potentially blocked report. The committed image record is
preserved. Shared native/input-capture/common-client diagnostics remain separate
open boundaries; this preparatory caller slice does not close those gaps.

Before:
    printf '%s\n' 'Cannot import inference stack: build the inference image first.' >&2
    exit 2
After:
    printf -v inference_diagnostic '%s\n' 'Cannot import inference stack: build the inference image first.'
    exit 2
The existing fixed held reporter receives the payload as explicit argv only
after quiet cleanup; a blocked pipe therefore cannot postpone those removals.

Seventeen old/new rejection pairs cover all eleven message formats plus six PRINT
repeats with identical ordinary stderr/status2; four success/PRINT pairs match.
Two closed-stderr probes establish an intentional status change: old rawSIGPIPE
(-13, shell141) becomes normal exit2 preserving the actual rejection after owned
cleanup. Observed configuration/capture and record bytes/inode effects agree;
no compatibility self-signal shim is warranted.

The initial combined31 methods pass in30.221s, including all30 original methods
and one new six-subcase method. Source and complete original-method AST proofs
preserve the old coverage. Final test-only rescue refinement passes the affected
six-subcase method in2.736s plus20 posture fixtures in0.048s, scoped source/AST
proofs, Ruff/format and syntax; the unchanged31 are not represented as a second
combined run. Actual unread-stderr validation and observed-ID-mismatch cases
observe completed cleanup and the held blocked publisher before one of three
signals, then129/130/143 before drainage. Record bytes/inode remain unchanged.
Four private deliberately failed-observer probes exercise cooperative and
stopped-parent rescue for both phases. Rescue retains the unreaped caller
identity, observes death, admits only the already-observed matching held anchor,
and observes its group absent before reaping; earlier unobserved failures grant
no process-scan authority. These are harness proofs, not production fault claims.
Independent final source/evidence review found no actionable issue. Exact frozen
dependencies, commands, grants, parity pairs, receipts and remaining boundaries:
.work/qualification/inference-caller-diagnostics-20261015/REPORT.txt;
SHA256 8c9a47bbdba93d20cf65357d99a498ca5dfddbcd573a23813bfcaf7aff63e3c6.

Defaults applicability remains unresolved
----------------------------------------
The last combined red run (3adde8a, packet above) reports147 syntactic Python
findings; that is not147 demonstrated fallback defects. Focused source review
again found no earned behavior repair in the production examples: solvent
categories reproduce the pinned model contract; scheme ports/origin paths are
HTTP normalization; absent Content-Encoding permits identity transfer. For the
scientific example, tools/baseline_prepare.py:76-78 preserves missing0, CDCl3=1,
DMSO-d6=2, other-present=3, including present None. Exact authority:
https://github.com/numpde/fork-of-NMRNetplusplus/blob/3ba8b9c2f3d0a390d00685d238618345c6ab24d7/uninmr/data/key_dataset.py#L23-L41
repository_checks/test_scientific_product_contract.py owns the corresponding
contract proof. Changing those categories to satisfy syntax would alter science;
rewriting equivalent branches merely to escape the matcher would prove nothing.

No generic classifier exception, test-tree exclusion, approval ledger or waiver
lands. A later applicability change must preserve strict operator-input and
proof-coverage fallbacks and exercise the actual whole-file/property collector
with operator counterexamples transplanted into its proposed accepted context.
Passing the original raw matcher fixtures alone would not prove that boundary.
The raw gate and red historical evidence remain intact pending that concrete
consumer-contract adjudication; this is unfinished work, not a check closure.

Native cancellation provenance for checker reporting
----------------------------------------------------
An ordinary client exit130 and a real handled INT both return130. The new checker
owner must distinguish them: ordinary failure needs its capped inspection cause
and path reported, whereas actual cancellation must not start a new publisher
that could block on unread stderr after consuming the sole signal. Suppressing
all reports for numeric129/130/143 was rejected: status alone proves no signal
and would silently lose ordinary failure diagnostics.

tools/inference_native.sh now resets inference_cancellation_status to0 at entry
and publishes its existing local cancelled outcome after restoring caller traps
and monitor state, immediately before return. Return status is reconciled with
that same final snapshot. The field reports this invocation's handled signal;
it supplies no retirement/cleanup authority. Local cancellation traps, child
programs, retirement facts, budgets and output modes remain unchanged. Restored
checker traps must separately record interruptions outside this native owner;
such a trap exits instead of returning through the result publication. Shared
captured-mode blocking diagnostics remain a distinct open boundary.

The first full native module executes43 methods in164.137s:42 pass, one existing
fault-injection test fails to find its unique source marker because publication
adds two lines between monitor restoration and return. All four new outcome
methods pass. The repair changes only that test's expected source literal to
include the two lines, preserving its injection point before monitor restoration,
unique-match requirement, all cases and assertions. This is explicit fixture
adaptation, not removal of the handoff proof or a claimed green full43 run.
The corrected method passes in5.585s; complete original module bytes/AST restore
after removing only the four new methods/their harness and that exact literal
expansion. Shared helper bytes restore after removing only the documented result
addition. Scoped collectors, full owner Ruff/format and syntax pass. An initial
narrow rerun stopped at format checking before any test; its exit1/log are kept,
followed by the corrected formatter copy and terminal0 proof. No unchanged full43
or75-consumer rerun is represented as green.
Four new methods cover22 subcases: captured/stdio ordinary129/130/143 versus
actual handled signals, same-caller next-success reset, early known/unknown
failure provenance and deterministic late-window injection. The latter proves
the return contract in an instrumented test copy, not an observed scheduler race.
Independent final source/evidence review found no actionable issue. Exact frozen
source, commands, grants, failed attempts, endpoints and limits:
.work/qualification/native-cancellation-outcome-20261015/REPORT.txt;
SHA256 91c4f0ca3826e7cafb78ace891c57d12b62a3fccacba200c01b5c694b6678456.

Package caller-owned mismatch reporting
---------------------------------------
The package launcher's sole explicit post-preparation rejection now uses the
same presentation contract as the inference caller above: format the unchanged
observed-ID-mismatch message into inference_diagnostic, exit2, complete permitted
quiet configuration removal, then pass pending text first to the existing held
reporter. Cleanup diagnostics follow it; no later effects use the reporter's
replacement fact. Unknown retirement retains direct reporting/no next owner.
PRINT, engine/controller argv, strict identity admission and publication remain
unchanged. This supplies a real caller improvement before shared helper migration,
without adding an unused wheelhouse payload (wheelhouse has no such rejection).

All15 focused package methods pass in91.455s:14 complete original bodies/helpers
are conserved and one new method covers actual HUP/INT/TERM with unread full
stderr. Each observes the held blocked diagnostic writer after build/inspection
retirement and quiet configuration removal, then129/130/143 before drainage.
No controller/new image-ID publication occurs; predecessor bytes/inode survive.
The existing bounded rescue and its two-caller isolation test remain unchanged.
Twenty policy fixtures/scoped collectors pass in0.043s; source/whole-original-AST,
ordinary bytes, removal-before/after9 truth/primary2, PRINT/apply, Ruff/format and
syntax pass. Closed stderr deliberately changes old rawSIGPIPE(-13, shell141)
to normal primary rejection2 after cleanup, matching the accepted inference
contract; no closed-pipe status parity or compatibility shim is claimed.

Independent final source/proof review found no actionable issue. The private
projection is94f0580 plus only package/test overlays and the earlier native helper,
excluding concurrent checker/native/inference changes. This is focused evidence,
not qualification of the current combined checkout. Shared helper pre-return and
common preparation diagnostics remain open. Exact commands, versions,180s existing
package-only qualification ceiling, endpoints and retained limitations:
.work/qualification/packages-caller-diagnostics-20261015/REPORT.txt;
SHA256 e6136a03ad3d1d3e130c082e9ba9d57021a1d791253358b5d5a5abc63a2f8900.

Next shared-boundary inventory
------------------------------
Checker ownership adds a fifth inference_native consumer to the earlier four:
baseline.sh, inference_image.sh, packages.sh, wheelhouse.sh and checker.sh. The
pending atomic returned-diagnostic API must update all five, including checker’s
current separate pending_diagnostic field, and direct test harnesses. Wheelhouse
needs its real shared-result consumer at that switch; it has no own post-prepare
rejection justifying preparatory unused state. Common docker_client preparation
now has six consumers, those five plus container.sh with its separate native
owner. Re-inventory before each shared contract change, including any intervening
acquisition-controller migration. Earlier private design evidence against0eb869b
describes its then-current four/five consumer cohorts and remains historical;
its count is not proof of the current caller set. Source authority is the actual
source statements in tools/*.sh, including the indented wheelhouse branch.

Baseline caller-owned diagnostic boundary
-----------------------------------------
The baseline caller now formats its four post-preparation admission rejections
into inference_diagnostic. After quiet permitted configuration removal, EXIT
appends the existing configuration/admission labels in their original order and
publishes through one held untimed reporter. Actual caller/native cancellation
is consumed before another helper can reset that outcome; it starts no reporter.
Ordinary native130 remains an ordinary failure and still reports cleanup causes.
False retirement retains resources/direct reporting without another native call.
Scientific argv, receipt states, handoff marker, PRINT and budgets are preserved.

Exactly two old admission assertions now require empty stderr after actual
cancellation: interrupted removal and post-removal/pre-scientific handoff. Their
status, physical before/after effects, no-retained-claim and no-run assertions
remain; ordinary failed/partial rm23 still requires its diagnostic. This enforces
the no-new-publisher policy rather than removing the cancellation proof.
All23 focused methods pass in116.324s (21 original plus two earned methods), with
the original actual30s metadata deadline intact. Twenty policy fixtures/scoped
collectors pass in0.048s; source/AST conservation, nine old/new byte/effect pairs,
two complete PRINT pairs, Ruff/format and syntax pass. New full-stderr tests cover
mismatch reporting and scientific stdio cancellation with real-delete-then23,
distinguishing ordinary130. Two deliberately failed observers prove cooperative
and stopped-parent rescue in1.328s/3.027s, with admitted anchor groups absent.
Closed stderr deliberately changes old rawSIGPIPE(-13, shell141) to primary2
after cleanup, with the same record/receipt/configuration/scientific effects.

Frozen84a1a36 plus only baseline/test overlays excludes concurrent checker and
package changes; combined checkout qualification remains pending. The shared
CAPTURED helper can still block before returning; baseline metadata uses discard,
so this does not establish full-stderr metadata cancellation. Common preparation
and raw setup/stat/rm errors remain separately open. Exact commands, dependencies,
retained invocation mistakes, hashes/modes and proof scopes:
.work/qualification/baseline-caller-diagnostics-20261015/REPORT.txt;
SHA256 3ece9de36f5ee922d89d567693fd20fe927d9c5e6c774ac4079edeb2e68020e4.
Independent final source, evidence and note review found no actionable issue.

Git provenance environment finding, pending repair
--------------------------------------------------
At c0252bb, baseline.sh:165/:173 reads repository HEAD and indexed gitlink with
plain Git. -C chooses a directory but does not revoke inherited GIT_DIR,
GIT_INDEX_FILE or Git configuration authority. A contained five-case probe using
two disposable repositories confirms that baseline PRINT can select a foreign
repository revision while preserving the expected upstream gitlink. Thus image
upstream-label admission cannot establish the recorded repository revision.
This is actual PRINT/dataflow evidence, not an executed scientific-receipt claim.

Clean, foreign GIT_DIR, foreign GIT_INDEX_FILE and malformed GIT_CONFIG_COUNT
cases also compare the existing sanitized inference_git primitive: it preserves
the selected repository HEAD/index. Actual inference build capture already uses
that primitive; inference_image.sh's four plain-Git PRINT reads remain affected.
The repair should share the existing runner and validated executable lookup,
preserving HEAD-versus-index selection semantics rather than duplicating policy
or importing the whole inference capture operation. No extraction API has landed
yet. Raw host Git stderr/liveness remains a separate owner, not closed by this
provenance fix. Exact frozen c0252bb source, commands, no-network grants, five
probe cases and unchanged source/hash/mode endpoints:
.work/qualification/baseline-git-provenance-20261015/REPORT.txt;
SHA256 1d3066781990af2d547e7a31f823f7500e70eb0e3a04c5515bab241b071f912b.

Offline checker client ownership
--------------------------------
Before: checker.sh used a partial Docker environment scrub and bare offline
verification/build/inspection clients; build and inspection ran in substitutions.
After: the existing common private client serves all offline phases through the
held native owner. Verification/build remain untimed; image admission has30s and
private4KiB stdout/stderr receipts. The exact137-byte image-ID/input-label result
must match before publication. The seven captured source inputs, label algorithm,
recipe/dependency pins, worker grants/argv and download controller stay unchanged.
PRINT stays inert; its engine prefix gains the common environment scrub and
private-config placeholder, so complete printed-command bytes change deliberately.
Known retirement gates quiet capture/configuration/record cleanup;
unknown retirement retains all resources and starts no next owner. Inspection
cause receipts live separately from the removed build capture and remain on a
failed workflow, including cancelled final reporting. Cleanup reports attempted
paths rather than claiming failed rm necessarily left a resource intact.

The caller consumes actual native/outside/removal cancellation before starting
any new publisher. Ordinary native129/130/143 remains a reportable failure with
retained cause; numeric status is not evidence of a handled signal. Final success
and cleanup messages use held reporters, and the committed record survives report
cancellation. This qualifies metadata cancellation within this checker owner;
container.sh admission and shared raw/captured diagnostics remain
separate boundaries.

Qualification deliberately preserves failed epochs. The initial40 methods take
123.182s with18 failure/6 error reports (subcases, not24 distinct failed methods).
All22 dependency methods pass. A contained diagnostic finds the finite engine's
cumulative calls.jsonl exactly4096 bytes and actual EFBIG on its fourth event:
the intentional inspector file limit also governs fixture writes. The fixture
now publishes bounded ordered event files atomically, with identical payloads,
without relaxing limits or ignoring malformed JSON. Production source is unchanged.
The next18-method epoch takes154.559s with9 failures/6 errors, while all seven
original cases and three unaffected new cases pass. A phase diagnostic observes
inspection readiness after the five-second whole-build observation window; its
diagnostic-only drainage recovers no queued stderr and is not unread-pipe proof.
Per-case interceptors now install only the bash/rm/mv hooks actually needed,
preserving required observations/faults and all product/post-signal deadlines.
The affected eight methods then pass: the three-signal unread-stderr inspection
method in7.220s and the remaining seven methods in45.112s. This is split focused
qualification, not a claimed green full40 or full18 invocation.

The private constant probe also over-applied a production-only property to unit
tests. Its unchanged ROOT=Path.cwd() finding remains visible with exact old/new
binding proof and no new finding; no public marker, waiver or inventory change
was added. Original detector fixtures and actual production responsibility stay
intact. Original seven cases remain, with only two cleanup-message predicates
changed to truthful attempted-path messages; fixture control/event adapters are
documented separately from product changes. Shared raw/captured/preparation
diagnostics and actual engine/image-content qualification remain pending.
Exact source/fixture bindings, frozen84a dependencies, commands/grants, failed
epochs, diagnostic-only probes, split final proof and hash/mode endpoints:
.work/qualification/checker-client-ownership-20261015/REPORT.txt;
SHA256 e7b846d95476f013468a9a99e2b3b6339c10a42f686ad6eb6e3fce7e77261a75.
Independent final source and evidence review found no actionable issue; its
requested PRINT-prefix wording and exact packet reference are recorded above.

Selected-checkout Git provenance repair
---------------------------------------
The earlier c0252bb finding is repaired by tools/git_metadata.sh: repository_git
shares the existing inference-input sanitizer and executable-file validation.
Baseline's two metadata reads and inference PRINT's four reads now use it;
the build capture uses the same primitive. HEAD-versus-index authority, blob
materialization, inventories, image inputs and scientific argv are preserved.
The helper defines its function without executing Git on source. Each query
resolves its executable; missing lookup retains status1, invalid resolution
retains status2 with an intentionally neutral repository-metadata diagnostic.
check_git_inputs.sh keeps its different topology/reject-ambient/grant duties.

The contained frozen c0252bb projection has ten owned overlays; concurrent
checker work is excluded explicitly. All54 original affected unit methods pass
in120.718s. All51 selected original repository methods pass in43.156s at the
earlier nine-file epoch; the final delta is two unit-only PATH repairs. The first
54-method run failed57 subcases because those two fixtures discarded the new
finite Git executable's PATH, selecting real Git against synthetic repositories.
The repairs prepend Docker interceptors to the inherited fixture PATH; no
production behavior, fault, status or assertion is weakened. Failed logs remain.

Four new actual-Git/strict-fixture methods pass in0.332s, including foreign HEAD
with a matching upstream gitlink. Four ordinary old/new PRINT pairs match full
stdout bytes, status, stderr and image-record bytes/inode. Twenty unchanged
policy methods pass in0.088s; Ruff, format, syntax, original-case conservation
and all ten hash/mode endpoints pass. This is focused evidence, not a combined
checkout or scientific rerun. Raw Git/setup stderr and liveness remain open.
Exact source references, commands, grants, failed epochs and evidence bindings:
.work/qualification/git-metadata-owner-20261015/REPORT.txt;
SHA256 92ecec25f4255b9dd904e4d66489fecf9a225d0229f44d1f096a2641bb07fe37.
The adjacent DETAILS.txt retains the full receipts and bindings;
SHA256 4d6706e54fa1aea1fd6c86ac1da8072c9d399e6afb8f9a1f633b776b01207ff1.
Independent final source, packet and note review found no actionable issue.

Fixture registry ownership, a concrete defaults repair
-----------------------------------------------------
Owners: repository_checks/fixtures/containers/fixture.py and docker.py;
regressions: repository_checks/test_engine_metadata_fixture.py.
Before: the finite Docker fixture interpreted a missing containers.json as an
empty inventory during create/removal. A lost registry could discard an earlier
container identity; create also wrote CID/role receipts before parsing it.
After: LauncherFixture exclusively initializes the empty registry once, alongside
its existing exclusive call-log initialization. Later create/start/removal read
that owned JSON directly; create reads it before publishing CID/role receipts.
Missing or unparseable state preserves its real cause. Existing native statuses,
unknown-identity rejection and intentional malformed-CID/NUL faults remain.
No new schema, registry abstraction or defaults-check exemption is introduced.

The frozen a1decec projection plus these three files excludes the concurrent
native-diagnostics migration. Focused qualification passes64 methods in24.238s,
including all seven original metadata cases and five new lifecycle/state-loss
cases, plus the affected original operator/build/proxy-resolver modules. Two
original raw-default detector fixtures pass in0.001s. The actual property with
isolated discovery accepts the initializer and rejects both transplanted operator
and proof-state fallbacks; this does not claim the whole repository gate passes.
Style, original-case conservation and source hash/mode endpoints pass.

Restoring only the old Docker double makes the two state-loss methods fail three
subcases in0.791s: missing-state create succeeds, malformed-state create publishes
a CID first, and missing-state removal hides its cause. The malformed-removal
subcase already fails honestly in the old double. These are retained intentional
negative results, not a failed final qualification. Scientific/API defaults and
the broader raw defaults gate remain unresolved.
Exact source bindings, contained commands/grants, normal/negative results and
unchanged hash/mode endpoints:
.work/qualification/fixture-registry-lifetime-20261015/REPORT.txt;
SHA256 3b84fb17dc77a09db99100ed6a0e3af7c89e341be4ff6bd6e3ae4e5cffd4e299.

Returned native diagnostics, one atomic consumer contract
---------------------------------------------------------
Before: eight controlled inference_native.sh messages wrote public stderr before
returning, so a full pipe could postpone caller cleanup. After: the helper resets
and returns inference_diagnostic separately from status, result and retirement.
Its five consumers (baseline, inference_image, packages, wheelhouse, checker)
finish permitted quiet cleanup before one held reporter. They consume actual
cancellation before another invocation can reset it; ordinary child exits
129/130/143 remain reportable. Checker appends its own inspection explanation
after the helper's cause. Unknown retirement retains resources and starts no next
owner. A terminal reporter failure exits without retry or direct fallback;
bootstrap failure can prevent diagnostic delivery. Cancellation may suppress
returned text. Raw utility/setup/capture/common-preparation stderr remains open.

The six production sources and five test adapters form one coherent API change.
Direct harnesses preserve bare-versus-conditional calls, errexit and native status
before presenting returned text. Source conservation verifies only the helper's
reset/eight writes/contract comment changed; process control, caps, evidence and
retirement semantics remain. The frozen a1decec plus eleven overlays excludes
the independent registry repair; all133 other files and every mode are preserved.

Focused runtime evidence covers138 methods across split44/40/18/36 groups, plus
20 unchanged posture methods in0.121s. Native's first group reaches the private
180s ceiling after40 passes; only the four unfinished methods continue and pass
in6.560s. Image/baseline40 pass in135.077s; caller36 pass in153.401s. Checker has
17 passes and one observation timeout, then the unchanged failed case passes
alone in4.988s. No wholly green initial invocation is claimed. Exact-mount engine
inventory verifies the timed-out worker is gone, separately from its CLI timeout.

Seven native and eight caller old/new pairs preserve ordinary bytes/status,
private binary evidence and records, normalizing only fresh owned paths. Real
full-stderr tests observe native retirement and config/capture cleanup before a
single signal and wait before draining. Actual native cancellation is tested
separately. Terminal bootstrap faults observe the exact operation sequence ending
in cleanup reporting, preserve primary7/evidence/records, and start no retry.
Ruff, format, syntax, original cases and final hash/mode endpoints pass. Failed
epochs remain retained. This is focused qualification, not aggregate closure.
Exact source references, commands/grants, split results and private fault proofs:
.work/qualification/native-returned-diagnostics-20261015/REPORT.txt;
SHA256 ff63216e4d3a8f85c89f533a47b0dac1d3c743c97a308c80d73db189e269276f.

Real contained proxy transport qualification
---------------------------------------------
At frozen2f35079, the unchanged tools/bound_http_proxy.py CLI runs with the
production proxy grants from tools/docker.sh:154-164: host network, nonroot,
read-only root, cap-drop ALL without NET_RAW, NNP,1CPU,128MiB,64PIDs and16MiB
noexec scratch. One container also hosts cooperative local nonce endpoints and
clients; the extra read-only proof script and owned evidence directory are
recorded explicitly. This is transport-module evidence, not controller lifecycle
or hostile-code egress isolation. Device/route/resolver details remain private.

Seven real outcomes pass: HTTP and CONNECT preserve upload/response bytes after
client write-half-close; both destinations fail with zero accepts on a different
explicit device; a nonexistent device publishes no readiness; configured bound
DNS resolves example.com on the explicit outbound device and fails on loopback.
The two DNS outcomes do not imply only two packets. Production deadlines remain.
Actual image/grants/mounts/argv are inspected, and all five CLI children retire.

Transport exits0, container removal0 and the subsequent exact-ID inspection1.
The original runner exits1 solely because its absence-text matcher expects a
different capitalization. Its source and receipts remain unchanged. Separate
contained network-none reconciliation exits0 and validates the exact owned-ID
absence response and all recorded outcomes; no traffic/lifecycle is repeated.
Source/live-source hashes AND modes remain equal; resolver HASH endpoints alone
are compared. No external HTTP, download, install, pull or host configuration
change occurs. Independent script and final evidence review finds no issue.
Precise source references, commands/grants, original results and reconciliation:
.work/qualification/proxy-live-20261015/REPORT.txt;
SHA256 4d3a79e76800a44480d5e1f24d300607ca8dc2c29e30a4dee479416102047073.
Endpoint clarification: adjacent ENDPOINT-PRECISION.txt;
SHA256 d13b68ef6a6eeff9dbfaf0e2f5cf96928916b0ef8d5f3ce96037443435627e6c.

Shared committed-input materializer
------------------------------------
tools/git_inputs.sh now owns the existing committed-blob copier and its failure
formatter. A required operation label preserves inference's exact error bytes
while allowing the coming package capture to identify its own consumer. Old
definitions disappear without aliases or duplicate copying policy. Inference
still owns its closure/inventories/wheelhouse flow. Two fixtures gain only the
new source dependency; no case or assertion changes. This extraction does not
implement package capture or resolve raw Git/stat/copy/setup stderr liveness.

At frozen b5029dc plus four overlays, first runs pass inference-image17 in4.494s,
affected original repository consumers61 in44.230s, and unchanged posture20
in0.061s. Thirteen old/new materializer pairs preserve exact bytes/status,
binary blobs, executable modes on noexec storage, inventories and partial effects
across valid and invalid inputs, links/missing/FIFO leaves, mutations and raw
Git failure37. A second operation label earns consumer-specific diagnostics.
Exact original copier/capture reconstruction,141 other base files, existing
modes, scoped Ruff/format and syntax pass. No new authored test or policy waiver
is added. Source and fixture bits were independently reviewed before execution.
Precise source bindings, contained commands/grants and first-run results:
.work/qualification/git-input-materializer-20261015/REPORT.txt;
SHA256 07945beeecec4df3d2ff33a72ff91b373e2c9c2c3b60324a30ecf9924cf41aa3.

Package execution capture and editable dependency intent
---------------------------------------------------------
Package staging now uses tools/package_inputs.sh to capture four committed
execution leaves: the lock resolver Dockerfile, its Dockerignore, package_lock.py
and container_guard.py. Apply captures only the two execution modules it uses.
The shared tools/git_inputs.sh materializer checks committed identities, live
bytes and modes. Dependency intent remains editable: inference.in, build.in and
unicore-source.json are copied from the current worktree with physical-path,
byte and mode admission. A snapshot belongs to this invocation; admission does
not claim a transaction with editors across all three files.

Before: the build context and /input binds used live repository paths; an edit
after admission could change the bytes consumed by the worker.
After: the build uses .inputs/context and /input uses .inputs/requirements.
The stage retains its private capture after success or failure. Because /output
is the writable stage directory, a read-only child bind at /output/.inputs also
closes that writable alias. Apply takes a fresh snapshot, compares its intent
hashes with the reviewed report using the unchanged package_lock.py authority,
and removes its private capture only after confirmed local retirement.

Rationale: intentional dependency updates must admit edited intent while
execution remains reviewed and committed. The existing README package workflow
and requirements/README.md describe that distinction. Upstream precedents for
editable intent, rather than requiring all declarations to match HEAD:
https://github.com/numpde/secs-repro/blob/34f5915c1534278bbf61b4c6592afa44cf94ab08/make/packages.mk#L44-L45
https://github.com/numpde/nmrpeak-repro/blob/f8055ab1065795fd46f8c1539e894cf9773f5495/scripts/runner-lock.sh#L100-L107
The in-place package_lock.py stage/apply implementations remain the authority
for input hashes and paired publication. Raw capture utility stderr and the
outer acquisition-controller signal handoff remain separate unfinished work.

Qualification at frozen6be82ae plus the eight owning overlays:
original repository consumers89 pass in123.624s, new capture contracts5 pass
in24.123s, and posture20 pass in0.063s. The original unit run has27 passes and
one failure: its apply assertion still expects the former live tool mount.
Only that fixture expectation changes to the explicit captured context; the
single failed method then passes in0.011s. Original cases and mount assertions
remain intact. The failed first epoch is retained rather than called green.

A real contained mount proof checks identical input/output-alias inodes:
write, truncate, unlink and rename within the child fail EROFS; renaming the
mounted child fails EBUSY. An ordinary /output sibling remains writable through
create/write/rename/unlink, and captured bytes remain unchanged. Ten private
fault/cancellation cases preserve primary0/37 against removal23 before or after
the actual deletion, and verify HUP/INT/TERM during native work and capture
removal with unread full stderr. Confirmed client retirement precedes capture
and config cleanup; reporting follows those attempts. Cancellation starts no new
reporter, and uncertain retirement retains the capture. Scoped Ruff, format,
shell syntax and source hash/mode endpoints
pass. These are focused results, not a new aggregate or scientific qualification.
Source bytes match live/executed endpoints; modes are recorded and stable
separately, including fixture git.sh host0755 versus projected0775.
Precise source bindings, contained grants/commands, original failures and split
results: .work/qualification/package-input-capture-20261015/implementation/REPORT-v2.txt;
SHA256 d65edb7633f2f693daa962b1b3773c4d1a4c01f334aa672b4de63d688c96beb4.

Untimed native cancellation: TERM opportunity before escalation
---------------------------------------------------------------
Before: actual cancellation immediately KILLed an admitted native group.
After: an actual cancellation already observed at retirement entry offers that
same live held group TERM and one interruptible second before the existing
KILL/join, only when its budget is exactly untimed. Another signal updates the
existing cancellation cause without renewing grace. Late cancellation still
controls the final cause but cannot retroactively promise a TERM opportunity.
TERM delivery or elapsed grace never establishes retirement; KILL/join does.

This deliberate shared policy allows native clients to handle cancellation,
including emitting handler output or Docker forwarding the signal. The concrete
next consumer is acquisition attachment: tools/docker.sh currently TERM-signals
and waits for that client, and its existing corrupt-CID retirement test requires
the actual TERM handler and joined PID. Authority remains the original held
anchor, with no new PID receipt or API. Local client retirement continues to say
nothing about engine-side container removal. tools/container.sh's separate
signal-specific two-second policy remains unchanged.

Numeric calls remain unchanged. Sending TERM into their timed branch would
invoke its expiry handler and could falsely publish deadline evidence. The
one-second precedent is the existing bounded numeric expiry escalation in
tools/inference_native.sh, not a new deadline for scientific work.

At frozen3e0f87d plus the two owning overlays, all47 native methods pass in
196.342s:44 original methods and3 new methods with4 earned cases. They cover
responsive TERM plus resistant descendants in captured and stdio modes, a
numeric-cancellation negative, and a second signal during the actual grace.
Original signal, full-pipe, live-byte, deadline, uncertain-retirement and
publication assertions and per-method deadlines remain unchanged. Numeric
source conservation supports unchanged expiry semantics; the new negative does
not directly inspect a retained deadline receipt. Ruff, format, shell syntax,
posture checks and source/mode endpoints pass. The first attempt stopped at
Ruff RET503 before tests; its receipts are retained. No runtime suite repeats.
Precise frozen source/test bindings, contained grants/commands and results:
.work/qualification/untimed-cancellation-grace-20261015/REPORT.txt;
SHA256 ada0e9a1aa213d004152a5f683b4626fabe37be8526783b7ef9295247b4fcf40.

Defaults: explicit local contract applicability pilot
------------------------------------------------------
The earlier blanket no-waiver position above was provisional. Purpose-based
adjudication now admits one documented protocol contract through an explicit
local annotation. The original raw candidates, matcher fixtures, discovery and
whole-repository inventory remain intact. This is a reviewed exception, not an
inferred safe context, file exclusion or central approval ledger.

Before:
    path = parsed.path or "/"
    -> raw finding without a consumer-contract decision.
After:
    # silent-defaults: allow-contract -- Origin-form requires / for an empty URI path; proof=tests/test_bound_http_proxy.py::BoundProxyTests.test_empty_absolute_path_becomes_origin_slash
    path = parsed.path or "/"
    -> raw finding retained; operator property accepts this documented contract.

RFC 9112 section3.2.1 requires slash when producing origin-form from an empty
URI path, including a query-only URI. This justifies the existing normalization;
it does not justify a configurable operator fallback or claim full HTTP
conformance (server-wide OPTIONS is separately covered by section3.2.4).
https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2.1
https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2.4
The precise RFC reference is also beside the production annotation and its new
test, which checks exact prepared GET headers for empty and query-only paths.

The property accepts only a standalone actual comment immediately above one
single-line statement with one generic mapping/or/ternary candidate. A reason
and existing local class/test-method reference are required. Static AST lookup
rejects missing, renamed, duplicated or linked proof targets without importing
them. Meaning and actual test execution remain review obligations; symbol
presence is not semantic proof. Environment, CLI, function-default and exception
rules cannot use this annotation. Stale, blank, string, inline, multi-statement
and multi-candidate placements fail. Unannotated neighbouring proof-state
fallbacks remain findings. The existing allow-empty-get convention is the
precedent, not permission to inherit its loose source-substring matching:
repository_checks/quality/silent_defaults/test_python_empty_defaults.py:181-190
and545-575, _has_empty_get_waiver and its annotation fixtures; exact port source:
https://github.com/numpde/vote-mcp/blob/6f595850d199e0d97098c1a7e67ddff774171a25/repo-checks/silent-defaults/test_python_empty_defaults.py

At frozen83e8b48 plus four owning overlays, focused24 pass in0.059s: original
proxy13, one new byte-contract test, seven new applicability tests and three
original raw/inventory tests. Posture20 and conservation pass in0.077s. All
original raw matchers/fixtures, production proxy AST and original unit methods
remain unchanged. Across80 frozen Python files the original and current raw
collectors agree exactly:180 raw findings,179 applicable findings, with only the
documented HTTP node accepted. The actual whole-repository property remains red
as expected. This pilot does not close defaults or overall repo qualification.
Precise source/reference bindings, contained grants/commands, retained setup
failures and complete residual findings:
.work/qualification/default-contract-pilot-20261015/REPORT-v2.txt;
SHA256 11b537f11853f7840d6221ca199dbd3282a38a18f12b53d96eafa34c6bad9c72.

Package input capture owns its utility children
------------------------------------------------
Before: package_capture_inputs ran in the caller; Git/copy/stat stderr could
block on a full public pipe before EXIT cleaned up owned client/input state.
After: the unchanged function runs bare under bash -eu in the existing held,
capped native owner, with explicit root/action/destination. Stage .inputs mkdir
also runs there. A confirmed join permits existing quiet cleanup and then one
terminal reporter; unknown retirement retains resources without another owner.
No copier, receipt, callback or native API is introduced. PRINT stays inert.

Detailed capture errors deliberately move to private capped evidence; the public
controlled summary names operation/status/evidence. Apply's parent still learns
its owned path from mktemp. Allocation failure cannot retain raw cause before
that path exists, so it reports the attempted parent/status after cleanup.
Qualification caught an actual Bash redirection-order error in this bootstrap:

Before:
    if apply_capture=$(umask 077; mktemp ... ) 2>/dev/null; then ...
After:
    if apply_capture=$(umask 077; mktemp ... 2>/dev/null); then ...

The first form redirects too late to cover substitution stderr. Only that
redirection moves in the final repair; the failed ordinary-allocation pair is
retained and its affected pair passes afresh. No public raw replay is added.

At frozen83e8b48 plus two owning overlays, the initial combined run reaches its
180-second outer ceiling after17 passes: all15 client originals and2 capture
originals. Its owned worker is absent afterward. The unfinished new six-case
capture-cancellation method passes alone in14.206s; remaining3 capture originals
and2 existing PRINT/grant units pass5 in28.960s. Across those scopes all20 package
originals, one earned method and2 affected units pass. Posture20 passes in0.064s;
Ruff/format/syntax and145 other projected files/modes are conserved. Two named
rejection methods adapt their public-cause assertions to private evidence.

Six old/new pairs preserve PRINT2 and small/over-cap binary utility37 outcomes.
After the allocation fix, that pair and two unfinished finite37/full-public-pipe
probes pass. Actual terminal pipe_write occurs after quiet cleanup; drainage
then yields37 and the exact8MiB private cap. Six signal cases observe actual
utility/anchor ownership, retirement and config cleanup before draining, stage
retention/apply removal and unchanged publication record. Earlier green scopes
bind source8ca87823; only the affected final repair scopes bind cd396fe0. This is
split qualification, not a full rerun at the final source or aggregate closure.
Common preparation, inference capture and native bootstrap remain open limits.
Exact source epochs, contained commands/grants and retained failed receipts:
.work/qualification/package-capture-held-phase-20261015/REPORT.txt;
SHA256 593ff253e2c576aa620e14a6d3bad7dc5f2f32d1566d84458001f408ce853a64.

Native fixture result belongs to its constructor
-------------------------------------------------
Before:
    return int(os.environ.get("NATIVE_STATUS", "0"))
After:
    # setUp adds NATIVE_STATUS="0" to the probe's explicit environment.
    return int(os.environ["NATIVE_STATUS"])

The constructor now owns normal success and overrides ambient status. Previously
the field could be inherited or absent, so broken fixture wiring could silently
manufacture success. A missing field now fails in the actual finite client.
This is a concrete proof-state repair, not an annotation or a raw-count target.
Optional fault/behaviour selectors are separate contracts; they are not changed.

At frozenbe5af61 plus only tests/test_inference_native.py, first targeted5 pass
in39.586s: one new ambient37-to-owned0/missing-field boundary method and four
original normal/nonzero/stdio/signal-retirement representatives. Posture20 pass
in0.101s; Ruff/format pass without changes. Static conservation preserves all47
original method bodies and discovery identities, with one new48th method; full47
was not rerun. The file's raw9 become8 solely through the required lookup. This
does not establish a current repository-wide finding count or qualification.
Live/projected bytes match; separate host0755/projected0775 modes are stable.
Exact source bindings, contained commands/grants and results:
.work/qualification/native-fixture-status-20261015/REPORT-v2.txt;
SHA256 4bc448ac6533106b8fa19e80df66cd64d4f9b3451ded7b3dfb60a45628c49ac3.

Inference input capture owns its utility children
--------------------------------------------------
Before: inference_capture_inputs ran in the parent; Git/copy/stat stderr could
block on a full public pipe before owned client/build input cleanup.
After: the unchanged capture function runs bare under bash -eu in the existing
held, untimed, capped native owner. Confirmed retirement permits quiet cleanup
before one terminal report; unknown retirement retains inputs and stops before
another owner or parent declaration decoding. PRINT remains inert.

The parent takes its revision from the existing captured declaration, which
capture already checked against the committed gitlink. It does not reread live
Git or introduce another receipt. The parent checks regular/nonlink type, exact
revision syntax and original declaration bytes before passing the build label:

Before:
    inference_capture_inputs
After:
    inference_native 'input capture' untimed discard bash -eu -c '...'
    # Decode the already-validated captured nmrnet-source.paths declaration.

Missing, linked, unterminated, NUL-modified and actually unreadable declarations
fail before engine invocation or image-record replacement. A late live-Git
mutation leaves the build label bound to the captured revision. Parent work-path
allocation remains outside capture because the parent needs its owned path;
its utilities are quiet until controlled reporting after cleanup. Generic
filesystem hangs and common client preparation remain separate open limits.

At frozen cb318a9 plus three owning overlays, image17 pass in4.638s; all12 input
originals pass in the initial13-method run, whose added declaration method fails.
The new observer first accesses an unset native-local variable during caller
cleanup; its presence guard fixes that. A failed-only rerun exposes an added
assertion about a declaration absent from the fixture's COPY-only manifest.
Removing that non-contract assertion retains the actual captured build-label
and poisoned-revision checks. Final new method passes six cases in2.298s. Both
failed epochs remain recorded; only the added method changes between them.
Client16 pass in51.993s: all15 originals plus capture37/full-pipe reporting under
three signals. Across these scopes44 originals and2 earned methods pass; this
is split qualification, not a current combined repository-wide green claim.

Four private cases pass: actual active capture under HUP/INT/TERM retires before
public drainage with exact8MiB private evidence, config/capture gone, no engine
and unchanged record; denied retirement retains state and prevents decoding or
another owner. Exact rescue requires positive observed anchor admission. Eight
old/new pairs preserve PRINT2, normal build/import2, binary utility37 and three
bootstrap status/effect contracts; accepted diagnostic changes are explicit.
Posture20 pass in0.080s; Ruff/format/syntax,145 other projected files/modes and
original ASTs outside named presentation/phase adapters are conserved. Source
and existing publication body remain unchanged outside the described capture
boundary and one redundant later mkdir. Precise source epochs, contained
commands/grants, results and limitations:
.work/qualification/inference-capture-held-phase-20261015/REPORT.txt;
SHA256 e90adfaeaca348d76d9f8ddf12af458ca470cc524862a252437c1c36b1506e89.

Native control I/O returns before public reporting
----------------------------------------------------
Before: the shared native owner could block while printing a setup, receipt,
validator or removal utility error, before returning retirement facts to callers.
After: those utility stderr streams are quiet at their actual origin and the
existing returned diagnostic describes failure. Client stdio remains inherited;
captured client output remains capped. Status, retirement, cancellation and
cleanup authority are unchanged. This does not bound generic filesystem hangs.

Before:
    exec {capture_guard}<> "$scratch/output"
After:
    { exec {capture_guard}<> "$scratch/output"; } 2>/dev/null

The same-shell compound command scopes stderr without permanently replacing the
caller's descriptor. Redirection also precedes FIFO/file opens. Generated control
writers are quiet inside their process substitutions; redirecting their consumer
alone does not cover writer expansion. These changes do not hide client streams.

Eight earned full-public-pipe cases exercise finite setup, ready/release/status,
image-validator and known-retired removal failures. Returned status, cancellation,
retirement fact, controlled text and fact-permitted harness cleanup are checked
before draining. That sentinel proves the primitive returns control to a caller;
actual caller cleanup is established by the separate caller qualifications. A
captured call followed by stdio and caller binary stderr verifies descriptor
restoration across both modes.

At frozen cb318a9 plus only helper/test candidates, earned2 pass in15.381s. The
original48 run once in281.863s:47 pass, while terminal-printf fault injection
fails its exact source-match count before exercising that subcase. The brace
scope requires adding its opening brace to both matcher and false replacement.
The failed method alone then passes both phases in2.934s. The failed epoch stays;
no green original method repeats. This establishes all48 originals and2 earned
methods across documented epochs, not a green full-module invocation.

Restricted AST/discovery preserves all original methods except six literal
values at five named fault-injection sites;139 other projected files and all
projected modes remain exact. Original posture20 pass in0.130s at the earlier
test epoch; the final AST/style proof does not repeat them. Ruff/format/Bash
syntax and141-file byte/mode endpoint comparisons pass. Private setup failures
and earlier source-review corrections are retained. Qualified helper cdc80c9c
and final test db37a129, exact commands/grants/epochs/results and limitations:
.work/qualification/native-control-io-20261015/REPORT.txt;
SHA256 f0689f2ff8907d95070ba34ca45355fb87f705d62f4903dfea4a48ee80358b45.

Stdio control cleanup returns an actionable attempted path
-----------------------------------------------------------
Before: confirmed stdio retirement followed by failed control-directory removal
could change success to the removal status without returning its attempted path.
After: the same existing diagnostic field returns the attempted path and removal
status. It does not claim the directory remains: removal can complete and still
report failure. Native nonzero and actual cancellation keep precedence, public
streams remain inherited, and the helper adds no public write or fallback.

Before:
    if [[ $status == 0 ]]; then status=$removal_status; fi
After:
    if [[ $status == 0 ]]; then status=$removal_status; fi
    printf -v inference_diagnostic '... attempted path %q (status %s).\n' ...

This follows the operator-retrievable diagnostics requirement: quiet cleanup must
preserve useful evidence and truthful retention/removal outcomes. The caller
still owns presentation; a failed terminal publisher is not retried. Reader-facing temporary
path discovery and lifetime guidance remain pending the controller closure.

At frozen4490c0f plus only native helper/test overlays, focused3 methods pass in
38.395s: four new before/delete-then-fail cases with native0/7, six original
blocked-output signal cases and nine original receipt/startup cases. The two
original harness consumers deliberately adapt to the newly nonempty result:
the full-pipe case records it privately before checking retirement; after-delete
cases expect the exact attempted-path/removal23 diagnostic. All original signal,
status, fact, pipe-write, deletion, descendant and no-capped-evidence assertions
remain. This is affected qualification, not a full51-method or repository run.

Posture20 pass in0.104s; Ruff/format/Bash syntax and restricted AST/discovery pass.
The original50 methods differ only at those two named consumers, plus one new
51st method;139 other projected files and all141 modes/byte endpoints are exact.
No failed proof attempts or repeated green methods. Qualified helper a7e72e66
and final test c8ad7f22, full hashes/modes, contained commands and results:
.work/qualification/native-stdio-cleanup-diagnostic-20261015/REPORT.txt;
SHA256 0dbc338ac61f95808ecb5399a9b6fdc1cb6f5a42d39513890fc26372334b6d3d.

Acquisition owns its client, native phases and failure evidence
----------------------------------------------------------------
Before: engine calls inherited ambient Docker client state and separate shell
lifetimes; raw stdout/CID disagreement and cancellation could leave ambiguous
cleanup authority. After: one operation-owned private client serves every engine
phase through the existing held native owner. Metadata/readiness owners have
30-second budgets; attachment keeps untimed live streams. Exact raw stdout/CID
agreement admits cleanup identities, with contradictory create output preserved
across cancellation. Worker removal precedes proxy removal. Unknown local
retirement stops every next owner and removal; a local join alone proves no
engine-side removal.

Actual cancellation now completes permitted cleanup without a new publisher.
The original corrupted-CID cancellation test retains its signal status, TERM
marker, three-second bound, damaged receipt and cleanup predicates; only its two
public stderr predicates become silence. An ordinary post-start corrupt-CID
counterpart still reports refusal at143. Ordinary preflight130/143 remain silent,
while their captured cause survives independently of public presentation:

Before:
    130|143) exit "$inspect_status" ;;
After:
    130|143) retain_preflight_receipts=true; exit "$inspect_status" ;;

Readiness poll exhaustion collects bounded proxy logs before removal inside the
same owner. Primary timeout outcome2 survives secondary log-retrieval failure37;
a stalled metadata owner remains124. README's diagnostic section gives same-user
retrieval for acquisition/native/checker/baseline temporary receipts, bounds,
lifetime and uncertainty, including silent failures and live-only worker output.
It introduces no index, cleanup authority or permanent-retention promise.

The shared finite-engine observer had a separate proof defect. Its cumulative
JSONL file inherited the client's4KiB file limit. The first normal test initially
failed with truncated JSON; its disposed raw log supports no retrospective errno
claim. A retained old/new probe separately measures old Errno27 at4096 bytes
following five successes, versus twelve ordered new events (max701,total8412).

Before:
    with Path(log_path).open("a") as stream: ...
After:
    record_engine_call(Path(log_path), observed)

The existing mandatory log path becomes one owned event directory. Complete JSON
files publish atomically under a directory lock for actual concurrent callers;
missing, malformed, pending or gapped history fails. There is no empty fallback,
index or second authority. All three writers/readers migrate together. The local
per-call receipt precedent is tests/test_checker_engine.py at4490c0f; original
metadata assertions adapt by meaning, including missing/malformed/preexisting
state. Actual concurrent publishers preserve their events under the unchanged
per-file limit while their aggregate exceeds it.

Qualification remains split across explicit source epochs. At4490c0f plus owning
overlays, normal1+metadata14 pass in11.907s and remaining acquisition12 pass in
37.868s, covering the earlier13-method contract. Atc0bcfdb plus nine overlays,
diagnostic6 pass in24.154s. A broader125-method shared-consumer run completes in
301.747s with120 passing methods and five package methods producing9 failures/
3 errors; its three preflight methods overlap the diagnostic6. All receipts stay.

The package test fixture had doubled only stage execution while delegating
preflight into the newly held real acquisition owners. Its startup fault is
proven to hit that foreign owner; four other missing-phase failures were initially
source-correlated. Its existing finite seam now admits only the exact immutable
Python/uv preload pair, refuses unknown requests97, and keeps interface checks
real. Dedicated acquisition/operator suites own real preflight lifetime. All15
original package methods, signal/status/retirement predicates, deadlines and
rescue gates remain unchanged. The failed five plus an earned actual-caller
changed-pin rejection pass6 in45.182s; the120 greens are not rerun. This repairs
fixture scope and does not qualify production preflight through that double.

Ruff0.15.15/format, shell syntax, restricted AST/discovery and byte/mode endpoint
checks pass in their recorded epochs. The final149-file projection binds
c0bcfdb plus only nine authored overlays; README/note edits are separate. There is
no full current acquisition15, broad current-suite or real-controller lifecycle
claim here. No transfer, model, build or upstream source/pin change occurred.
Common preparation/bootstrap, generic filesystem stalls, unknown direct-report
blocking and outer foreground-controller cancellation remain open boundaries.
Precise source bindings, grants, commands, results and retained failed epochs:
.work/qualification/acquisition-client-20261015/REPORT-v2.txt;
SHA256 00a7c8c991d076b4f4d211015c6eff5b08a6b4bb42f820fbc1ba1451ac0eea8b.
Version2 corrects an initial historical test-hash label (first1e8fcfd7, later440d)
and narrows143 wording; all sixteen named epoch hashes/modes and four snapshot
manifests were checked directly. Frozen original metadata remains preserved.

Real acquisition-controller qualification (separate from the finite-engine tests)
-------------------------------------------------------------------------------
The same controller236cadfb/nativea7e72e66 projection subsequently passed three
real cached-image lifecycle cases: normal0, ordinary worker37 and directed
controller TERM143. The held worker independently recorded signal15. Exact raw
CID/create-output pairs admitted each role before inspection; observed image,
nonroot/read-only/capability/resource/mount grants and actual attach CLI argv,
scrubbed environment and empty0700 private configuration matched the contract.
After each case both exact admitted container IDs were absent, as were the
attach process, private configuration and controller scratch. Only the production
controller removed containers; the harness had no force-cleanup fallback.

Actual orchestration session5718 returned terminal0 on the same handle. Source,
runner and worker hashes, separate projected/live mode endpoints, poison config
and resolver hash remained stable. Independent receipt/source review found no
actionable issue. This explicit lo exercise made no HTTP/DNS request and used no
pull, install, build or transfer. Private regular-file output proves these live
bytes; it does not qualify full pipes, routing, hostile workloads, all signal
phases or unknown-retirement recovery. Precise runner, tool-terminal receipt,
grants, raw observations and evidence manifest are retained beside:
.work/qualification/acquisition-client-20261015/real-controller/REPORT.txt;
SHA256 a0d85126b4c78c7808ece64ca1245f3a4f47df7fe16142cef581cd744363987c.

Checker download transfers its supported PID to acquisition
---------------------------------------------------------
Before, the checker download branch waited for its final acquisition command:
    "${download_command[@]}"
    exit 0
After:
    exec "${download_command[@]}"

At this branch no checker client, native owner, cleanup trap or unpublished
record exists. The command is terminal: transferring the supported PID lets a
directed signal reach the acquisition controller's own lifetime and cleanup.
The exact command array, worker grants, input mounts and PRINT path stay intact.
Earlier interface checks and filesystem preparation remain separate boundaries;
this does not repair the package caller, which still owns post-controller work.

Against base0d5e661 plus only checker/test overlays, the three new methods and
existing checker download-preview method pass4 in9.663s, actual tool59425
terminal0. Three actual HUP/INT/TERM cases observe the held attach client and
supported controller PID, then finish before draining a full stderr pipe. They
verify the client's TERM marker, local retirement, worker-before-proxy removal
and configuration removal. Ordinary worker130/143 preserve their exact streams
and statuses without becoming cancellation; PRINT verifies its request and
absence of engine/allocation/filesystem effects. All fifteen existing acquisition
methods and the existing rescue helpers remain unchanged. The contained posture
checks pass20 in0.065s; restricted AST comparison confirms discovery15-to18 and
all original method/helper bodies. The checker differs only at the terminal
handoff/comment;140 other projected input files and modes remain exact. A private
old/new comparison confirms full four-line PRINT byte/status/stderr equality
with no allocation, engine or filesystem effect. Ruff/format and shell syntax
pass. Failed formatter path/config and proof import-entry attempts are retained
as harness failures; neither reran the four green runtime methods. Final source
hashes: checker402229d5 and acquisition test2668448b. This is focused contained
qualification, not a full current-suite run or an actual dependency download.
Exact source/mode bindings, commands, terminal observations and failed attempts:
.work/qualification/checker-controller-handoff-20261015/REPORT.txt;
SHA256 9439a082b5a4ee14b76dad573ca3d19670f98b9491dac3ff1eda8c8a1d2b0e7b.

Docker client preparation returns failure before public presentation
------------------------------------------------------------------
Preparation previously wrote utility errors and its summary to public stderr
before the caller could finish cleanup. Merely suppressing those writes would
discard the mkdir cause and let caller cleanup erase its only evidence. The
shared helper now returns controlled docker_client_diagnostic text. Each of its
seven callers saves the failed status before queuing that text and exiting;
existing signal precedence, retirement authority and terminal presentation stay
with the caller. The container launcher retains its separate native owner.

Before:
    if mkdir -m 700 -- "$config"; then :; else
        preparation_status=$?
        printf 'Cannot prepare Docker client configuration ...' >&2
After (the existing private parent owns the attempted receipt):
    umask 077 || exit "$?"
    ulimit -f 4 || exit "$?"
    exec 3> "$receipt" || exit "$?"
    mkdir -m 700 -- "$config" >&3 2>&1

The conditional caller disables errexit inside preparation, so cap and file-open
failures must explicitly stop before mkdir. Failed config setup retains the
existing0700 parent, possible partial config and attempted0600 preparation.log;
the usable-client binding is cleared after constructing its diagnostic. No new
index, directory allocation, retirement fact or cleanup-path mirror is added.
The receipt may be absent or incomplete; a cap failure preserves its observed
wrapper status rather than claiming the utility's intended exit status.

Failed mktemp stdout also cannot grant cleanup authority: its failed branch
saves status and clears docker_client_directory before returning. Without an
admitted directory, allocation failure promises no private cause receipt. A
simultaneous storage failure can prevent the later native reporter from starting;
no builtin fallback or public-delivery guarantee is introduced. Generic filesystem
stalls, allocation/result signal handoff and the container launcher's broader
raw-cleanup/direct-publication limits remain separate work. README adds same-user
discovery of nmrnet-docker-client.* preparation receipts and these limits.

At base d855fa3 plus the eight Bash and two test overlays, actual tool14726
returns terminal0:20 methods pass in32.680s. These are all eighteen client unit
methods (fifteen originals plus two helper methods and one container case), the
new held preparation reporter case and the existing acquisition reporter case
affected by observer extraction. The five helper subcases prove failed allocation
stdout cannot authorize sentinel deletion, exact cause/modes survive cleanup,
real hard-limit and receipt-open failures stop before mkdir, oversized output
stays at4096 bytes with observed SIGXFSZ status, and subsequent PRINT resets the
returned field. Returned diagnostics are recorded separately from public streams;
asserting both streams empty prevents premature writes from masquerading as the
returned result. The caller case observes the exact publisher argv and held
anchor blocked on stderr, then proves soleTERM143 finishes before draining while
the original cause bytes and inode survive. No original unit method was altered.
The existing observer loop moves unchanged to a shared test helper; no signal,
deadline, exact-identity or rescue assertion is relaxed. Formatter/Ruff and exact
AST comparison pass before this first runtime attempt. Posture20 pass in0.083s;
restricted AST checks bind unit15-to18, acquisition18-to19 and the unchanged
observer loop. The142-file projection binds eight Bash and two test overlays;
the other132 files retain their bytes and modes. README and this note are
separately reviewed.

All seven caller ingestion edges are qualified: the maintained container method
above plus six private acceptance cases for baseline run, checker check,
acquisition require-images, inference build, package apply and wheelhouse check.
Each proves ordinary42, the actual private cause and no engine dispatch; these
are not six extra maintained tests or an expanded unittest suite. Package apply
avoids unrelated acquisition preflight. The corrected acceptance tool29227
returns terminal0. Its first attempt97614 returned2 after printing case results
because its executing shell wrapper was edited; incomplete footer receipts and
that failed epoch remain preserved. Only these six acceptance cases repeated,
under the frozen corrected wrapper; the green runtime and posture methods did
not repeat. Final hashes, commands, terminal observations and failure evidence
are bound in the qualification packet below.
.work/qualification/client-preparation-20261015/REPORT.txt;
SHA256 b3dcd298786127d7ecdbc4dec8370de6c9c952cb8ff687154dfc1c5d67ebd820.

Finite engine metadata belongs to the fixture constructor
-------------------------------------------------------
The shared engine double previously manufactured a valid image ID and source
revision when its environment lacked those fields. Ambient values could also
replace the intended ordinary response before a test selected any fault.
LauncherFixture now supplies "sha256:" + "b" *64 and revision "a" *40 after
inheriting the environment; per-call additions still select deliberate malformed
responses.
The engine requires those fields at its existing metadata-read phase:

Before:
    identity = os.environ.get("NMRNET_FAKE_IMAGE_ID", "sha256:" + "b" * 64)
After:
    identity = os.environ["NMRNET_FAKE_IMAGE_ID"]

The revision follows the same rule. This is the same constructor-owned proof
input principle as cb318a9's native fixture NATIVE_STATUS repair above. Grammar
rejection, explicit private-error output and injected inspection status keep
their earlier precedence. Missing owned inputs fail rather than synthesizing
successful metadata; explicit empty, malformed and newline-containing stimuli
remain literal. CID and build-result policies are separate from this change.

At base6cc39f1 plus only these three source overlays, actual tool60086 returns
terminal0: all sixteen metadata methods pass in7.981s. Fourteen original methods
stay exact; the two new methods prove ambient poison cannot replace constructor
inputs, explicit malformed/empty responses stay literal, missing each owned
field fails with its actual missing-key cause and no successful response, and
explicit inspection7/private-error precedence survives the missing fields.
Posture20 pass in0.064s. Exact AST checks bind discovery14-to16 and reconstruct
the two consumer/constructor edits;139 other projected files and their modes
stay unchanged. Ruff0.15.15/format/AST pass without reformatting. All frozen/live
byte and mode endpoint pairs match. This first attempt repeated no green tests,
ran no broad consumer cohort and makes no predecessor-runtime claim. The note
is outside the142-file runtime projection. Exact sources, commands and results:
.work/qualification/fixture-image-identity-20261015/REPORT.txt;
SHA256 6f8b316889f1475001c99d92899622d30c33cb99e240f1c424c2d043b16400fa.

Two cancellation contracts share one held native owner
-----------------------------------------------------
The shared owner previously exposed its existing TERM/one-second policy only.
The container launcher's separate owner forwards the original HUP/INT/TERM and
offers two seconds. Blind substitution would change that contract; duplicating
the held protocol would leave two owners to maintain. Two named entries now
select a required closed policy in the same shell, without result interception:

    inference_native() { native_client term-1s "$@"; }
    container_native() { native_client original-2s "$@"; }

One implementation owns traps, admission, receipts, joining and the existing
result/cancellation/retirement fields. Existing production inference_native
calls stay unchanged. The new entry is preparatory: container.sh still owns its
old protocol until its separately qualified migration.

For original-signal numeric operations, timeout sends private USR2 to its timed
wrapper; that wrapper records the existing expired receipt and attempts TERM
to the held group. Actual group TERM therefore cannot masquerade as deadline
expiry. The existing entry keeps its TERM deadline behavior. Both the timeout
kill-after and the parent's grace use the selected one/two-second policy.
An ordinary client129/130/143 remains distinct from actual cancellation.

The new deadline_grace_started field records entry to a performed wait phase;
it supplies neither a second deadline nor cleanup authority. A known cancellation
skips that expiry wait, while cancellation after entry cannot start a fresh wait.
Repeated signals can change the final cancellation cause without renewing grace.
The phase-entry guard is not an atomic signal handoff, and an expired receipt
does not establish that the client received TERM. Actual delivery and grace must
be observed in qualification. This core slice introduces no container adoption,
new PID authority, ambient policy control or source/API fallback.

The four earned policy methods pass in50.800s, actual tool77897 terminal0.
They observe numeric10 expiry with real USR2/kill-after2 argv, the original
HUP/INT/TERM for numeric and untimed clients, three known/during-expiry/repeated
cancellation phases with one actual sleep2 dispatch, and ordinary129/130/143
without cancellation or expiry. The fixture publishes readiness only after
observing the resistant descendant's actual signal-ignore dispositions. The
known-expiry hook waits for the real TERM marker before HUP; it does not
synthesize expiry.
The same pinned container records GNU timeout9.1, SHA256
5ef0eaaaa4220593add7716aad74da927ca3bb10605e964330de64fecc3ef15e.
Exact /proc executable/argv observations bind the tested binary to that path.
Existing-suite and caller-compatibility qualification remain separate below.

The original51 loader cases subsequently pass in289.101s, actual tool29981
terminal0; the four new green methods are excluded from that run. The original
loader includes the preexisting stdio alias, so its count differs from lexical
def count. Adapters preserve every original assertion: three internal launch
strings in two native methods gain the required deadline/grace arguments, and
the grace observer retains its old one-second/three-second defaults. Six strict
anchor-signature strings in five caller test files gain the same fields while
preserving receipt/parent positions, session/group checks and rescue predicates.

Posture20 pass in0.168s. Restricted AST checks bind actual discovery51-to55,
the reviewed original-module adapters and five caller files with only the six
signature literals changed;135 other projected files retain bytes and modes.
Initial formatting stopped before runtime on T201 for a test metadata print.
The corrected test asserts the real GNU version banner while the earned command
records version/hash separately in that same pinned container; no lint waiver
or runtime repeat was used. Final formatting and full-file Ruff checks pass.

The six affected caller methods pass in45.206s, actual tool8740 terminal0.
Checker/report, acquisition/report and the package two-live-caller rescue cases
exercise the new signature nonvacuously. Baseline's executed mismatch case does
not exercise its failure-only rescue gate; that gate and inference's analogous
gate are conservatively verified by exact source adaptation, not claimed as
runtime rescue proofs. No broad125-consumer or current whole-suite claim follows.
All frozen/live SHA/mode endpoint pairs match. No runtime method repeated or
failed. The core and its seven source overlays are qualified; launcher adoption,
real engine qualification and scientific repeats remain separate. Precise input
bindings, original loader identities, commands, logs and failed formatting epoch:
.work/qualification/container-native-policy-20261015/REPORT.txt;
SHA256 822c123a71256b34c0d92a0d4fc7b6e4d34d439004e2e48b6a1d9be296835a7f.

Launcher adoption of the shared native owner (2026-10-15, in progress)
-------------------------------------------------------------------

The preceding qualified core commit92a0419 introduced container_native with the
launcher's original-signal/two-second cancellation policy. tools/container.sh
now delegates its offline client, checker inspection, Git/input preparation and
terminal publishers to that owner. This removes its second PID, ready/release,
completion and USR1 protocol. The inspection retains its10-second budget;
offline work remains untimed. Download still terminal-execs tools/docker.sh.
The exact provenance of the shared mechanism remains the preceding core entry
and tools/inference_native.sh's pinned Magnet source reference.

Before, checker inspection ran a foreground timeout and deleted its private
receipts even on failure. After, the same held owner joins inspection/setup work
before the launcher decides cleanup, and failed inspections retain their cause
under .work/checker/.inspect.*. Receipt setup runs inside that inspection phase;
its CLI files remain4096-byte capped, while setup failure can retain a separate
native command.log. Allocation/storage failure does not promise complete files.
README documents discovery after silent cancellation and retention limits.

Before, find and check_git_inputs.sh ran outside native ownership even though
the latter starts Git/scaffold commands. After, their unchanged input/output
commands execute together in one held bare-errexit preparation phase. A failed
phase cannot dispatch the check worker; its private captured cause survives
permitted cleanup. The root inventory now inherits the owner's077 umask, making
it0600 within its0700 directory. This is a deliberate privacy restriction, not
a claim of mode parity. Generic filesystem stalls remain a separate limit.

Failed inspect/probe/check-input allocation clears failed stdout before EXIT
cleanup can consume it. Parent metadata/control failures queue controlled
status/path diagnostics. Permitted cleanup is quiet and precedes a held terminal
reporter; actual cancellation skips a new reporter, and unknown retirement
retains state and forbids another owner. A failed removal describes an attempted
path and status rather than asserting which files remain.

The first contained caller run, tool1408 terminal1, executed31 methods in49.492s:
all12 LauncherTests, the affected convention grant check and14 DockerClientTests
passed. Four client methods failed with six assertion events: failed release,
failed completion publication, malformed receipt (three cases), and unreadable
receipt. Their statuses were correct; the shared core's retired-stdio cleanup
branch omitted controlled reasons. The NUL case additionally exposed a Bash
command-substitution warning. These are source defects, not justification for
relaxing the original diagnostic assertions. Corrective qualification follows;
this entry does not claim current suite closure.

The frozen142-file runtime projection contains four overlays. Its before/after
SHA256 and mode manifests compare equal. Ruff0.15.15/full-file lint/format,
formatter AST parity and Bash syntax checks passed before runtime. Private
commands, actual terminal output and the failed epoch remain at
.work/qualification/container-adopter-20261015/ORIGINAL-EPOCH.txt;
SHA256 1f82367681a44c2537aa1f2fb80f2bd070dd67a5d5ae05431d8f9d7f9ef03d47.
No real-engine, scientific, upstream or global filesystem-liveness claim follows.

Corrective and earned caller qualification:

The shared owner now distinguishes an admitted canonical completion from its
own control failure. A local completion_observed flag becomes true only after
raw-byte status admission. Known-retired stdio failures return their controlled
reason when completion was not admitted; ordinary native status and actual
cancellation retain their existing stream contract. Receipt assignment uses a
redirected compound command so Bash's NUL-substitution warning cannot escape;
the original-byte comparison still rejects that receipt. The caller test adds
one assertion rejecting that warning. No original status or cause assertion was
removed. Final core SHA256
045b4e4ad8039d0472d339b8d41070f2f5c9495ab4a988de08515f5eb78552ea.

Tool61313 terminal0 passes only the four failed caller methods in13.437s.
Tool98542 terminal0 passes four affected native methods in70.378s: ordinary
status/binary streams under both budgets, receipt/startup faults, blocked-output
cancellation and captured-mode receipt type/read/byte mutations. The original
27 green methods were not repeated. Exact frozen inputs, commands, SHA/mode
endpoint comparisons and scope distinctions:
.work/qualification/native-stdio-control-diagnostics-20261015/REPORT.txt;
SHA256 e16079035984b4dc38d9a662a0120a91947f50eeca16f6f69f4d6bd21dd1edf8.

Five new integration methods earn the launcher's changed boundaries: retained
inspection cause after directed TERM before worker dispatch; failed37 and held
Git preparation with private cause; probe success publisher cancellation while
stdout remains full/unread; failed inspect/input/probe allocator stdout preserving
an unowned sentinel's inode and bytes; and record-metadata failure cleaning its
client configuration before a cancellable report on full/unread stderr.

The first new-method invocation (tool35612 terminal1,20.223s) passed four real
methods but root supplied a nonexistent fifth selector, causing one loader
error. That failed command/log remains preserved. Tool39813 terminal0 runs only
the exact missed record-metadata method in2.959s; the four green methods were not
repeated. All five therefore have passing runtime evidence, without claiming a
single green five-method invocation. Test review repaired readiness-before-cause,
partial-card publication and premature caller reaping before any execution.
Positive WNOWAIT death and observed anchor absence precede caller reaping in the
new rescue harness. Final test module SHA256
750011cecb3685d9a82a67f5837b78b8ecdaa319ae2fb6516b41a167ddfa4b88.
Ruff0.15.15/full-file lint/format and pre/post-format AST parity passed. Frozen
candidate/executed trees are distinct; executed before/after hashes and modes
match. Exact earned runtime record:
.work/qualification/container-adopter-earned-20261015/RUNTIME.txt;
SHA256 04319bc05fcba34d82ae763551077503355718e295d985225fbfa577b34de4bd.

Final conservation proof passes20 scoped posture methods in0.090s and verifies
actual loader identities18-to23 (all originals plus five new), unchanged12 launcher
identities,137 other projected files/modes and the narrowly reviewed adapters.
Two original methods retain all assertions while their injection/diagnostic
strings follow the real owner;15 other original method ASTs are exact, and the
remaining method gains only NUL-warning rejection. The five source overlays are
explicit; README and this note stay outside the runtime projection.

The first proof launch stopped before tests on its import entry point. Its failed
receipt is retained. A separate immutable invocation uses runpy from the project
working directory, with unchanged proof/check code, and passes; no runtime
method was repeated. Final commands, conservation code and all epoch distinctions:
.work/qualification/container-adopter-earned-20261015/REPORT.txt.
SHA256 9b3419b72ab123b4720fcbc51a964a12f7eeadd4bfd8da05470cbba7affe0860.
The launcher migration and its affected focused scopes are qualified. Package
outer-controller handoff, remaining repo-check adjudication, affected real-engine
qualification, current-lock inference image/scientific repeats and final aggregate
remain open; CI stays deferred and NMRNetplusplus remains untouched.

Reviewed HTTP/HTTPS scheme-port contract (2026-10-15)
--------------------------------------------------

The existing omitted-URI-port branch in tools/bound_http_proxy.py now cites
RFC9110 sections4.2.1 and4.2.2 precisely at the ternary, with one existing local
allow-contract annotation and its actual boundary-test reference. HTTP80 and
HTTPS443 are protocol meaning after scheme/host admission; CONNECT requires an
explicit integer port. This does not default an operator input or claim TLS
transport. Before/after runtime ASTs are identical: only four comment lines were
added. Raw scanner labels/snippets/order remain identical after line-number
normalization; applicability accepts exactly this expression. No detector rule,
strict boundary or test was changed to obtain that result.

The contained focused command passes11 methods in0.038s: the two existing port
units, all seven contract-policy fixtures and two original rawmatcher fixtures.
Explicit1/65535 remain accepted;0/65536/-1/noninteger remain rejected before
transport. Ruff0.15.15/full-file lint/format pass. The142-file projection changes
only this source;141otherbytes/modes and successful before/after manifests match.
An initial root orchestration mode mistake stopped at EXE001 before tests; its
644 projection/log remains preserved. Restoring the original Git/host755 in the
successful projection changes no authored mode and repeats no green runtime.
Precise commands, source bindings, proof and failed/successful epochs:
.work/qualification/proxy-scheme-port-contract-20261015/REPORT.txt;
SHA256 68f936c91f1daf7ac7e1c8a62bb4f34b6eec195e1b1e29ed75b66d1b83d75ec9.
This is one meaning-based adjudication, not current global defaults closure.

HTTP content-coding proof before defaults adjudication (2026-10-15)
----------------------------------------------------------------

One new tests/test_artifacts.py method now exercises the current downloader
through actual stdlib HTTPResponse header parsing over finite in-memory wire
bytes. Its seven cases cover absent/explicitidentity at offsets0/17, gzip at both
offsets rejected before reading body bytes while preserving the partial inode,
and same-size damaged resumed identity bytes rejected by MD5 before publication.
Existing Response and all35 prior test bodies remain unchanged; discovery is36.
This is parsed-response/download proof, not a socket or transport claim.

Why this reference/behavior matters: RFC9110 section8.4 requires applied content
codings to be declared; absence therefore means no additional HTTP coding for a
conforming response. Literal Content-Encoding:identity acceptance preserves the
existing compatibility behavior; section8.4 says it SHOULD NOT be sent, so this
is not a required response header. Section12.5.3 defines identity as no encoding.
Section14.1.2 measures ranges in coded bytes: additional coding would change the
archive byte offsets and declared size/digest contract. Header absence does not
prove server truthfulness; final size/digest checks still gate publication.
Precise primary references:
https://www.rfc-editor.org/rfc/rfc9110.html#section-8.4
https://www.rfc-editor.org/rfc/rfc9110.html#section-12.5.3
https://www.rfc-editor.org/rfc/rfc9110.html#section-14.1.2

The contained command passes3 methods in0.006s: the new seven-case method plus
the existing matching-range resume and wrong-checksum/excess-byte methods, each
once. Ruff0.15.15/full-file lint/format and formatter AST parity pass. Exact
original module/Response AST reconstruction,141 other projected files/modes and
all endpoint comparisons pass. An initial Docker-socket sandbox denial occurred
before any container/test; its failed receipt remains separate from the authorized
formatter/focused invocations. Download source, defaults policy and annotations
are unchanged. The earned proof is a preparatory slice, not defaults closure.
Exact frozen inputs, command/exit receipts and conservation scope:
.work/qualification/artifact-content-coding-contract-20261015/REPORT.txt;
SHA256 9e995e0fd3db24da619f89be835b034d9dbacbb04abcfcb6c6df5c508976d713.

Failed package apply allocation grants no removal authority (2026-10-15)
---------------------------------------------------------------------

Before, a failing mktemp could print a path into apply_capture; EXIT then passed
that unadmitted path to rm. The owning allocation now saves the failure status
and immediately clears the failed binding before its existing rejection:

    preparation_status=$?
    apply_capture=

The original diagnostic/status remain. This matches the Docker-client and
contained-launcher failed-allocation precedent above; no new cleanup protocol,
validation layer or guessed path is introduced.

One new regression emits an unowned-by-caller sentinel path plus28 from exactly
the apply allocator. Other allocations and the fixture's rm execute real native
commands. The patched caller preserves the sentinel/marker inode and bytes,
retires its prepared configuration and makes no engine call. The same unchanged
new body against old source actually deletes that fixture-owned sentinel, then
raises FileNotFoundError at its final sentinel.stat comparison. The counterfactual
checks the exact filename/frame and earlier28/no-engine/config-cleanup facts
before disposing its fixture; an arbitrary nonzero exit is not counted as proof.

Contained positives pass2 methods in5.897s: the new regression and existing apply
output/status0/37 cases. The separately recorded counterfactual is an expected
negative. Discovery16-to17, all original method/fixture ASTs,140 other files and
all142 projected modes remain exact. Ruff0.15.15/full-file lint/format/Bash syntax
and formatter AST parity pass. Initial import setup stopped before tests; its
receipt remains separate. Frozen inputs, actual handles90223/28084, precise
mode windows and four exact owned-container absence receipts are recorded in
.work/qualification/package-apply-allocation-authority-20261015/REPORT.txt;
SHA256 4cf561e8b60b63b8a6b90dc1ecde25bfe43a10a50db361b522991c4dac1c1556.
This fixes allocation authority only; package controller handoff remains separate.

Cooperative controller policy in the existing owner (2026-10-15)
--------------------------------------------------------------

A package controller owns nested worker/proxy cleanup. Wrapping it with the
single-client one/two-second escalation could kill it during its own removal
phases. The new controller_native entry therefore requires untimed/stdio and
uses the existing owner/receipts with cooperative completion. It introduces no
second PID authority, success callback or cleanup deadline. The inference_native
and container_native entry contracts remain unchanged.

Before release is attempted, actual cancellation can retire an idle anchor
without waiting for a nonexistent controller. After any attempt, a failed publish
might already have dispatched: only canonical raw completion permits KILL/join.
Missing, malformed or uncommitted completion retains UNKNOWN and forbids the
next owner. Any deadline receipt, including a FIFO or correctly spelled expired,
is invalid for this untimed contract and is rejected without reading it.

Actual original signals are forwarded while the same completion wait remains
in progress; repeated signals do not renew a timeout. An unresponsive controller
can keep this wait live indefinitely. That limit is explicit in the source;
elapsed time cannot establish that its engine cleanup finished. Canonical exit
proves this local group only, never an inner group's retirement or daemon
removal. Package adoption must dispose its unused build configuration beforehand,
retain its stage inputs and skip new parent reporters on nonzero completion.
That separate adoption and the early preflight lifetime gap remain open here.

The five new methods pass14.864s: actual TERM held beyond2s, then INT through the
same finish gate; ordinary143 distinct from actual cancellation; invalid entry
arguments; cancellation before release; release taking effect then returning29;
and NUL/publication/unexpected regular/FIFO-deadline UNKNOWN cases. The new test
module composes the old fixture without rediscovering its55 tests. It retains
unreaped caller identity through process/group assertions and admits only actual
anchor/SID/parent evidence for its failure rescue. Readiness and teardown test
races were corrected in private proposals before runtime.

Eight selected old compatibility methods pass117.252s, scoped20 posture methods
pass0.061s, and formatter/Ruff0.15.15/Bash syntax pass. All runtime methods ran
once without failure. The143-file frozen projection contains the helper and
new test only;141 other base files/modes, old entry bodies and all55 original
native test identities remain exact. This is not a current full55 run, package
composition proof or engine/scientific qualification. A metadata-only absence
assertion was corrected using its existing lone-LF receipt before querying the
remaining owned CIDs; no tests were repeated. All four exact checker CIDs are
absent. Precise inputs, original/scoped methods, actual handles96080/85331,
commands, endpoint windows and retained metadata epoch:
.work/qualification/cooperative-controller-native-20261015/qualification/REPORT.txt;
SHA256 181f9940e4dda41e371da647b11279c21f04b292d41a650b7117926142362f8e.

Reviewed contracts on an If condition (2026-10-15)
------------------------------------------------

The local contract mechanism now admits one generic candidate in an immediate
single-line If condition expression. It still rejects body defaults, sibling
candidates, continued condition expressions and non-If compound statements.
Raw classification and strict environment/CLI/function/exception rules remain
unchanged. This keeps the existing download check in its natural condition:

    # silent-defaults: allow-contract -- Absent Content-Encoding denotes no additional HTTP coding; proof=tests/test_artifacts.py::ArtifactTests.test_http_content_coding_preserves_declared_archive_offsets
    if source.headers.get("Content-Encoding", "identity") != "identity":

Before, the multiline If statement prevented this annotation from applying.
After, the condition is eligible; a default in its body remains a finding.
The exact RFC9110 sections8.4,12.5.3 and14.1.2 and rationale are recorded beside
the getter. Literal identity is existing compatibility; it is not a required
response header. Final size/digest still gate archive publication. The previously
qualified seven-case HTTPResponse proof remains unchanged and was not repeated.

Initial qualification passed13 methods in0.050s, but independent review found
that a one-line getter followed by a continued condition was also admitted.
Those greens did not prove the claimed boundary. The correction requires the
If.test AST span to end on the annotated statement line; it does not prohibit
a later physical closing-delimiter/colon-only line. The new negative subcase
fails precisely against the prior policy and passes with the corrected guard:
one affected method,0.003s; expected prior-policy failure,0.004s. No other green
runtime methods were repeated. Both epochs remain retained:
.work/qualification/artifact-content-coding-contract-20261015/header-policy/qualification/REPORT.txt;
SHA256 0479323e540bb1c12282506e54e53cacb9a2ddfb8bb5372e7b8285eff54c7a4b.
.work/qualification/artifact-content-coding-contract-20261015/header-policy/correction-v2/qualification/REPORT.txt;
SHA256 910be2d49a683e587989d32d13dbc92b3bc19a74424206d75a744f264e4435c8.

The corrected143-file projection conserves140 other files and every projected
mode. Across82 authored Python files, raw labels/snippets/order remain identical
apart from line numbers; only this getter changes applicability. Original seven
contract methods/helpers, artifact runtime AST and strict detector paths remain
exact. Formatter/Ruff0.15.15 and endpoint comparisons pass. This is a scoped
contract adjudication, not a current whole-property or global green claim.

One scientific expression can contain nested defaults (2026-10-15)
-----------------------------------------------------------------

The selector must preserve the trained solvent categories from pinned
SolventDataset, not invent an operator choice. Exact source and rationale remain
beside the expression in tools/baseline_prepare.py:
https://github.com/numpde/fork-of-NMRNetplusplus/blob/3ba8b9c2f3d0a390d00685d238618345c6ab24d7/uninmr/data/key_dataset.py#L23-L40

    category = {"CDCl3": 1, "DMSO-d6": 2}.get(solvent, 3) if solvent_present else 0

Before, one annotation could not cover its two nested generic findings. After,
the same local mechanism accepts one selected generic expression containing all
selected candidates. Every candidate must independently pass the existing strict
gate and single-line extent check. Independent siblings, operator inputs and
function/exception findings remain visible. The diagnostic now says expression,
and the source retains the caveat that proof existence is not semantic proof.

The only selector edit is its local annotation. Runtime AST and type behavior
remain exact: missing0, CDCl3=1, DMSO-d6=2, other-present3, presentNone3; present
unhashables still raise TypeError. The existing SelectionTests category proof
executes the actual selector and checks raw/presence receipts. The stronger
ScientificProductContractTests pinned-source crosswalk is cited here statically;
it was not rerun in this slice. Neither proof establishes checkpoint accuracy.

Contained qualification passes14 methods in0.058s: all11 local-contract methods,
the original two raw matcher methods and the existing solvent category method.
The new property case also rejects a nested argparse child under a generic
outer root, earning the per-candidate strict gate. All original10 contract method
bodies/helpers, raw/strict classifiers,140 other files and all143 projected modes
remain exact. Across82 authored Python files, only the two solvent findings
change applicability; raw labels/snippets/order remain identical apart from line
numbers. Formatter/Ruff0.15.15, whole producer AST and endpoint checks pass.
An initial private AST locator failed before tests; its immutable epoch remains.
Only the locator was corrected for the successful invocation, with no formatter
repeat. Exact commands, actual handle23655, frozen inputs and exclusions:
.work/qualification/solvent-expression-contract-20261015/qualification/REPORT.txt;
SHA256 affcbd2ae2e9f70af66fa45cad8a465f548f3fa64cdde07cc8fd65dd245a932e.

Package stage hands lifetime to the cooperative controller (2026-10-15)
----------------------------------------------------------------------

Before, packages.sh waited on a foreground docker.sh controller; a parent-only
signal could be deferred while that controller owned worker/proxy cleanup.
The stage now uses the reviewed controller_native policy above:

    controller_native 'package stage controller' untimed stdio "${command[@]}"

It first removes the unused parent build-client configuration, after confirmed
build/admission retirement. Record-only signal traps let that removal finish.
The caller then consumes its path binding even on failure, preventing an EXIT
retry; attempted-path/status text does not claim that any directory survived.
Actual cancellation takes priority and forbids controller dispatch. Any stage
inputs already captured remain with the review stage on every outcome.

The handoff installs a terminal EXIT handler with no removal or helper calls.
Only controller zero restores normal cleanup and permits the Review publisher.
An outer completion proves no inner retirement: even a nonzero controller plus
failed outer evidence removal must not start another parent reporter. The
terminal handler reports returned wrapper diagnostics directly, preserving the
primary status if delivery fails. Direct stderr can block; an unresponsive
controller can keep cooperative waiting live indefinitely. Neither limitation
is hidden by a second timeout, fallback or cleanup owner. README records the
operator-visible wait and retained-input behavior without promising successful
engine removal. PRINT and offline apply behavior remain unchanged.

Early interface validation and require-images preflight are still separate
foreground calls in this slice. The resource-bearing require-images lifetime
gap remains open; the retained private next-slice proposal is not implementation
or qualification. No upstream code/pin, image build, acquisition or scientific
execution changed here.

Four maintained methods are qualified across retained epochs, not one aggregate
run. Initial handle12706 passed the new controller37/outer-removal23/no-next-owner
regression, existing failed-apply allocation and existing full-unread Review
cancellation. Its new composition method failed both subcases. Correction97033
still missed the required observations within the existing waits; its new
diagnostics located the observed phases. The fixture had mismatched the actual
proxy create prefix and no-LF attach PID receipt; unused Python rm/mv
interceptors also consumed the short
test waits. The final case uses exact role-specific argv and real rm/mv only in
this composition test. Product code and timeout budgets remained unchanged;
fixture corrections preserve the cleanup/status requirements. No hypothetical
image-inspect route was added.

Final handle90039 passes the composition method/both subcases in11.725s. A sole
parent TERM reaches the actual copied controller, whose worker-removal actor
remains held beyond2s while the proxy remains present. After release, observed
groups disappear before caller reap, worker removal precedes proxy removal,
streams/status143 agree, build config is gone and captured input bytes/modes/
inodes remain. Ordinary worker143 separately proves stream/status/removal effects;
it does not independently phase-admit every native group. Private handle95236
passes retained-path41, delete-then41 and TERM-during-delete143: exactly one
config removal, no retry/dispatch and truthful path/status reporting. Its first
unexecuted script expected23 incorrectly; independent review corrected that
expectation to the existing fixture's41 before execution.

Original17 method bodies remain exact; actual discovery is19 with the two new
methods. Three formatter epochs/Ruff0.15.15/Bash syntax pass; scoped20 posture
methods pass0.077s. The143-file frozen package-only projections conserve141
other files and every projected mode, with exact source/endpoints across all
epochs. The earlier three passing methods and private probes were not repeated.
Eight exact owned checker IDs are absent. Ancillary metadata-verifier working-
directory/CLI-wording failures remain recorded; correction reused the first
absence receipt and queried only the remaining IDs. Current whole-suite green,
real-engine behavior and scientific readiness remain unproven. Exact grants,
commands, actual terminal handles, preserved failures and source/mode windows:
.work/qualification/package-controller-adopter-20261015/REPORT.txt;
SHA256 5a2c9be908638bfd79c97bdf71e83a9ad0ca36172dc44d6a0688198093698b3a.

Reviewed signature contract: DNS recursion origin (2026-10-15)
-------------------------------------------------------------

The proxy's existing _read_dns_name(message, offset, depth=0) starts each new
name with no followed pointers; recursive calls explicitly add one. Its16-hop
limit is local policy, not an RFC-mandated count. Source rationale and the local
behavioral proof are recorded immediately before this signature. The existing
pinned DNS implementation reference remains in tools/bound_http_proxy.py:
https://github.com/numpde/magnet-deploy/blob/2d4ee50b0359e71900fce9289ea01f46d0f41249/scripts/image-build-proxy.py#L96-L298
No proxy runtime expression or parameter default changed.

Before, a reviewed contract could not cover a callable signature. After, the
same local reason/proof annotation selects only the direct default subtrees of
one immediate def/async-def, including multiline signatures. Every selected
default and generic descendant must independently pass its gate; a strict
operator default in another parameter keeps the whole signature red. Bodies,
nested callables, decorators and type annotations stay outside this scope.
Exception handlers and lambda-containing defaults remain ineligible. Proof
existence guards reference drift, not semantic truth or required proof state.

Two old applicability fixtures deliberately change meaning: their annotations
already precede the exact signature, which is now an eligible boundary. Their
raw findings remain. Nine other fixture methods/helpers are unchanged; three
new methods exercise signature scope and strictness. The decoder gains one
byte-only proof: omitted/explicit0 give identical literal/compressed names and
following offsets; literal depth16 succeeds; another pointer at16, direct17 and
a self-pointer loop fail at the existing bound. All old proxy test bodies and
the whole proxy runtime AST remain exact.

Contained qualification passes17 methods in0.075s: applicability14, original
raw matchers2 and new decoder proof1. Ruff0.15.15/format/all-four ASTs and endpoint
checks pass first attempt. In the143-file frozen projection,139 other files and
all modes remain exact. Across82 Python files, raw labels/snippets/order remain
identical apart from line numbers; only this named depth0 finding changes
applicability. Formatted live integration is bound separately from the original
raw-live qualification window. Exact commands, actual terminal handle66877,
intentional fixture migrations and source/mode receipts:
.work/qualification/default-signature-contract-20261015/qualification/REPORT.txt;
SHA256 6979251ec4d28013a3ca75d981e2fef30206a8413997644c0ac5f78f58266609.

This adjudicates one concrete protocol contract. Unresolved generic fixture
candidates and the whole-property gate remain open; no broad signature exemption,
production DNS transport, real-engine or scientific qualification is claimed.

Fresh offline retained-input checks (2026-10-15)
-----------------------------------------------

Before rebuilding the inference image, the maintained contained commands ran
once against the retained inputs:

    make packages/wheelhouse/check
    make weights/check ARCHIVE=weight.zip
    make weights/check ARCHIVE=data.zip
    make weights/check ARCHIVE=checkpoints.zip

All four returned zero, between 14:15:47Z and 14:16:04Z, on actual handle 93934.
The wheelhouse owner checked exact membership and hashes against the applied
lock/source declaration and existing completion receipt. Each archive passed
its declared size/MD5 check and returned a SHA256 identity. The report below
records those full identities and the precise command/grant receipts.

The 25 source, lock, declaration, manifest and provenance hashes and their
metadata remained unchanged, as did 67 retained payload-file metadata records.
Prepared baseline provenance and the fixed upstream revision remain unchanged.
Concurrent package-preflight edits are separate and are not inputs to these
commands. The launchers used the cached pinned Python image, offline networking,
read-only inputs/root and the existing non-root/resource/private-client grants.
No artifacts or provenance were rewritten; no download, installation, build,
extraction or model execution occurred. This refreshes retained wheel/archive
identity, not extracted-data semantics, advisories, image/import readiness or
scientific results. No failed attempt or green repeat occurred.

Frozen commands, actual terminal results, before/after bindings and limits:
.work/qualification/offline-prerequisites-20261015/REPORT.txt;
SHA256 1906bcdb62aadaad367f9722061ad09217bf084ea3bf9595e997db00c301193e.

Owned package preflight and quiet polling controls (2026-10-15)
--------------------------------------------------------------

Before, packages.sh ran resource-bearing require-images as a foreground child.
It now uses the same cooperative controller owner before allocating a package
stage or parent build-client configuration. The existing terminal handler/state
move once rather than introducing another cleanup policy. Nonzero, actual
cancellation and UNKNOWN stop before the next owner; only zero clears the early
traps and continues admission. Resource-free check-interface stays first, with
the same explicit interface requirement. Its pre-resource error write remains
a separate possible blocking limit. PRINT/apply operands remain unchanged.

Initial contained handle 63655 passed six of seven selected methods. The new
parent-TERM case completed its held cleanup and retirement checks, then failed
because public stderr contained b'Terminated\n'. Assertions after that failure
were not reached. Instrumenting the two explicit wait sites did not reproduce
or attribute the message; a separate self-TERM probe also passed against the old
helper and established no wait defect. Neither experiment justified a wait fix.

The bounded sleep-scope probe attributed the text on its first attempt, then
stopped: the actual preflight controller's foreground sleep scope captured the
eleven bytes while all wait captures stayed empty. Actor/phase evidence locates
the active native-client completion poll; no instruction-pointer trace is
claimed. The original attribution report's seven-byte typo remains preserved;
the corrected text changes only that count, with no runtime or evidence rewrite:
.work/qualification/package-preflight-ownership-20261015/sleep-diagnostic/REPORT-v2.txt;
SHA256 94db4615dd172e29a3f8272112dae38430c45e0722f34dfd8880e9f015eb378d.

The correction redirects the compound scope of the three live polling sleeps,
where Bash itself can report a signalled foreground child:

    { sleep 0.01; } 2>/dev/null

It preserves sleep status, loop predicates, traps and native client descriptors.
It changes neither explicit wait site nor supplied client streams. The existing
preflight test now deliberately holds the inspection completion poll, observes
the actual sleep child/parent/group/session, then sends its sole parent TERM.
The unchanged config-removal barrier still holds for more than two seconds.
This proves the forced completion-poll site, not runtime coverage of every poll.

The same strengthened method fails precisely on old helper 239 (handle 64937,
2.585s, Terminated stderr) and passes with helper 174 (5400, 2.610s), reaching its
no-package-stage/no-build assertions. Three selected existing native methods pass
27.019s (17181): binary streams/status/dispositions, blocked-output cancellation
and resistant numeric expiry. The six earlier preflight greens are preserved
on their original helper and were not repeated; no full-current suite is claimed.

Original 19 package method bodies remain exact; discovery is now 22. Its old
global readiness fault is scoped to the actual package-capture payload so the
new early owner cannot steal that test's intended phase. Failed outer readiness
retains typed private UNKNOWN scratch. Failure rescue admits only observed
anchors; pre-admission separate children remain bounded by the ephemeral checker
container, without guessed cleanup. Ruff/format/Bash syntax, source/AST/mode
conservation and frozen endpoints pass. Corrected projections conserve 140 other
files and all 143 modes; formatted live integration is a separate receipt.
Precise split epochs, actual results, commands, limitations and source bindings:
.work/qualification/package-preflight-ownership-20261015/REPORT.txt;
SHA256 bbb2f78d6d710c956fcd1eca28e04c97168eda9ccf59af4049b7e1f6a9c59120.

Actual acquisition lifecycle after cooperative preflight (2026-10-15)
------------------------------------------------------------------

A single cached-engine qualification exercised the corrected native helper and
current controller/client/proxy/guard, through a private cooperative parent.
Actual handle 77137 returned zero, with receipts at 14:38:37–14:38:42 UTC. Its
three cases returned ordinary 0, ordinary 37 and parent TERM -> 143 with exact
stdout/stderr; the directed worker independently recorded signal 15. Readiness
required the exact nonce plus newline before release or signalling.

The observed attach client, controller and two anchors matched their admitted
identities. Both roles' raw CID and create-stdout receipts agreed. Actual image,
mounts, non-root/read-only/resource grants and private empty client configuration
passed inspection. After return, the observed processes, configuration, scratch
and recorded native control paths were absent. Each exact worker/proxy ID was
independently absent; only the production controller removed containers. No
UNKNOWN, fallback removal or restart occurred. Source/harness hashes and modes,
poison configuration and resolver bytes remained unchanged.

This used cached pinned Python with pull disabled and explicit loopback for
lifecycle only. It requested no network traffic, transfers, installs, builds or
scientific execution. It does not prove routing, unread full-pipe behavior,
every process-group member's retirement, actual package resolution or scientific
correctness. The maintained package composition tests cover a separate boundary;
current-lock image build/import and scientific repeats remain outstanding.

The original unexecuted helper-239 proposal remains preserved. The executed
version binds helper 17460eb7, controller ec31b27b, client d3834b87, proxy a03200ba
and guard 4130aa58; it makes no whole-repository or clean-HEAD claim. Independent
review checked the frozen source, grants, actual terminal receipt and exact-ID
absence evidence without further engine calls. Precise commands, full bindings,
raw results and limitations:
.work/qualification/current-runtime-readiness-20261015/real-controller-v2/REPORT.txt;
SHA256 aa4bc3f8b996349f88f97b6447ea9440e83c2e14ca28e6a3bdfcf78ba180efb2.

Runtime pull policy requires an explicit operand (2026-10-15)
-----------------------------------------------------------

The native runtime-grants port checked every supplied --pull value was never,
but accepted an absent flag through all([]). That missed its existing obligation
to forbid implicit image acquisition; maintained runtime arguments already supply
--pull never. The checker now requires presence before its unchanged value check.
Other grant assertions, option parsing and duplicate-never acceptance remain.

Before: captured valid import arguments with only the --pull never pair removed
were accepted. After: that precise mutation is rejected. The strengthened method
first validates the original captured arguments and retains every prior negative.
Against the old matcher it fails only the new missing-pull subcase (one method,
0.445s, no errors); the corrected matcher passes that same method and the existing
seven-lane runtime-grants consumer (actual handle 6980, two methods, 2.776s).
No production launcher changes or real builds/transfers were required.

Pinned Ruff/format and whole-file AST checks pass without reformatting. The
original matcher and remaining module AST are conserved after removing the two
explicit changes; source hash/mode endpoints pass. This is focused qualification,
not a fresh aggregate repository result. Exact commands, grants, split old/new
results and source identities:
.work/qualification/native-pull-presence-20261015/REPORT.txt;
SHA256 0bd52eff1e8559402b50f6fece7ec69d95de667543ea4eac0070ebfba986cea4.

Current full unit run exposes a network-fixture boundary (2026-10-15)
-------------------------------------------------------------------

The maintained offline make test/unit command ran once at HEAD 7af8965, actual
handle 32847, from 14:47:13Z to 14:59:12Z. It reports 363 tests in 715.490s,
with eight failures and twenty errors, all in tests/test_network_cancellation.py.
These totals include subtests, not twenty-eight distinct methods. ResourceWarnings
remain in the raw stderr. All tracked tools/tests hashes compare equal across
the run; concurrent repository-check edits were outside the unit input mounts.

The failing scenarios stop before their intended CID/receipt cases: diagnostics
show pinned-image admission rejection, while fixture event/readiness files never
appear. Owner diagnosis and repair qualification are separate pending work; this
run proves neither those cancellation cases nor whole-suite readiness. No repeat,
package installation or scientific execution is claimed. Exact command, source
endpoints, timestamps, raw output and terminal result:
.work/qualification/foundation-current-unit-20261015/REPORT.txt;
SHA256 2c2f3772e6da91d784387e6e55079a7df89ba5714f253bd23c343e081e7f3758.

Fresh dependency metadata and inherited installer findings (2026-10-15)
---------------------------------------------------------------------

One explicitly interface-selected, contained metadata scan (actual handle 7077)
returned zero. Its 138 approved URLs returned HTTP 200 from 14:56:51Z to
15:00:41Z, retaining 2,287,530 response-body bytes. Redirects were refused before
contact; the offline inventory and exact request plan were hash-bound and not
rewritten. This acquired metadata only: no resolution, package download, install,
build or scientific execution occurred. No failed attempt or restart occurred.

The applied 59 lock versions again have zero returned PyPI advisory entries.
Inherited base pip 25.0.1 has twelve alias records for six CVEs, with the exact
IDs, fixed versions and primary references now in requirements/README.md. The
source is https://pypi.org/pypi/pip/25.0.1/json, queried because this installer is
inherited from the pinned base rather than represented by the applied lock.
No complete affected-version ranges were invented from fixed-version fields.

Python 3.12's PEP706 behavior addresses the stated tar-fallback case. Maintained
--no-index and --disable-pip-version-check controls constrain the malicious-index
and update-check cases. They do not fix archive ambiguity, wheel extraction or
entry-point path defects. Pip writes the build image filesystem as root, before
final runtime USER65532. Hash-bound inputs constrain selected bytes; they are not
proof that pip's installer defects are repaired. No clean-installer claim follows.

The refreshed Torch advisory still states <=2.12.1 affected and 2.13.0 first
patched; selected 2.13.0+cpu is outside this stated public-version range. Exact
advisory/fix/issue URLs and rationale remain in requirements/README.md. Public
CPython/Uni-Core lists were empty, with limited coverage. All 73 installed Debian
source pages were retained; bookworm vulnerable rows and installed/listed version
differences for glibc/OpenSSL preclude a clean-base claim. Precise installed-version
CVE applicability and reachability remain unresolved. Host/kernel/engine security
was outside this refresh. Historical applied receipt, lock and source inputs are
unchanged. Installation/build adjudication remains separate pending work.

Exact URLs, per-request UTC/status/body hashes, base inventory, findings and
source/grant endpoints are preserved in:
.work/qualification/advisory-refresh-20261015/REPORT.txt;
SHA256 5b4920a04818d819aa3737cde63a7a0f6fb3acb367f7a41e2c01e0fa7338afa6.

Bounded offline qualification after advisory review (2026-10-15)
--------------------------------------------------------------

Decision: continue the maintained packages/image, packages/import and baseline/run
qualification with the existing immutable inputs. This does not declare the
inherited installer or base repaired. The purpose is to qualify this contained
scientific environment, preserving its known advisory findings rather than
silently changing its dependency authority or claiming security readiness.

Reviewed inference_image.sh builds with --network none and --pull=false from a
captured committed context and verified copied wheelhouse. Its Dockerfile uses
local COPY and a read-only wheelhouse bind; there is no build socket, credential,
secret, SSH, remote ADD or additional host bind grant. Pip and custom Uni-Core
setup intentionally write the build image filesystem. Image/cache writes and
owned capture/image-id publication are the expected external effects. Import
is offline, non-root and read-only. Baseline adds read-only scientific inputs and
explicit writable prepared/runs parent directories for its result lifecycle;
these are broader than a selected leaf and remain the actual output authority.

The exact pinned inputs and no-index/version-check controls reduce exposure to
unreviewed selection and network metadata. They do not fix the reported installer
defects or prove every archive/entry-point harmless. No current evidence identifies
an exact selected input triggering those defects; absence of such evidence is
not a security proof. Independent source review found no extra host/network/secret
write authority beyond the intended contained build and result lifecycle. This
adjudication authorizes that bounded qualification, with all known pip/base
findings retained; it makes no deployment or complete security-readiness claim.

Network cancellation fixture follows the native CLI boundary (2026-10-15)
------------------------------------------------------------------------

The failed full unit run exposed a stale fixture, not executed CID scenarios.
An exported env shell function no longer intercepts the native owner's terminal
exec. Its old positional parser also predates explicit --config. The fixture
now uses the existing test_docker_client.py precedent: a symlink targets executable
read-only test source, whose CLI dispatch execs the finite Bash engine grammar.
Scratch stays noexec and the CLI PID survives. Exact --config/--host operands are
admitted before the unchanged operation cases; production source is unchanged.

Current actual-cancellation handling intentionally avoids starting a diagnostic
publisher. Three old refusal-text assertions become exact quiet-output checks;
status 143, attach retirement, admitted-ID removal, refusal of malformed identity,
ordering and no-start assertions remain. An unexecuted TERM-marker proposal was
rejected in review: numeric creation cancellation kills its client immediately.
The exercised stimulus instead writes exact CID/stdout before holding create
unfinished. The test independently checks those bytes and no-start state before
its sole parent TERM. It tests published-but-unreturned identity recovery, not
publication after cancellation or an invented independent daemon actor.

Actual handle 96873 ran all eight methods in 32.709s: seven passed. Four valid
LF/EOF subcases of the remaining method failed only its final scratch-absence
expectation, after their paired bytes, status, removal and no-start checks passed.
Cancelled create is nonzero and retains private failure evidence even when known
containers were removed. The correction requires a nonlinked mode-0700 directory
and unchanged raw CID/stdout after cleanup. Actual handle 39294 passed that method's six
subcases in 6.627s; the seven earlier greens were not repeated. Both formatter
runs pass pinned Ruff/format and whole-file AST equivalence without byte changes.
Final test SHA ba563975de84dd43013aaf51a4d9355d75e7bc0201ca4423d0e0594e08be4ed1,
mode 0755, matches the executed file; all seven scoped source/mode endpoints pass.

All intermediate proposals and the failed epoch remain preserved. This repairs
the focused fixture cohort; a current complete unit/repository run remains open.
Precise commands, actual terminal receipts, scopes and retained limitations:
.work/qualification/network-cancellation-fixture-20261015/REPORT.txt;
SHA256 e48862a75f8c65b02a9f5258aba82b108e3672639e9543bdc3da8be0aaed66ee.

Current-lock image build/import and failed scientific preflight (2026-10-15)
-------------------------------------------------------------------------

After the recorded advisory adjudication, maintained packages/image returned zero
on actual handle 26478 and published observed immutable image
sha256:5e0d01677237c3127271f47a6e918f3c7fb7f6b53ffa2f6f69df4b48d9d0674f.
Maintained packages/import returned zero on 41524. Both were offline. The previous
image record and original scientific reference remain preserved. No dependency,
upstream source or gitlink change was made.

Fresh baseline/run used RUN_ID=foundation-current-lock-20261015, LABEL_ATOL=0.0001,
ATOL=0 and RTOL=0. Actual handle 89667 returned two. H preflight rejected task
uninmr because the registry was empty, before model prediction. The failed run,
inputs, attempt and failure.log are retained; this proves no H/C repeat or
64-value comparison. All scoped runtime-source hashes stayed unchanged across
these phases; the concurrent network-test repair was recorded separately.

A single contained read-only diagnostic (33497, zero, 15:20:17–15:20:19Z) explains
why import success was insufficient. Package root uninmr was root-owned0755 with
readable0644 files, while its tasks/data/models/losses directories were root-owned
0700. Runtime UID1000 received PermissionError traversing task files. Python loaded
empty namespace packages with no __file__, leaving the task registry empty even
after the pinned parser imported the user module. Repeating that import remained
memoized and did not fix discovery. Exact maintained H arguments reproduced the
parse failure; no checkpoint/model/scaler/LMDB objects were loaded in this probe.
The larger parser probe was the only executed diagnostic; a reduced alternative
remains unexecuted. Reconstructed driver argv is identified as source-derived,
not an observed exec trace.

The ownership chain is the native capture's umask077, plain mkdir-p in shared
copy_git_blobs, then Docker COPY preserving root-owned nested directory modes.
The repair belongs in source materialization, with declared accessible execution
directories and private outer capture preserved. Parser/import workarounds and
upstream edits would leave the cause intact. A rebuilt image and fresh run ID
must qualify the repair; the existing failed run cannot be overwritten.

Independent review checked actual phase results, source bindings, raw filesystem
and namespace evidence, and preserved predecessor/reference identities:
.work/qualification/scientific-current-lock-20261015/EPOCH-1-REPORT.txt;
SHA256 8a509cbe47d6c2875d4f81a7f6029774007a7c8ca0fc22c46ac08231be5596cb.
.work/qualification/scientific-registration-diagnostic-20261015/REPORT.txt;
SHA256 33669f6ab6a16ea28d9dededd737d9a0895a9197144f3c5c1d8eb38d605bb9d2.

Captured-package fixture retains inherited preflight admission (2026-10-15)
-------------------------------------------------------------------------

During directory-mode qualification, the two inference capture consumers passed,
but the existing captured-package consumer timed out at its unchanged eight-second
limit (30300: three methods, 9.990s, one error). The log did not retain a phase
timeline, so the exact timeout phase remains unattributed. This failed epoch is
preserved; it is not dismissed as load or a production-helper failure.

Independent source review found a separate concrete fixture-scope drift.
PackageInputCaptureTests replaced its superclass's exact pinned-pair preload shim
and delegated non-run operations to the real controller. The subclass now saves
that inherited shim and overrides only captured-worker execution. Non-run commands
reuse the original strict preload boundary and check-interface delegation; no
policy copy, broad success fallback, production change or deadline increase.
Every original test method and assertion remains unchanged.

Only the failed consumer was repeated after this fixture correction: actual48693,
one method, 6.600s, zero. The two earlier inference greens were not repeated, and
no fresh combined three-method green is claimed. Single-file Ruff/format and
whole-file AST checks pass without reformatting. The three pending directory-fix
owners stayed byte/mode-identical; four scoped source/mode endpoint pairs pass.
The fixture correction qualifies its intended scope, not the precise old timeout
cause. Exact split epochs, commands, source identities and limits:
.work/qualification/materialized-source-directories-20261015/REPORT.txt;
SHA256 8953e6a34164a48caa44736613bb45c5902bf3d4a8b969e522b4f9d5b3b36ea6.

Declared directory permissions for materialized source (2026-10-15)
------------------------------------------------------------------

Shared copy_git_blobs now scopes umask 022 to its existing mkdir-p command. Git
owns leaf file modes, not directory permissions. Newly created source ancestors
need mode 0755 so Docker COPY preserves readable/traversable Python packages for
the non-root runtime. Existing private capture roots stay 0700; file bytes, Git
executable bits, inventories, mutation admission and cleanup behavior are unchanged.
No recursive chmod, upstream edit or parser/import workaround was introduced.
The actual Dockerfile consumer and private-root distinction are explained in place.

Before: the strengthened capture test fails on six observed directory modes with
the old helper (94781, one method, 0.994s, only expected 0700-vs-0755 subfailures).
After: the same capture method and original executable-file-mode consumer pass
on the corrected helper in handle 30300. Their existing outer mode-0700/UID/leaf hash/mode,
worktree mutation and retirement assertions remain. The finite build fixture adds
only an observed directory-mode map; the test includes containers/inference to
catch intermediate-parent masking as well as its copied uninmr package. It has
only uninmr/infer.py, so it does not claim real tasks/data/models/losses discovery.
That boundary still requires the rebuilt image and fresh scientific run.

The shared package consumer's original timeout and separate fixture correction
are recorded immediately above. Only that failed consumer was repeated (48693,
one method, 6.600s, zero); no fresh combined three-method green is claimed. Pinned
Ruff/format, whole-file formatter AST equivalence, Bash syntax and scoped source/
mode endpoint checks pass. Helper SHA256 79a6b9be7a6819fdcbda168d18f66833e89b322f01ae5f5b846e185811701a2f
matches the qualified source. Precise source restoration proofs, commands,
old/corrected epochs and limitations:
.work/qualification/materialized-source-directories-20261015/REPORT.txt;
SHA256 8953e6a34164a48caa44736613bb45c5902bf3d4a8b969e522b4f9d5b3b36ea6.

Rebuilt source discovery and exact historical CPU repeat (2026-10-15)
-------------------------------------------------------------------

At committed source 5b49b4357124c51499febf84756b2b86343f8b76, maintained offline
build handle 94835 and import handle 68377 returned zero. The observed new immutable image is
sha256:935254b0c70f6aa8e8f7b0d54d64eec391da5dfc26a05c2c9cbbd13125570b85.
The earlier failed image and run remain preserved. No dependency version,
prepared fixture, reference, upstream source or gitlink was changed.

Fresh RUN_ID=foundation-current-lock-20261015-mode-fixed returned zero on actual
handle 47851. Both real model preflights and H/C inference succeeded: 42 H and
22 C predictions, each repeated twice with maximum absolute difference zero.
The receipt records 25.594s, 15:43:55.896Z–15:44:21.490Z. This earns actual
non-root package discovery beyond the finite directory-mode fixture. Labels
retain tolerance 0.0001; repeat ATOL/RTOL remain zero.

One independent contained comparison (tool receipt 0c1efb, zero) matched all 64 unique
historical-reference rows in both repeats: 128 exact source-index/token/label/
prediction comparisons, maximum difference zero. It checked model/prepared/
artifact identities, current tools and complete-linked preflight/verification/
log/raw-output hashes without deserializing model output pickles. Current lock
and historical reference lock identities are reported separately; normalized
lock bytes differ, not the selected package versions. Reference, prepared
provenance and preserved failed-run key records remain unchanged.

This is bounded fold-0 CPU float32 qualification, not five-checkpoint ensemble
accuracy. Scaler warnings, pending release-log/configuration and target-unit
reviews, known inherited pip/base findings and all failed epochs remain. Runtime
cgroup facts match the maintained limits; no fresh running-container inspection
or global unit/repository readiness is claimed. The broad suites are separate.
Precise phase commands, actual results, source endpoints and limitations:
.work/qualification/scientific-current-lock-20261015/EPOCH-2-REPORT.txt;
SHA256 827178ee0fe72bd39961e9d5bcc9aef40c5e81edfc0abc074bb405df7b69adfa.
Independent reference comparison:
.work/qualification/scientific-current-lock-20261015/comparison-mode-fixed/REPORT.txt;
SHA256 9846f0869170ea11210528f086148805411bc85f6c95c2f6a53d2fed897039d7.

Aggregate qualification after source-directory repair (2026-10-15)
----------------------------------------------------------------
At source HEAD 5b49b4357124c51499febf84756b2b86343f8b76, both maintained
contained aggregate suites finished red. Unit handle 45044: 363 tests in
764.658s, three failures, no errors. All three failures are subcases of the
post-removal handoff cancellation fixture: HUP fails before signal delivery;
INT/TERM subsequently fail no-dispatch assertions. The marker's original raw
bytes were not retained, so an empty-marker race is a source diagnosis, not
an observed fact or proof of a production cancellation failure.

Repository handle 67049: 430 tests in 494.226s, four failures and 13 errors
(including subcases). Ops defaults passes. Remaining cohorts are the Python
operator-default property, inference-client test teardown, and package-client
pin/identity/blocked-report fixtures. No failure is waived. Scientific success
above does not establish aggregate readiness. Both raw failed epochs remain.

Independent review checked raw summaries, failure locations and 146 source
hashes at each endpoint. The only intervening commit, 20ef4d3, changed this note.
Precise commands, logs, source checks and limitations:
.work/qualification/foundation-after-source-modes-20261015/REPORT.txt;
SHA256 958f58ef1df37cec6f86b82e2729ac281e1bc512baa5173f22d6f83a182ae7fa.

Wrong-pin fixture reaches the intended rejection (2026-10-15)
------------------------------------------------------------
Before: the changed-pin test's blanket mktemp fault returned96 while creating
native preflight control scratch, before its expected pin rejection97. After:
only the exact preflight operation/two-argument scratch request delegates real
mktemp; every other allocation still records the original marker and fails96.
The original97, cause, quiet stdout, no engine/config/package allocation,
no controller and unchanged stage assertions remain.

Independent dirty review passes. Actual contained handle48513 returns zero:
one method,0.967s; pinned Ruff/format and whole-module AST restoration pass.
Source/mode endpoints match. This fixes test phase targeting, not production
pin policy, and does not claim a whole package suite pass. Exact sources,
commands and retained logs:
.work/qualification/package-pin-fixture-20261015/REPORT.txt;
SHA256 85cf29f54b3ad22a53e2544f0d4c4aedefd0f674cf6c7ca2dcafeba7fbed0f4e.

Retained client preparation receipt in fixture teardown (2026-10-15)
-------------------------------------------------------------------
Before: six aggregate subcases passed their behavioral assertions, then failed
strict parent rmdir because successful preparation retained preparation.log.
After: the two before-effect teardown blocks unlink that exact owned receipt
before their unchanged config/parent rmdir. Missing expected receipts and
unexpected siblings still fail; no recursive deletion or missing_ok was added.
Production cleanup and every status/signal/effect assertion remain unchanged.

Independent dirty/raw-evidence review passes. Actual contained handle52167:
two methods,12 status/signal/effect cases,11.249s, zero. Ruff/format and43 public
source endpoint hashes pass. This is fixture teardown qualification only;
aggregate readiness remains unproven. Exact source, commands and results:
.work/qualification/inference-client-retained-preparation-20261015/REPORT.txt;
SHA256 33cb8f0a21105dddbd01afcb2e6d24249b2684aaaf0673396e95794500577a25.

Atomic handoff observation and signal-case isolation (2026-10-15)
----------------------------------------------------------------
Before: the fixture exposed its path file before printf completed, used a
0.25-second release window and deferred failed-case cleanup until method exit.
After: atomic rename publishes the complete typed path; an independent receipt
must agree; the caller waits for cancellation at the same production handoff.
Each subcase retires its actual Popen before reusing observations. HUP/INT/TERM,
129/130/143, quiet output, physical removal, no-dispatch and original bounds stay.

Independent review passes. Actual92644: one method/three signal cases,4.007s,
zero. Initial sandbox socket denial ran no tests and remains recorded. Ruff
found one quote-format difference; contained formatting passed whole-file AST
equality and both style checks. Final source2ec7325d differs only in Python
quotes; injected Bash bytes and runtime semantics are identical, so no runtime
repeat was needed. Production code is unchanged; the old raw marker was not
retained, so this does not prove the precise cause of its historical failure.
Exact commands, failed/style epochs, final bytes and limits:
.work/qualification/baseline-handoff-fixture-20261015/focused/SUPPLEMENT.txt;
SHA256 81805c19c23f681f5f5a302c3b06eda490bd1f5187f244eafa81f52ca3fc3539.

Remove unused control interceptors from package observers (2026-10-15)
--------------------------------------------------------------------
The identity-admission and blocked-mismatch-stderr tests now use real /bin/rm
and /bin/mv, following their existing composition-test precedent. Neither test
requires those control faults; the mismatch test independently admits its live
reporter by exact argv and pipe-write wait. Review-stdout keeps its observer.
All original engine ordering, image/config/publication, signal/no-drain,
retirement and rescue assertions and time bounds are unchanged.

Independent source/evidence review passes. Actual58752: two methods including
three mismatch signal cases,6.487s, zero; owned-file Ruff/format and scoped
source/mode endpoints pass. The prior aggregate's exact timeout phase remains
unattributed; no whole-module or aggregate green is claimed. Precise sources,
commands, outputs and limitations:
.work/qualification/package-observer-fixture-20261015/REPORT.txt;
SHA256 8eef41338fe1a7d86fbae46a58c6871a8e5a3fa70c71721806a705d4e91d9ff5.

Review-stdout observer qualification remains red (2026-10-15)
-----------------------------------------------------------
The proposed fixture scopes its ready card to the exact Review program and
moves existing authority-gated rescue into each signal subcase. Independent
source review passed, but actual contained21631 returned1: one method,24.074s,
three errors. Each case missed its report card at the existing five-second
bound, then its existing rescue communicate timed out after three seconds.
No Review writer was admitted and no intended cancellation signal was tested.
Ruff/format and source/mode endpoints passed; those are not runtime success.

The exact blocked phase remains unknown. A separate single-case, contained
observation is required before changing this proposal; no deadline increase or
production diagnosis is justified by these traces. Failed commands/logs/source
remain immutable; this is not a whole-module or aggregate pass:
.work/qualification/package-review-observer-fixture-20261015/REPORT.txt;
SHA256 3ab284e8c2558a9180ca42708bd39444f9e342cd60ee99306580741c4f496ae7.

DNS answer accumulation has an explicit local contract (2026-10-15)
------------------------------------------------------------------
Before: addresses.setdefault(owner, []) was an applicable generic-default
finding. After: one adjacent existing-mechanism annotation records its purpose:
each response-local bucket accumulates received A records, without inventing an
absent answer. A new real wire-parser test checks zero answers and interleaved
repeated/distinct owners, exact order and independent buckets; sockets are mocked.
Production runtime AST and every old test body are unchanged.

Independent source review passes. Actual formatter01017d and qualifier ee3902
return zero: two methods in0.007s, two-file Ruff/format, runtime/raw-candidate
conservation and exactly this one applicable finding removed. All other findings
remain; no detector or inventory changed, and no network or aggregate pass is
claimed. Precise source/proof targets, commands, byte endpoints and results:
.work/qualification/proxy-dns-record-accumulation-20261015/REPORT.txt;
SHA256 d9ba05607e746f0740f24323a47a0ef787eb6d00f495a9bd9206351fd4bc213e.

A missing finite worker result cannot certify success (2026-10-15)
-----------------------------------------------------------------
Before: the engine double's WORKER_STATUS getter supplied0 when its result field
was absent. After: LauncherFixture explicitly owns ordinary0; per-call additions
own faults; worker attach requires the field. The new proof checks ambient37 is
ignored, explicit37 is preserved, and deleting the field fails1 with its named
KeyError, leaving registry bytes/inode unchanged. Existing methods are unchanged.

Independent source review passes. A getter-only predecessor counterfactual
actually fails at the missing-result assertion (one method,0.545s,1!=0), after
its positive checks pass. Patched qualification95147 passes two methods in1.523s,
plus three-file Ruff/format and exact source endpoints. An earlier OCI mount
failure125 ran no tests and remains retained; the corrected runner changed only
its comparison mount/receipt paths. No production, model or aggregate pass is
claimed. Exact sources, old/new results and commands:
.work/qualification/finite-worker-result-20261015/REPORT.txt;
SHA256 0bd7b5e6fd29c734659b8758cc40344195fdcf8ac357e5aeab7d5e5bc59f0c79.

The native admission helper has a documented checker profile (2026-10-15)
------------------------------------------------------------------------
One signature annotation records the existing network-none, tmpfs-256-MiB and
memory-2-GiB admission profile, with explicit per-lane overrides. Its proof points
to the existing test that first admits unchanged argv using all three omitted
defaults, then rejects added authority and a missing pull policy. Review corrected
an initial reference that exercised numeric overrides instead of omitted bounds.

Actual contained static307ec9 passes Ruff/format, whole-module and existing-proof
AST equality, raw finding parity and exactly three signature applicability
removals. No behavioral test was repeated; the existing proof passed in the
recorded430-test epoch. Body findings, strict operator-input rules and all other
findings remain. Exact bytes, proof reference and static-only limits:
.work/qualification/native-admission-profile-contract-20261015/REPORT.txt;
SHA256 77ff4dca0d9d7ae4d68cefdbf2c72a016eb97a3629da5bbfb9ee0b6517c300bc.

Review observer qualifies after removing unused control wrappers (2026-10-15)
----------------------------------------------------------------------------
The single-case diagnostic67618 observed stage-controller completion publication:
the controller-returned card existed, status.pending held0, final status was
absent, and its child was the Python mv fixture. Its wchan0 does not prove a
pipe block or the delay's cause. Review had not started. Exact private record:
.work/qualification/package-review-observer-fixture-20261015/diagnostic-HUP/REPORT.txt;
SHA256 4fdf1ee19d106e42c5f54b5f6414f662512884ad2d4e75938b789848b49549cc.

The fixture now directly execs /bin/mv for non-ready moves, which have no fault
or observation duties; the Review case uses real /bin/rm with no removal fault.
Ready faults remain, and only the exact Review program publishes its atomic
observer card. Existing gated rescue runs per case before card reuse. All original
signal/status, actual pipe-writer, no-drain, retirement/config and time assertions
remain; production code is unchanged.

Independent code/raw review passes. Focused77753: one method/all three signals,
17.578s, Ruff/format/endpoints zero. Broader15985: all22 package methods pass in
161.863s at frozen8f47eab plus sole fixture overlay2fe26c8e. No further repeat is
needed for this shared helper. This is not an aggregate pass or retrospective
proof of the old delay's cause. Failed21631 and diagnostic67618 remain immutable.
Exact sources, grants, commands and old/new epochs:
.work/qualification/package-review-observer-fixture-20261015/full-module-v3/REPORT.txt;
SHA256 6506c23570a8d04e311ff3f5ccb6d753b6c0be44da655061f57e2b47b5d51806.

Missing proxy inspection evidence cannot certify readiness (2026-10-15)
---------------------------------------------------------------------
Before: missing proxy-state/status fields manufactured true/0. After: the fixture
constructor owns ordinary true/0 and the engine requires both fields. Explicit
false0, true37 and malformed-state0 remain literal faults. Output ordering stays:
missing state fails1 without stdout; missing status emits trueLF then fails1.
Production requires status0 and exact true, so partial stdout cannot admit it.

Independent source/raw review passes. A getter-only counterfactual actually
fails both missing-field assertions (one method,1.631s,two1!=0 failures,no errors)
after ordinary/fault checks. Patched77578: two methods in4.941s, including existing
readiness-distinction integration, plus three-file Ruff/format and exact endpoints.
Tests also preserve registry bytes/inode and reject ambient scenario selection.
No old method, runtime grammar, validator or production behavior changed. Exact
source, counterfactual, commands, preserved output order and limits:
.work/qualification/finite-proxy-inspection-result-20261015/REPORT.txt;
SHA256 fc6f646c0f6c9768b2f4b10694d9907621702c0f16c0654927e9334d726e9b15.

Current full unit epoch: one different birth-seam failure (2026-10-15)
--------------------------------------------------------------------
Maintained contained29760 returns make2:363 tests in719.536s, one failure,
no errors. The repaired baseline handoff passes. The sole failure is now
DockerClientTests.test_cancel_during_birth_joins_anchor_without_dispatching_docker:
Path(directory).exists() is true with empty stderr, after status143 and anchor
retirement pass. Its final no-dispatch assertion was not reached. Raw birth-marker
bytes were not retained, so neither a partial marker nor a production cleanup
regression is proven. All61 scoped unit inputs remain byte-identical at terminal;
orthogonal repository fixtures were outside its source mounts.

Independent raw/source review passes. Preserve this failed epoch before any
birth-fixture correction; no waiver, timeout increase or unit-green claim:
.work/qualification/foundation-unit-after-fixture-repairs-20261015/REPORT.txt;
SHA256 e9d8fc838f264f1ac810e14163960f03d2bd6b07af9b89c8446693f282b8a2da.

Current repository aggregate isolates the defaults property (2026-10-15)
-----------------------------------------------------------------------
At frozen5cb479f, maintained contained64504 returns make2:433 tests in435.759s,
one failure and no errors. The sole failure is the Python operator-default
property; all other methods complete successfully. Its exact remaining
expressions/signatures/handlers are retained, with no waiver or inventory change.
This is not repository green. The separate363-unit birth-handoff failure remains.

Independent raw/source review passes. All150 tracked parent-source hashes and
modes, plus entry/terminal HEAD, match; upstream gitlink3ba8b9c is separately
recorded. No public source or Git mutation occurred during the run; private
birth probes used separate frozen snapshots. CI remains deferred. Exact source,
commands, full diagnostics and endpoint proofs:
.work/qualification/foundation-repository-after-fixture-repairs-20261015/REPORT.txt;
SHA256 49608d3217eee9ab965da8c2ba6a934452dd9df1b50bb2dc4b0431470b60938f.

Shared finite engine completion status has one owner (2026-10-15)
----------------------------------------------------------------
Before: the terminal engine getter manufactured0 when shared completion status
was missing. After: the constructor explicitly owns ordinary0; the terminal
consumer requires it. Ambient37 cannot choose the ordinary case; explicit37
remains authoritative. Missing status fails1 after authentic image output and
attempt recording, preserving those effects and registry bytes/inode.

Independent source/raw review passes. Getter-only counterfactual66735 verifies
one intended missing-status failure (0.376s,1!=0). Patched41898 passes all19
metadata methods and the existing global7 import/private-output companion:
20 methods in11.142s. Proper-path Ruff/format and exact source/mode endpoints pass.
The first formatter's wrong-path lint failure ran no tests and remains retained;
validation reused byte-identical output without changing repository lint rules.
Build-specific controls and branch-local status owners are unchanged. Exact
sources, old/new results, effects and limits:
.work/qualification/engine-status-authority-20261015/REPORT.txt;
SHA256 9fff1ba0d413d830d6c0776d4b851737b961a492f6cbf598e3b8685270a2be13.

Controlled ready-publication lifetime counterexample (2026-10-15)
---------------------------------------------------------------
A reviewed private probe holds the actual ready publisher after successful real
rename, validates its PID/parent/group, owned anchor and exact canonical receipt,
then sends the original parent-only TERM. Root96542 returns1: one method,2.248s,
failing the unchanged configuration-removal assertion. Status143 and anchor
retirement assertions pass; retained facts show retirementfalse and no client
removal. No Docker dispatch occurred. Four scoped source/mode endpoints match.

This proves a controlled published-ready ownership gap: the foreground publisher
can be interrupted before returning to the anchor's ready compound, whose failure
branch exits before the parent's later retirement confirmation. Retention under
unconfirmed retirement remains correct. It does not establish the historical
full-unit failure's cause. No production fix or green claim is included here.
Exact frozen sources, commands, raw facts and failed assertions:
.work/qualification/unit-birth-handoff-fixture-20261015/ready-publisher-probe-v1/REPORT.txt;
SHA256 d2efd2d5ee60fedd70cadf2c205cce2905c8bb193c10081221ceb1526099d74c.

Finite build identity is supplied by its producer (2026-10-15)
-------------------------------------------------------------
Before: missing BUILD_RESULT manufactured a valid immutable identity inside the
engine. After: the constructor supplies the ordinary identity; its consumer
requires the field only when producing identity output. An explicit BUILD_BYTES
scenario does not consume or require it. Global37 and build-specific7/0 status
precedence, literal empty/multiline faults and existing build-evidence effects
remain unchanged. Missing consumed identity fails1 with no identity stdout.

Independent source review passes. Root99869 passes all20 metadata methods and
two existing build-publication/identity-rejection companions:22 in14.526s;
Ruff and source/mode endpoints pass. The initial private formatter lost executable
mode and the first qualification stopped at EXE001 before tests; both receipts
remain. Restoring only the private engine's executable mode changed no bytes or
lint policy. No aggregate-green claim or upstream change. Exact sources/results:
.work/qualification/build-result-authority-20261015/qualification/REPORT.txt;
SHA256 60bc110b60238a5e9d91df58bc504ffd60b8613bcde0bdb0d389fa9b622e4d3d.

Keep a published ready anchor alive after publisher failure (2026-10-15)
----------------------------------------------------------------------
Before: ready could become visible before its foreground publisher returned;
interruption could then make the ready compound fail and exit the admitted
anchor. After: a failed publisher with the canonical own-PID ready receipt
notifies the parent through existing USR1 and stays held without client dispatch.
The parent still owns signal cause, KILL, join and retirement confirmation.
Missing/noncanonical ready keeps the prior failed-publication behavior. Ignoring
signals only within this terminal branch protects its validation and held life;
repeated signals during validation are source reasoning, not a tested claim.

The original birth fixture now publishes an atomic typed marker and holds PID
capture until its actual cancellation trap runs, preserving143, cleanup,
no-dispatch assertions and5s/6s observation bounds. A new regression covers both
real parentTERM during the successful publisher's post-rename hold and ordinary
publisher29 after rename. Both require retired actors, configuration removal
and no client dispatch. Generic control-publication wording remains truthful
for ready and completion failures; exactly three existing expectations adapt.

Independent dirty-source review passes. Root29987 passes seven focused methods
in25.852s, including both new cases and existing pre-effect/release/terminal
failure and native/controller diagnostic consumers. Full-AST formatter parity,
Ruff, shell syntax and source/mode endpoints pass; final live bytes match those
executed. Historical raw failures remain preserved and unexplained; this repair
addresses the earned controlled race. Released controller UNKNOWN behavior is
unchanged. The maintained full unit suite is running; no broad green claim.
Exact sources, counterexample provenance and qualification:
.work/qualification/unit-birth-handoff-fixture-20261015/ready-publication-repair/REPORT.txt;
SHA256 3d490c74fd93823e77452410507aa8d889a7827499fb7e978b68aff001259222.

Removal outcome must exist before simulated deletion (2026-10-15)
----------------------------------------------------------------
Before: missing REMOVE_STATUS authorized registry deletion and reported0. After:
the constructor owns ordinary0; both consumers require it. Unknown identity still
rejects97 first. Ordinary removal really removes one admitted identity while
preserving another. Explicit37 and missing status retain exact registry bytes
and inode; missing input fails1 with its KeyError. Five actual attempts remain
recorded. No new status grammar, CID or log policy is introduced.

Independent dirty-source review passes. Root44887 passes all21 metadata methods
and the existing worker7/removal9 dual-failure companion:22 in14.159s. Full-AST
formatter parity, Ruff/format and source/mode endpoints pass; formatted input
and final live bytes agree. Executable mode is preserved throughout. The full
unit suite remains running against its unchanged separate source scope; no
aggregate green claim. Exact inputs, commands, effects and limits:
.work/qualification/removal-status-authority-20261015/qualification/REPORT.txt;
SHA256 68ada5d405f494323bcbbe501dcde74fe2bc20d9106e9c5b806ae92854064c86.

Two explicit quality classifications keep their contracts (2026-10-15)
---------------------------------------------------------------------
The Make helper's colon test selects a literal owner or clears stale ownership;
its None result does not invent an owner. A new negative fixture inserts a
nonrule before a later tabbed invocation, so failing to clear ownership cannot
pass. The source helper's required production_only choice selects tools versus
all authored roots; both include future inference modules. A new isolated proof
checks exact recursive results, unrelated/text exclusions and required-keyword
omission. Two immediate local annotations name these specific proofs.

Independent dirty-source review passes. Root82279 passes17 methods in0.096s,
including the existing14 applicability fixtures. Both owner runtime ASTs and
all82 authored files' raw210 findings remain unchanged (labels/snippets/order;
only comment line shifts normalized). Exactly these two applicable findings
are admitted; all other applicable findings remain. Detector bytes, signatures,
inventory and policy are unchanged. Ruff/format, full formatter AST parity and
source/mode endpoints pass; live files equal executed files. Frozen base defe85f
excludes orthogonal fixture edits; this is not a current global count or green
claim. Exact inputs, commands and results:
.work/qualification/quality-selection-contracts-20261015/REPORT.txt;
SHA256 a25dae4ccee7055405b90005f7cb283a21af13be62125005fee296af905376da.

Maintained full unit suite passes after the ready repair (2026-10-15)
-------------------------------------------------------------------
Root38954 runs maintained make test/unit and returns0:364 tests in728.477s,
no failures or errors. Both the deterministic birth handoff and new two-case
post-rename publication regression pass, along with every other unit method.
This supersedes the failed363-test epoch as current unit qualification; that
failed epoch and the original unexplained failure remain preserved.

Independent raw/source review passes. All61 scoped Makefile/tools/tests/containers
hashes and mode endpoints match, and current scoped bytes equal committeddefe85f.
Entry HEAD06c4e46 had the reviewed four unit/source overlays still dirty; later
commits changed repository-check files and notes outside the unit mount scope,
then committed the identical unit bytes. This is a scoped-source result, not a
claim of unchanged whole HEAD or a clean entry checkout. No tests were rerun.
The repository defaults property remains open; this is not foundation completion.
Exact maintained command, output, source bindings and historical limits:
.work/qualification/foundation-unit-ready-publication-repair-20261015/REPORT.txt;
SHA256 8f2c1b3c364fba0b1263d56756d87cb03e6c73a693c8179540c1f9c521a54602.

Three helper defaults express local test contracts (2026-10-15)
--------------------------------------------------------------
The guard detector ordinarily requires a module guard; its explicit package-marker
option permits only empty/docstring-only markers. The acquisition helper ordinarily
captures real stderr; its full-pipe option creates an actual unread-full-pipe
stimulus. The inference assertion helper ordinarily expects observed configuration
absence; explicit False requires retention. That expectation is not a retirement
fact and cannot authorize cleanup. Three signature-local annotations name existing
omission proofs; existing explicit-option companions complete their review.

Independent dirty-source and raw-result review passes. Root76038 passes five
existing omission/override methods in8.554s. Whole-file ASTs/modes and all17 scoped
raw findings remain identical after normalizing only line numbers. Exactly these
three signature applicability findings are admitted; all other scoped findings
remain. Ruff/format and final source/mode endpoints pass. No assertion, signature,
body, raw collector or applicability policy changed. Timeout10 remains outside
this review, and no current global count or aggregate green is claimed.
Exact sources, commands, meaningful witnesses and limits:
.work/qualification/helper-signature-contracts-20261015/qualification/REPORT.txt;
SHA256 1ac93cdf0b39623f05d21dc49f5af8bbd98f62d02edd7a4f5294a03a44377fdb.

Fresh defaults inventory after the reviewed contracts (2026-10-15)
-----------------------------------------------------------------
At clean committedcea9ffb, root23133 performs an inventory-only contained run:
82 authored Python files,208 raw findings,193 applicable findings. These are
findings requiring meaning review, not193 established defects or a test pass.
Exact ordered raw/applicable lines and both counts for every path, including
zeroes, are retained. No filter, line normalization or new exception was added.

Independent final raw/source review passes. All150 tracked-blob snapshot hashes
and mode endpoints match; live maintained inventory/policy bytes match the
snapshot. Upstream gitlink content is excluded by the existing authored-source
policy. The new unit regression's expected143-if-hold-else1 expression and the
proxy-log status getter remain in both collections, pending their separate
adjudication. No Python collection or tests ran on the host, and no aggregate
qualification is claimed. Exact source, collector, command, outputs and limits:
.work/qualification/current-python-default-inventory-20261015/REPORT.txt;
SHA256 571b419202d023c6c3daf5ffce3fd92faf871bf7180878d97005fb13fe5b6f3f.

Log retrieval requires an outcome after emitting its text (2026-10-15)
---------------------------------------------------------------------
Before: missing PROXY_LOG_STATUS reported0 after writing private log text. After:
the constructor owns ordinary0 and the consumer requires the result. Explicit37
remains a literal fault. Missing status fails1 with its KeyError after preserving
the already-emitted diagnostic prefix. Three actual attempts and registry bytes
and inode remain unchanged. No identity prerequisite or status grammar is added.

Independent dirty-source review passes. Root17705 passes all22 metadata methods
and the existing readiness/log23 companion:23 methods in15.487s. Full-AST formatter
parity, Ruff/format and source/mode endpoints pass; formatted/input/live bytes
agree. The companion retains primary readiness2, secondary log failure23 and its
actual private cause. No counterfactual, failed epoch, collector change or broad
green claim. Exact inputs, emitted effects, commands and limits:
.work/qualification/proxy-log-status-authority-20261015/qualification/REPORT.txt;
SHA256 d5fb3904477a8f2ac64ddeec0236d298d2679e9db1768ff2b2d4d78b62d1caa1.

Finite verb and role selections are classifications (2026-10-15)
----------------------------------------------------------------
Four local annotations record the finite engine's empty-command rejection
sentinel, create role, stored role and start-role selection. These classify
explicit requests; they do not manufacture successful observations. Existing
request-rejection proof now includes empty and unmodeled argv. Existing two-role
lifetime proof now rejects attached proxy and unattached worker starts with97,
the exact cause and unchanged registry bytes/inode. All prior cases remain.

Independent dirty-source and raw-proof review passes. Root15656 passes both
strengthened methods in2.471s. Engine AST, both modes and all16 scoped raw findings
remain identical (only comment line numbers normalized); exactly four named
applicability findings are admitted. Ruff/format and source/mode endpoints pass;
final live bytes equal executed bytes. No ENV/CID rule or detector changed and
no broad argv-validation or aggregate-green claim is made. Exact source/proofs:
.work/qualification/finite-engine-classification-contracts-20261015/qualification/REPORT.txt;
SHA256 23afca77c0eabeab24d08efaac7eeab279bddcda6a34a9cac2b273a2190b7040.

Local contracts can address With contexts and assignment values (2026-10-15)
---------------------------------------------------------------------------
Two real artifact expressions sit inside a With header and a multiline Request
assignment. Reshaping working source solely to place an annotation would obscure
their intent. The existing immediate annotation now selects only With context
expressions or an Assign value by AST containment. One outermost generic candidate
must contain all selected candidates; operator inputs and nested callables remain
strict. Bodies, targets, independent siblings and adjacent statements stay visible.
Other statement kinds retain their prior eligible single-line behavior; this is
only a narrow multiline extension, with no new producer annotations yet.

Independent dirty-source and final raw review pass. Root6604 passes21 methods
in0.116s:18 contract methods plus three existing raw/inventory fixtures. All14
old methods remain, except that the one deliberately supported multiline Assign
case moves verbatim from its former placement-negative tuple to the new positive
fixture. New negatives cover strict inputs, body/target/adjacent spill, lambdas,
siblings and unsupported multiline forms. Raw and other policy ASTs are unchanged.
At frozen160c, all82 inventory paths and every raw207/applicable192 finding string
and order match old/new exactly; these are epoch counts, not current global totals.
Formatter AST parity, Ruff and source/mode endpoints pass; live files equal the
executed formatted files. No repository-wide property pass is claimed. Exact
boundary, old-case conservation, commands and final bindings:
.work/qualification/with-assign-contracts-20261015/REPORT.txt;
SHA256 61e8af4eb822035e72b57d8c90c3723ba27b073d1fa330d1930baa0414fc77dd.

Artifact binary access and exact resume requests (2026-10-15)
-------------------------------------------------------------
Two producer annotations explain existing binary file modes and whole-versus-
Range request selection. O_RDONLY denies writes; O_RDWR permits binary overwrite
without replacing the opened inode. The new I/O method proves those actual effects.
The existing seven-case HTTPResponse proof retains exact request headers at offsets
0/17, content-coding rejection and partial/publication identity. No network transport
or additional supported flags are claimed. Production AST and all prior test ASTs
are unchanged; the only test additions are os and the meaningful I/O method.

Independent dirty-source and raw review pass. Root exec558769 passes both methods
in0.004s. Ruff/format, scoped source/mode endpoints and all11 raw findings match;
exactly two generic applicability findings are admitted. Live files match executed
bytes. This does not establish a current full unit or repository aggregate pass.
Exact source, commands and proof:
.work/qualification/artifact-io-range-contracts-20261015/REPORT.txt;
SHA256 3637b60900a9d7daa6d51b979c26c725700a82cd524da4d082c4ddfc587d6ca5.

Build provenance matters even for comments: containers/checker/Dockerfile:11 and
containers/inference/Dockerfile:13 COPY tools/artifacts.py; the complete declaration
path is containers/inference/image-inputs.txt:7 (the frozen report abbreviates it).
Both image qualifications and scientific evidence require final refresh after
build-input edits. This slice performs no build, acquisition or scientific rerun.

Controller scenarios and fixture observation budgets (2026-10-15)
-----------------------------------------------------------------
Four controller comments explain declared status/hold/budget/result inputs, closed
hold encoding, WNOWAIT observation and expected malformed-completion outcomes.
One shared fixture comment distinguishes its ten-second per-wait observation budget
from launcher deadlines and cleanup. These are local fixture contracts. No behavior,
default, assertion or test identity changes. Omitted ordinary status is consumed by
the delayed-completion companion; the ordinary-status method explicitly supplies
0/143. Nonholding False dispatch has no separate measured proof. Neither four nor
ten seconds is a measured expiry guarantee or authority to retire native clients.

Independent dirty-source and frozen evidence reviews pass. Root53956 passes the
three existing controller consumers and the existing native-failure private-output
consumer:4 methods in13.786s. Whole AST/default/mode conservation, Ruff/format and
source endpoints pass. All12 scoped raw findings retain labels/snippets/order;
exactly seven controller findings plus the shared timeout finding are admitted.
Live2 match executed bytes. No new rescue or full-suite/global-defaults claim.
Original qualification/ remains UNRUN; only qualification-v2 ran. Exact commands,
projection, final bindings and limits:
.work/qualification/controller-fixture-contracts-20261015/qualification-v2/REPORT.txt;
SHA256 0a0e13327cc05cd117dcbc87bd17510ca29495b10db15506c45d8300765ad1a2.

Finite capture composition retains literal inputs (2026-10-15)
---------------------------------------------------------------
Six comment-only dispositions explain captured fixture composition: observed
executable bits select Git leaf mode; closed parent/module rows select declared
paths; omitted run/Make additions provide a neutral overlay; admitted COPY source
shape selects actual leaves; exact mounted argv tokens translate while other
literal verifier tokens remain. Required outcome and mount fields remain required.
These are finite fixture contracts, not general Git/Docker grammar, arbitrary
mapping behavior, exhaustive argv routing or an atomic filesystem capture claim.

Independent source reviews cover the actual integrated candidates. Root53358
passes seven existing consumers in4.842s: executable and committed-source modes,
Git grammar, real frozen-wheel verification, private native failure, ambient input
rejection and literal Make aliases. No new tests were added for declarations.
Formatter changes neither file; Ruff/format and source/mode endpoints pass. Whole
runtime ASTs match. Across82 files, all207 raw labels/snippets/order match modulo
comment lines; exactly six named applicability findings are admitted, retaining
the prior timeout disposition. These are frozen epoch counts, not a current full
repository property pass. Live bytes match executed bytes. Exact inputs/results:
.work/qualification/fixture-composition-contracts-20261015/REPORT.txt;
SHA256 57a14eef312c37b7f221d2990a3909194f469721f88e79c27b2bbe093f38152e.

Ordinary client fixture completion requires its owned status (2026-10-15)
-------------------------------------------------------------------------
Before: int(os.environ.get("FAKE_RUN_STATUS", "0")) manufactured success after
recording a run when its status was absent. After: the fixture constructor owns
ordinary0 and the terminal consumes os.environ["FAKE_RUN_STATUS"]. Explicit19 and
special inspection/held/closed-output branches retain their existing semantics;
unconsumed status is not a prerequisite. Missing status now returns1 with the
precise KeyError, after observed dispatch. The new regression also observes empty
private configuration and actual configuration-parent removal. It claims no
absence of prior effects. No status grammar or environment exemption is added.

Independent actual-source and frozen raw reviews pass. Root73891 passes the new
missing-field method and existing explicit19 plus0/19 removal companions:3 methods
in8.852s. All24 old method identities/ASTs remain, except the two explicit fixture
ownership edits and the added method. Exactly one raw/applicable getter finding
is removed; Ruff/format, hashes and executable modes pass. Live39db95cd equals
executed bytes. No full25-method or ambient-poison runtime claim is made.

The initial private path-list setup error and the first contained mode assertion
are preserved. That assertion stopped before unittest: Git100755 had materialized
as0775 in the baseline projection. V2 restores every recorded Git blob mode;
all300 source byte hashes and the proof are unchanged. No assertion was weakened.
Exact attempts, source bindings and results:
.work/qualification/client-run-status-authority-20261015/REPORT.txt;
SHA256 d5ceeef77fcadea76ea6bb263084c1bcc77fb8abe433990ff0de82c7f5bdf828.

Finite HTTP response declarations and wire expectations (2026-10-15)
--------------------------------------------------------------------
Six comment-only dispositions explain the local Response constructor's ordinary
200/no-fields inputs, its read(-1) rejection sentinel, and the finite wire cases'
status, reason phrase and expected Range header. They supply fixture inputs rather
than missing observed responses. The interrupted-download consumer omits status
and headers, performs its17-byte read and preserves a partial after OSError. The
resume companion explicitly supplies206/Content-Range. The existing wire cases
parse actual HTTPResponse bytes and independently observe request Range values,
status, bodies, partial/publication identity and coding/digest rejection.

Independent dirty-source review passes. Root75649 passes those consumers plus
checksum/excess rejection:4 existing methods in0.007s. Whole AST and all8 scoped
raw labels/snippets/order match; exactly six applicability findings are admitted.
Both unrelated interruption callback defaults remain visible. Ruff/checkformat,
source/mode endpoints and current/executed bytes pass. Omitted/oversized read-size
rejection is source reasoning, not separately exercised; the reason phrase is a
declared fixture association. No new tests, transport or full-suite claim.
Exact commands, source, proof and limitations:
.work/qualification/artifact-http-fixture-contracts-20261015/REPORT.txt;
SHA256 6e4cdd7d8e2326e13e11aeec5c63abe90efcee024c55f8ccd3cb16dfa12705e8.

Finalized artifact bytes: both images and bounded science refreshed (2026-10-15)
-------------------------------------------------------------------------------
Root18170 passes maintained make checks/image/build, recording observed immutable
checker9164d380c00bf0e013d44357cafb03d4b1f64570a93105f74ac4b85b66cf1b49.
Root16689 passes maintained packages/image, packages/import and fresh baseline/run
foundation-final-inputs-20261015 with LABEL_ATOL0.0001/ATOL0/RTOL0, recording inference
cabb4fe3e36541b0fefe54ca7c16fb21f9a60112a1e3d47992d4aa18343ecd08.
Both captured build inputs include committed artifacts.py b2920baa. No acquisition,
source/dependency/pin update, pull or replacement of prior scientific runs occurs.

Roota78239 independently compares all64 unique reference rows (H42/C22) in both
repetitions:128 exact comparisons, maximum absolute difference0. Contained checks
bind actual image, held runtime revision ef1d6bc, linked preflight/model/raw-output/
verification/log hashes and prepared identity. Current lock7a4ee5bb is compared to
current input; historical reference lock3abca8de remains separately identified.
Model cgroup facts match2CPU/4GiB/swap0/PID64. All55 build-source SHA/mode endpoints,
17 comparison inputs/modes and29 run-file checks pass. The original prepared
receipt and checked-in reference remain unchanged. Raw pickle is only hashed by
the independent comparator. No fresh running-container inspection, ensemble/Table2
accuracy, clean-base security or global test/repository pass is claimed. Known
inherited advisory adjudication and release-configuration/target-unit reviews
retain their existing scope.

The first comparison attempt stops before a container or assertions: root395e79
finds three wrongly rooted private checksum-manifest entries. Original manifest
and metadata-only failure record remain. Only manifest paths change; runner and
trusted comparator203658eb remain byte-exact. The retry performs the successful
comparison. Exact retained commands, separate streams, images, source bindings,
results and limitations:
.work/qualification/final-image-refresh-20261015/REPORT.txt;
SHA256 1ab96916d3da6b279152ce23bc51b069c4880990d72138314660819a8c19990e.
Independent frozen-image review passes. A later one-comment proxy readiness
annotation changes one member of the broad55-file live tree; it changes neither
image's actual captured inputs. All10 selected inference and7 selected checker
input hashes and current modes still match. The55-file claim above concerns the
recorded execution endpoints, rather than an assertion of current whole-tree
identity. Both immutable image records still match the successful admissions.

Proxy exception boundaries are observed before policy adjudication (2026-10-15)
-------------------------------------------------------------------------------
Two new methods establish real behavior rather than merely certify declarations.
A literal IPv4 produces its singleton without DNS discovery/query/socket calls;
an unrelated classifier RuntimeError propagates. A failed502 OSError preserves
the original exact safe admission diagnostic without private values or outbound
connection. An unexpected reply RuntimeError propagates as the same object.
The existing hostname DNS deadline consumer exercises the other classifier path.

One producer comment explains that the readiness diagnostic reports publication
completion independently of temporary-alias cleanup. Both existing readiness
consumers distinguish failed publication and successful serving after cleanup
failure. Production whole AST and all15 prior unit methods remain unchanged.
The raw producer/unit findings are unchanged; only the readiness conditional is
admitted. Both exception handlers remain applicable pending separate policy
adjudication. No source rewrite, handler exemption or new default is introduced.

Independent actual-source review passes. Root983f93 passes the two earned methods
and five existing DNS/readiness/admission/forwarding companions:7 methods in0.024s.
Ruff/format, source/mode endpoints and final live/executed bindings pass. The
producer is0755; unit host0664/projected0644 are separately recorded. No formatter,
failed runtime, full17-method or current global property claim. Exact proof,
commands, unchanged old ASTs and retained strict handlers:
.work/qualification/proxy-residual-contracts-20261015/REPORT.txt;
SHA256 1eac36fd70ce00998e53c3634387dd7189eca4a7e79a33e6959f6a37675f9425.
Independent frozen raw/source review also passes: every old unit method and the
producer AST are conserved, raw lists match, and both handler findings remain
strict. The new transport assertions use controlled mocks; no live network or
external proxy availability is established.

Fresh defaults inventory on the rebuilt checker (2026-10-15)
------------------------------------------------------------
Root20541 collects the maintained raw and applicable findings at clean committed
6f98f810b7c15c43eda1e4d44b340def5bab14f9. The rebuilt checker9164d380 actually
reports Git2.39.5, GNU Make4.3 and Ruff0.15.15. Collection returns0:82 Python
paths,206 raw findings and164 applicable findings, with exact ordered strings
and per-path zeroes retained. These are findings to adjudicate, not164 proven
bugs or a passing repository property. The earlier193 inventory is historical.

Independent packet review passes. The collector is byte-identical to its prior
reviewed version; there is no filter, expected-count target, assertion of emptiness
or test-suite execution. All150 committed blobs, projected modes, clean tracked
HEAD/index boundaries and runner endpoints pass. The final live policy binding
belongs to this recorded pre-typed-pass epoch; later policy edits are separate.
No host Python/JSON processing, acquisition, dependency or upstream change.
Exact actual checker command, outputs, versions, source bindings and limits:
.work/qualification/current-python-default-inventory-after-contracts-20261015/REPORT.txt;
SHA256 9807040145fa1ce13a25401041a1baf08dbeb691987df9d6e3ec4411f761313e.

Reviewed typed-pass handlers retain operator-input findings (2026-10-15)
------------------------------------------------------------------------
The two proxy handlers have earned classification/diagnostic-preservation proofs,
but the prior applicability boundary cannot address an ExceptHandler. The local
annotation may now select exactly one immediately following, equally indented
handler of an ordinary Try. It must contain only Pass and declare nonbroad names,
dotted names or a nonempty flat tuple. Bare, computed, nested/starred tuple, broad
Exception/BaseException/group spellings, except*, returns and extra body statements
remain strict. No consumer-specific type whitelist, function-name match or inferred
alias/hierarchy proof is added. The linked test and human source review own meaning.

Shared ENV/raw-args/args-attribute guards apply to the handler/header before its
special eligibility branch. Protected Try bodies also reject recognized ENV/CLI
access, including required os.environ["PORT"], whose swallowing handler can be its
only raw finding. All other protected-body, sibling and neighbouring findings stay
visible. A new witness accepts a handler but retains state.get("done", 0) with
raw2/applicable1. No producer annotation is added here: both actual proxy handlers
remain applicable, and the frozen82/raw206/applicable164 inventory is unchanged.

Independent review caught a real gap in the first uncommitted candidate despite
its green25-method run: an annotated `except args.failure: pass` bypassed the
existing common CLI guard. Moving that guard before handler admission and adding
the exact negative fixes it before commit. Both independent correction reviews
and final raw/source review pass. Root43241 passes25 methods in0.167s:all18 prior
contract method ASTs/identities, four new property methods and three existing
matcher/absence/inventory fixtures. Raw detector/collector and old raw/property
fixtures are unchanged; both full inventories and ordered findings match exactly.
Ruff/checkformat and source/mode endpoints pass; live02639b0b/497d4cab match executed
bytes. No aggregate pass is claimed. Original lint-only PLW2901 failure, isolated
formatter and earlier green V2 are retained; a separate reference cursor repaired
the lint failure without suppression. Final proof and exact retained history:
.work/qualification/typed-pass-contract-policy-20261015/REPORT-v3.txt;
SHA256 fc7e7650828fd34ef2182dba0c569c9df12341160396df502284efd1f248aa7e.

The separately reviewed quality/PORTS.md now labels129/21 as initial import counts
and documents current local contract boundaries and human proof-review limits.
Its If wording is precisely a single-line condition expression in a header; a
closing delimiter/colon may occupy another line. Documentation is outside the
code qualifier and receives source review plus diff checks, without a new test.

Two actual proxy recovery contracts qualified (2026-10-15)
----------------------------------------------------------
Exactly two comments now select the proven handlers. Nonliteral destinations take
the DNS path only after AddressValueError; the named hostname-expiry consumer
actually observes that path, with the literal/unexpected-error method as companion.
The failed502 OSError handler preserves the original safe admission diagnostic;
its named consumer exercises both that failure and unrelated-error propagation.
No behavior, test, signature, type grammar or policy changes accompany the tags.

Independent actual-source and final raw reviews pass. Root2552ea passes all three
existing consumers in0.005s. Producer AST/0755 and all7 ordered raw findings are
unchanged modulo comment lines; exactly the two handler applicability findings
are admitted, all others preserved. The scoped producer property, Ruff/format and
source/mode endpoints pass; live94c84af2 equals executed bytes. No live-network,
universal diagnostic-delivery or global count/property pass is claimed. These
comments do not alter either image's captured COPY inputs. Exact proof/results:
.work/qualification/proxy-typed-pass-dispositions-20261015/REPORT.txt;
SHA256 c86790a089cfd821415fc6540e2b3adf48e3a8ef472597f2d40ecb087d50e990.

Local baseline fixture declarations retain exact scientific choices (2026-10-15)
--------------------------------------------------------------------------------
Five comments explain the local preparation/run preview choices, deliberately
selected mounted-input drift, synthetic pickle protocol4 and exact label allowance0.
The four existing consumers exercise omission, both embedded-input admissions and
drift refusals, exact selected record bytes/receipts, and explicit0.0625 label
roundtrip admission/error reporting. No production tolerance, solvent, ENV choice,
scientific execution or general pickle-safety claim changes.

Independent actual-source and final raw reviews pass. Root67670 passes all four
methods in0.068s. Whole3 ASTs and scoped6 raw labels/snippets/order match; exactly
five applicability findings are admitted. The multiline Return batch selector stays
visible, and its explicit-empty missing-record negative is unchanged. No source
reshape, policy expansion or declaration-only test was added. Ruff/checkformat,
source/mode endpoints and current/executed bytes pass. The qualifier excludes the
orthogonal CID candidate; host0664/projected0644 are separately recorded. No broad
unit/property pass. Exact commands, actual effects, source and limits:
.work/qualification/baseline-fixture-contracts-20261015/REPORT.txt;
SHA256 e9393ac4a708eebd418e3cee37f48adaa7a1cc622df23aeac2450363cc6edf6e.

CREATE identities belong to the finite fixture's role profile (2026-10-15)
---------------------------------------------------------------------------
The former shared NMRNET_FAKE_CID fallback generated deliberate fixture output;
it was not recovery of missing observed daemon evidence. Its unowned ambient
selector could nevertheless override both roles. The constructor now owns separate
PROXY_CID/WORKER_CID fields, and the already-classified role selects its required
field before CID, role-card or readiness publication. Explicit fault callers use
their known role field. No compatibility branch, schema, allocator or CID validation
layer is added. Empty, noncanonical and NUL-receipt stimuli remain exact fault bytes.

The new ownership lifecycle exercises both roles under old/new ambient poison,
then deletes the selected required field. The second invocation fails1 with its
KeyError and no new receipt; prior registry, receipt and card bytes/inodes remain.
Both attempts are observed in the call log; this is not a no-dispatch claim.
Existing two-role lifetimes, native statuses, removal/lost-registry assertions and
malformed-controller no-start/no-removal consumer remain intact. No repeated or
concurrent same-role identity-uniqueness guarantee is introduced.

Independent actual-source and final raw reviews pass. Root40584 passes24 methods
in26.351s:22 original metadata methods, one new ownership method and one existing
operator companion. Old method ASTs/assertions differ only in9+1 explicit field
keys and one added empty-CID row. Full82-path ordered raw/app findings differ only
by the two obsolete shared-CID defaults. Formatter changes no bytes; Ruff/format
and all four live/executed source/mode endpoints pass. The first qualifier47746
stops before unittest on a mistaken hardcoded count; V2 derives actual method
names instead. An incomplete prepare argument is rejected before capture. Both
pre-test attempts remain recorded; source/proof assertions are not weakened.
No aggregate or production daemon claim. Exact commands, source, effects and limits:
.work/qualification/fixture-cid-owner-20261015/REPORT.txt;
SHA256 4dd6bcbc8a4eb79c42c049070356114bdb66f9f282bc188e3e74863e5b46c23d.

Discarded ENV revocation uses the existing pop tag (2026-10-15)
---------------------------------------------------------------
A standalone environment.pop("KEY", None) deliberately revokes inherited input;
it does not substitute an operator value or recover an observed result. The
existing allow-pop-default spelling now shares the stronger detector's reason,
named-proof and immediate same-indent placement checks. Its boundary admits only
one discarded recognized ENV call, literal string key and None, two positional
arguments, no keywords. Consumed, returned, wrapped, conditional-value, computed
or non-None calls remain strict. Legacy matchers and the separate production ENV
rule remain unchanged. No producer annotation accompanies this policy slice.

For example, an unannotated environment.pop("KEY", None) remains a finding;
adding the reviewed reason/proof immediately above that standalone call admits
just that call. Assigning its result still fails. A tagged call inside an ENV
condition does not waive the ancestor's getter finding. This is the bounded
integration needed by eleven existing test/check revocations, not a global waiver.

Independent source reviews pass. Root70009 passes30 methods in0.182s:25 contract
methods, three raw fixtures and two legacy fixtures. The22 old contract ASTs,
shared header/typed/raw/legacy matcher ASTs, and the frozen82-path inventory are
preserved; both versions yield ordered206 raw/162 applicable findings for that
historical projection. Three adversarial methods cover the new boundary. Ruff,
format AST parity, source/mode endpoints and final live bindings pass. Final
policy f7a2da91, formatted fixture037ebdf9 and separately bound PORTS3c4762ab match
qualified bytes. No global-green or current-global-count claim. Exact commands,
proof, grants, endpoints and limits:
.work/qualification/env-revocation-contract-policy-20261015/REPORT.txt;
SHA256 43845b394fbb122a7e065ef19d4908ba3ff469c671fc61c89d3f707e345b8df2.

Eleven existing admission/selector revocations explained (2026-10-15)
-------------------------------------------------------------------
Eleven immediate pop-tag comments cover absent interface, admission marker,
package search path, forwarded stage/archive and inherited Git-function removal
in five test/check files. These operations already deliberately discard values;
no body, signature, assertion, environment value or policy changes. Before:
    environment.pop("NMRNET_IN_CONTAINER", None)
After: the same call has a local reason/proof identifying the existing missing/
invalid-marker consumer. Returned pop values remain strict. The Git comment was
corrected during independent review: the function can be inherited from ambient
state; this fixture owns an executable wrapper, not an exported function.

Root49308 passes eight existing consumers in1.414s. Whole five ASTs/test bodies,
ordered raw labels/snippets and145 other committed files/modes are unchanged;
exactly eleven applicability findings are removed. The maintained property still
rejects files containing other unreviewed findings. Ruff/checkformat, frozen
source/runner endpoints and live=candidate=executed bindings pass. Live launcher
0775 vs projected0755 and other0664 vs0644 modes are recorded separately. Native
comments were excluded from this projection. No new tests, declaration-only
proof, repeat, acquisition or global-green claim. Exact results/grants/limits:
.work/qualification/env-revocation-dispositions-20261015/REPORT.txt;
SHA256 5281e497178f91b531698935865a29d74840134d20a9fa1906cc2ee623ce79c1.

Native scenario inputs and expected outcomes stay explicit (2026-10-15)
-----------------------------------------------------------------------
Six comments explain seven local declarations in test_inference_native.py:
omitted captured discard mode, both twenty-second fixture-budget forwards,
one-second grace observation within a three-second observation window, and the
three-phase budget/status selectors. For example, budget="20" remains unchanged;
its local reason/proof now points to the existing cleanup/trap consumer that
actually exercises both helper omissions. Expected129/130 remains the same
independently induced HUP/INT outcome. These declarations supply fixture stimuli
or expectations; they never establish retirement from absence.

Independent source review passes. Root16118 passes the four existing consumers
in30.680s. Whole-module AST/0755 and13 ordered raw findings remain unchanged;
exactly seven applicability findings are removed. Six stay visible: three ENV
getters, two ENV-overlay conditionals and the multiline Return scenario selector.
No test, behavior, assertion, signature or detector change accompanies the tags.
The proof does not establish twenty-second expiry, exact three-second timeout
or every override. Ruff/checkformat, frozen source/script/mode endpoints and
live=executed63cefd6c pass. No repeat, download or global property pass. Exact
commands, sources, results and limits:
.work/qualification/native-fixture-controls-contracts-20261015/REPORT.txt;
SHA256 794c599435bae2164e502ea57e2f3b0dd16a7d773026daf125591001effcfb4d.

Repository-root symbol state has a discriminating rebinding witness (2026-10-15)
--------------------------------------------------------------------------------
Two local comments explain empty initial/inherited scope copies and removal of
non-source bindings. The first negative proposal merely executed removal without
a later consumer. Root rejected that proof limit: the existing negative source
fixture now adds HERE from source layout, rebinds it to an ordinary pinned path,
then derives REPO_ROOT from HERE.parent. The same empty-findings assertion must
hold; a private pop-to-pass mutation fails it specifically on stale REPO_ROOT.
This is detector behavior coverage, not a declaration-only test or ENV waiver.

Independent source review passes. Root878710 passes the two existing detector
methods in0.001s after observing that expected counterfactual failure. Four old
method identities/assertions are preserved. Removing the intentional three-line
source-fixture addition and two comments restores the old module bytes/AST;
there is no whole-module-AST-unchanged claim. Raw findings remain identical and
exactly two applicability findings are admitted;149 other Git files/modes are
unchanged. Scoped property, Ruff/checkformat, source/script/mode endpoints and
live=candidate=executed1a399ec6 pass. Host0664/projected0644 remain distinct. No
production root change, broad scope-isolation proof, repeat or global green.
Exact commands, sources, actual counterfactual, results and limits:
.work/qualification/root-posture-symbol-contracts-20261015/REPORT.txt;
SHA256 a74986e0bcbdfe1e98136ed6da969cf57bee00d62759de0841bb701411d582de.

Required CREATE fault instructions reject before publication (2026-10-15)
-------------------------------------------------------------------------
The CREATE output/status OR guards reject missing/unknown/noncanonical fault
instructions; they do not select replacement input. Direct missing/unknown
coverage was absent. One coherent five-row lifecycle method now exercises
missing/unknown output plus missing/00/256 status. Each case first creates a real
worker, then attempts a proxy CREATE with the bad instruction. Exact97/cause and
empty stdout distinguish validation from the deliberately valid fault status37;
prior registry, receipt and role-card bytes/inodes survive, with no new proxy
receipt/card/readiness path/port. Both attempts remain in the call log. No
constructor, fault-program, engine or scanner policy change accompanies this test.

Independent source and final raw reviews pass. Formattercf5bdf exits0 preserving
AST and268bbd9d bytes; root51833 passes four named methods in2.739s (new lifecycle,
existing role-CID ownership, malformed/NUL CID and controller256 consumers).
All23 old metadata method ASTs/identities remain, plus one new method; ordered
raw/applicable findings are unchanged. Ruff/checkformat and source/script/live/
formatted mode endpoints pass. Host0664/projected0644 are separately recorded.
No full-module, daemon-identity, global-property or broader validation claim.
The rejecting predicates remain findings pending a separate purpose-based
applicability decision; no fallback defaults or detector exemption was slipped
into the coverage slice. Exact commands, sources, effects and limits:
.work/qualification/create-fault-validation-20261015/REPORT.txt;
SHA256 5f5a54150158cb4acaebcb5bacd41fd9aa3ef61916d4492f2de666ca14464f67.

Checker fixture controls retain their behavioral consumers (2026-10-15)
------------------------------------------------------------------------
Seven comments explain eight declarations: execution vs preview, two captured
streams, malformed-build vs inspection-receipt fault selection, capped-stream
selection, delete/retain cleanup stimuli, owning check/build action, and distinct
cleanup expectations41/42 subordinate to an existing primary failure. These are
closed fixture stimuli/expectations. Actual ENV overlays, rescue absence and
unearned handler dispositions remain visible; the multiline expected-call
selector is not reshaped merely to place a tag. Bodies/assertions/signatures and
all production behavior stay unchanged. No declaration-only tests were added.

Root30659 passes the four existing consumers in26.844s: exact preview/execution
argv and one engine call; actual removal signal with exact output/quiet stderr;
eight malformed/capped receipt faults with observed4096-byte receipts; and five
cleanup cases checking physical directory effects, precedence and publication.
Whole owner AST/mode and13 ordered raw findings are unchanged; exactly eight
applicability findings are admitted, all others preserved. Ruff/checkformat,
143 projected source SHA/mode and script endpoints and live=executed23daadaaf
pass. Host0664/projected0644 remain distinct. Root rejected the first UNRUN
qualifier's incomplete projection/script endpoint coverage; V2 adds that evidence
before any execution. Original private scripts remain retained. No failed runtime,
repeat, whole-module suite, universal rescue or global property pass is claimed.
Exact commands, source bindings, actual effects and limits:
.work/qualification/checker-fixture-controls-contracts-20261015/REPORT.txt;
SHA256 1b0c1fd9cc61690ff93dab4aeee31ed7afd171c6e8daf86c0c1555374199e5b3.

Unfiltered inventory after reviewed revocations and fixture contracts (2026-10-15)
--------------------------------------------------------------------------------
Root23322 exits0 against clean158f41ee653727e4c23e3edbc34a6b47b0070992.
The unchanged29b63651 collector directly runs the maintained inventory and both
collectors, without filters or empty-result assertions:82 Python files,204 raw
findings,127 applicable findings. Exact ordered findings and per-path zeroes are
retained. These127 findings need purpose-based review; they are not127 established
bugs or a passing property. Older164/193 counts remain historical source windows.

Actual cached checker9164 logs Git2.39.5, GNU Make4.3 and Ruff0.15.15. Frozen Git
source SHA/modes, collector/runner/output manifests and equal before/after HEAD
with clean tracked/index guards pass; independent final raw review passes. No
scan repeat, detector mutation, source omission, tests or global-green claim.
The subsequent acquisition-comment integration is outside this clean window.
Exact command, grants, sources and complete unfiltered results:
.work/qualification/python-default-inventory-after-revocations-20261015/REPORT.txt;
SHA256 e756892f98dddb9b97adf46b49748610af23c9c5a3ae157b577ebe801cd4eb15.

Acquisition fixture expectations preserve observed ownership (2026-10-15)
------------------------------------------------------------------------
Three comments explain expected role IDs in two existing lifecycle methods and
primary-status-or41 in the private-config cleanup assertion. Expected fixture
IDs do not authorize cleanup: the unchanged consumers separately exercise exact
CID/stdout pairs, actual cancellation and physical removal effects. The second
comment explicitly limits its empty-stdout comparison to the closed empty/
disagree/NUL cases, avoiding a claim about every recovery path. Observation
registries, rescue absence, ENV overlays and all behavior/assertions are unchanged.

Root64837 passes three existing methods in17.144s. Whole owner AST/0755 and nine
ordered raw findings are unchanged; exactly three applicability findings are
admitted and every other finding remains. Ruff/checkformat, full projected source
SHA/mode and script endpoints and live=executed a5287eeb pass. The earlier f5aea1ee
comment wording and UNRUN pins are retained; narrowing preceded execution. No
repeat, new tests, universal failure rescue, deadline or global-property claim.
Exact commands, actual effects, source bindings and limits:
.work/qualification/acquisition-fixture-controls-contracts-20261015/REPORT.txt;
SHA256 f2a112d0043b7b1016857626999ec678b41019cc8253ebd3954eee05ddd63dbf.

Proxy fixture clocks, transport bytes and receipt expectations (2026-10-15)
--------------------------------------------------------------------------
Seven local comments explain scripted blocked/completed write times, select
counts, renewed inactivity expiry, half-close read order, GET/CONNECT admission
bytes, CONNECT remainder bytes and published/replaced readiness receipts. Four
existing consumers observe the corresponding two-sided transport effects and
serving/receipt behavior. The comments supply no timeout, readiness or cleanup
authority. No test, body, assertion, ENV or detector changes accompany them.

Independent source and final raw reviews pass. Root8f0d3c passes four methods
in0.010s. Whole owner AST/test identities,11 ordered raw findings and149 other
Git files/modes are unchanged; exactly seven applicability findings are admitted.
All four method-name mutation-selector findings remain. Ruff/checkformat, source/
runner/mode endpoints and live=candidate=executed2194bc3e pass. Host0664/projected
0644 are separately bound. No repeat, external network, global property or
universal scheduling claim. Exact commands, effects, source and limits:
.work/qualification/proxy-scenario-expectation-contracts-20261015/REPORT.txt;
SHA256 2e1cc525b392dc7b2ad9f66d81d1492017c407a705a716e5946bbe4d7d1345a7.

Package PRINT and cleanup scenario expectations stay local (2026-10-15)
----------------------------------------------------------------------
Three comments explain the six-case input/PRINT expectation, closed delete/
retain cleanup stimulus and primary37-or-cleanup41 expectation. Existing consumers
independently check no engine dispatch/ambient-path preservation and actual
removal effects/attempt diagnostics. Assertions, bodies, profile values and
production behavior remain unchanged. ENV readiness selectors, observed config
metadata and three sibling cancellation-composition selectors stay unannotated;
no source reshape or annotation-policy extension accompanies this cohort.

Root69226 passes the two existing methods in10.295s. Whole owner AST/0755 and11
ordered raw findings are unchanged; exactly three applicability findings are
admitted, all others preserved. Ruff/checkformat, full projected source SHA/mode
and script endpoints and live=executed fda28bfb pass. No repeat, new tests,
full-suite, universal cleanup or global-property claim. Exact commands, sources,
actual effects and limits:
.work/qualification/package-scenario-contracts-20261015/REPORT.txt;
SHA256 f09078c39e6ff0a4181ab3ea52cadc41a42ff227f163cd23bb987e995cef5eca.

Comparison predicates are Boolean composition, not replacement inputs (2026-10-15)
---------------------------------------------------------------------------------
The inherited predicate classifier recognized ENV membership comparisons but
misclassified other comparison operands of OR. Both CREATE rejection guards
combine comparisons; neither supplies a replacement value. Independent critique
rejected a proposed60–80-line annotated rejection mini-language as unnecessary.
The existing helper now directly recognizes Compare, retaining its old Not
branch. No producer tag, file exemption, rejection-flow inference, call whitelist
or operator-default allowance is added. PORTS distinguishes this detector
correctness change from annotations, which still preserve raw findings.

Before, OR-combined missing/invalid CREATE comparisons were reported as silent
input defaults. After, those comparisons compose validation results. Mixed
`env["K"] == "x" or 37` and nested `(env["K"] or "x") == "x"` remain findings;
ENV get(default), CLI, callable and handler rules remain strict. The syntactic
classification does not resolve rich-comparison overloads/aliases, prove call
purity or detect fail-open Boolean policy such as comparison-or-true.

Root86008 V2 passes33 methods in0.200s:25 original contract methods, three new
actual-property methods and five raw/legacy companions. Only the Compare tail
changes in the old policy AST; old Not/walker/contract/legacy guards and old test
ASTs/assertions are preserved. Both formatter ASTs and final4fc0c195/0e68fc49 bytes
match. The original V1 formatter succeeds, then RuffSIM103 stops before tests;
V2 uses the natural direct return, no suppression. That epoch remains retained.

Full frozen80f44bb6c0d2eb9ebb9141e483da2744ec19a766 inventory has82 paths:
raw204→201 and applicable114→111. Every delta was independently reviewed: only
the two CREATE guards and checker_engine's explicit READY_FAIL comparison-or-
count4 Boolean fault activation disappear. No additions; complete ordered retained
raw/applicable lists compare exactly after those three removals. The third
consumer was inspected, not rerun in this qualifier. This neither certifies its
counter lifetime nor admits any readiness/retirement evidence from absence.

Independent source, full-delta and final raw/docs reviews pass. Ruff/checkformat,
source/script/live/formatted/output SHA/mode endpoints pass; host0664/project0644
remain distinct and PORTS9c106e3b is separately bound. Orthogonal ledger changes
are excluded.111 is a frozen applicability inventory, not global green. Exact
commands, complete old/new lists/per-path zeroes, failures, sources and limits:
.work/qualification/env-comparison-predicate-20261015/REPORT.txt;
SHA256 8cfedfc184024c4102377b4acbccf069393835b99bbe43dea83a0f78df51d0d6.

Checker observations distinguish owned emptiness from lost history (2026-10-15)
------------------------------------------------------------------------------
Before: the reader's glob returned[] for a missing calls directory, while the
engine recreated that directory. A lost observation history could therefore be
presented as an empty one. The fixture constructor now creates state/calls once;
both reader and writer strictly enumerate it. Missing ownership raises the
filesystem cause before modeled request effects. Existing JSON filtering, atomic
pending→rename publication and sequential event format are unchanged. No new
ledger framework, index, schema or concurrency authority is introduced.

The lifecycle first observes owned-empty[], then a real successful dependency
check and its event. After deliberate loss, reading fails; the build lane's
INITIAL dependency-verification request also fails1 with the exact lost-directory
cause, empty stdout, no recreation/capture and unchanged predecessor image bytes.
This is not an unobserved zero-attempt or actual-build failure claim. Predecessor
inode preservation and arbitrary record-loss detection are not asserted.

Independent source and final raw reviews pass. Root19707 V3 passes four consumers
in6.143s, including normal offline build/client and actual unknown-inspection
startup. That fourth method observes READY_FAIL='inspect', exact count4/fault and
retained paths; it now supplies runtime companion evidence for the unchanged
Boolean condition discussed in the preceding classifier section. Earlier
inspection-only qualification remains a distinct historical window.

Formatter AST parity passes. Final launcher8383c3ab/engine882bb378 are bound to
executed outputs; launcher1bfbb102 is the input window, with root's post-terminal
formatted integration recorded separately. Old method ASTs/assertions are intact
except reviewed setUp/calls and one new lifecycle method; exact engine-block
restoration proves the remaining source unchanged. Frozen80f44 policy yields
23 scoped raw findings with raw/app order unchanged; this is not a new current
global count. Ruff/checkformat and all source/script/formatted/mode endpoints
pass; host0664/0755 vsprojected0644/0755 remain separate. Earlier d3306d stops on
format check before tests; original three-consumer UNRUN scripts remain retained.
No test repeat, broader rescue, record-integrity, daemon or global-green claim.
Exact commands, actual effects, sources, failures, bindings and limits:
.work/qualification/checker-call-ledger-ownership-20261015/REPORT.txt;
SHA256 4f07b8c4925b1eef3d1b8d4ddf1bf0c23a31f32e5e277ea154650db7b46115cb.

Closed scientific encodings explain two existing expressions (2026-10-15)
-------------------------------------------------------------------------
Two comments describe Git's already-admitted100644/100755 regular-file modes
being translated to0644/0755, and required audit stderr/exit encodings (empty
bytes and exact zero+LF). Neither invents missing evidence: admitted modes are
closed before translation and all nine capture names are required before their
identities are checked. Existing consumers exercise actual committed context
bytes/modes/digest drift, exit1 rejection and real historical-Git positive paths.

Independent source and final raw reviews pass. Root74885 passes three existing
methods in0.081s. Whole two ASTs/0644 and both ordered raw findings remain exact;
only two applicability findings are admitted. Both formatter ASTs/bytes remain
b9200053/c2149051; Ruff/checkformat, source/script/live/formatted SHA/mode endpoints
pass. Host0664/projected0644 are separately recorded. No new tests or behavior/
ABI/pin changes. This does not separately exercise materializing a0755 Git blob,
changed-stderr rejection, fresh audit capture or scientific-model execution.
No repeat or global-property pass. Exact commands, sources, results and limits:
.work/qualification/scientific-encoding-contracts-20261015/REPORT.txt;
SHA256 330b83f6d08086580b345a1569a6bb40bce99c1652e928b8b4f8cb1bba5916b9.

Required pull policy uses its admitted field directly (2026-10-15)
-----------------------------------------------------------------
assert_runtime_grants already asserts that --pull exists before checking every
value is never. The following get('--pull',[]) could not legitimately select its
fallback. It now uses values['--pull']; the preceding required-presence diagnostic
and all other assertions remain. Optional namespace/userns/restart/OOM/shm/mount
absence has a different meaning and is unchanged. No new tests or tag are needed.

Independent source and final raw reviews pass. Root30769 passes two existing
methods in2.702s: seven rendered offline profiles plus missing-pull, always-pull
and extra-authority negatives. Exact one-expression text/AST restoration proves
all original assertions unchanged. Ordered raw/applicable lists lose only this
redundant getter. Formatter AST/bytes cdd634f1, Ruff/checkformat and all frozen
source/script/live/formatted SHA/mode endpoints pass; host0664/projected0644 stay
separate. No repeat, daemon-default or global-property claim. Exact evidence:
.work/qualification/required-pull-access-20261015/REPORT.txt;
SHA256 ef9cc16844220f805367b430b00e9456f0a129bb71df8e220fca096cec0bec4c.

Baseline admission fixture declares its normal action and observation bound (2026-10-15)
---------------------------------------------------------------------------------------
One signature comment explains action='run' and timeout5. The existing omitted-
argument consumer verifies exact image identity/combined-label admission order,
typed private receipts and physical removal before inert dispatch; the explicit
prepare companion observes its own image admission. This is a local subprocess
observation bound, not a five-second scientific or native-execution policy.
ENV controls, optional overlay and call-history semantics are unchanged.

Independent source and final raw reviews pass. Root32551 passes both existing
methods in4.615s. Whole owner AST/test assertions/0755 and eight ordered raw
findings stay exact; only two signature applicability findings are admitted.
Both formatter AST and9484e4b2 bytes remain unchanged. Ruff/checkformat and frozen
source/script/live/formatted SHA/mode endpoints pass. No new test, formatter
rewrite, runtime failure, repeat, measured timeout-expiry or global-green claim.
A private draft orchestration parse error occurred before any tool dispatch;
it is not a test/runtime result. Exact commands, sources, actual effects and limits:
.work/qualification/baseline-admission-signature-contract-20261015/REPORT.txt;
SHA256 9fb13aad56b27fc5fcbc5fcdcfe1e2871035c13bc455a7cf51fb3f41c3394644.

Optional runtime argv fields describe supplied requests (2026-10-15)
----------------------------------------------------------------------
Five comments explain absent namespace/userns/restart/OOM/shm options as no
explicit argv value to inspect. Every supplied value still meets the existing
private/nonhost/no-restart/nonnegative/64MiB assertions. This concerns rendered
requested argv, not observed daemon namespaces, defaults or runtime authority.
The required --pull presence assertion/direct access remain. Unsupported mount
For-header placement and the unearned mandatory-whole-tmpfs absence disposition
remain findings; no parser extension or source reflow accompanies the comments.

Independent source and final raw reviews pass. Root47128 passes two existing
methods in2.722s: seven valid finite rendered profiles and explicit bad authority
requests. Whole owner AST/0644 and13 ordered raw findings remain exact; only five
applicability findings are admitted. Formatter AST/7563cd9c bytes, Ruff/checkformat
and all frozen source/script/live/formatted SHA/mode endpoints pass; host0664 vs
projected0644 stay distinct. No new tests, body, ENV or policy change. Explicit
UTS-specific rejection, every valid/resource-boundary variant and daemon-state
proof are not claimed. No repeat or global-property pass. Exact evidence:
.work/qualification/optional-runtime-flag-contracts-20261015/REPORT.txt;
SHA256 694b101e7d33e310729e24624e00f31e9bacffdbe8abe1e2c7bd6918fa421245.

Checker fixture owns normal response inputs (2026-10-15)
-------------------------------------------------------
The constructor now owns BUILD_OUTPUT and INSPECTED_ID in one environment
snapshot used by launch and _start. Explicit callers still inject malformed or
mismatched response bytes. These are fixture inputs, not observed daemon facts.
The finite engine requires each field only when consumed: missing build output
fails before modeled build writes; explicit BUILD_FAIL7 needs no unused output;
missing inspected ID fails after modeled build but before inspection output.
Two new behavioral methods exercise an actual constructor under ambient poison
and both absent inputs, private KeyError causes, exact attempt order, empty public
stdout and preserved predecessor bytes. Existing fault and signal consumers stay.

Independent source and final raw audits pass. Root60023 passes five methods in
28.127s; Ruff/checkformat and formatter whole-AST parity pass. Old assertions are
preserved by exact reviewed wiring/fault-input restoration; engine restoration
and other148 source/mode comparisons pass. Raw delta is three removed/one added
(two engine conditionals plus replacement of one annotated fault dictionary);
applicability removes only the two engine expressions, with no additions. Both
complete ordered remaining lists compare equal. Frozen base ad0a37a plus only two
overlays; effective executed/live launcher bf5ec9cd and engine bcb7bba8 match.
The d701765d preformat live window and later root integration are distinguished.
All source/script/formatted/output/mode endpoints pass; host0664/projected0644
remain separate. No repeat, universal no-effects or global-green claim.

Review corrected nested-case cleanup before execution: register before setUp,
then defer a parent assertTrue(fixture.doCleanups()). Otherwise a false cleanup
result is ignored by _callCleanup. Exact source and rationale are also in place:
https://raw.githubusercontent.com/python/cpython/v3.12.12/Lib/unittest/case.py
(doCleanups and _callCleanup). This is the pinned runtime's cleanup contract,
not a new fixture lifecycle framework. Original candidates/unrun scripts remain.
Exact commands, results, limits and bindings:
.work/qualification/checker-response-authority-20261015/REPORT.txt;
SHA256 7928f884ac2634661844ebf00ad6b7694673eef25ab62c7357ed69c6d522e898;
EVIDENCE.sha256 4277264d77330db6fed60ff08289a99f7748ca4a1a1b00bf8dcaf92fde714fab.

Fresh unfiltered inventory after response ownership (2026-10-15)
----------------------------------------------------------------
Root5338 exits0 on clean168d27afe4434ff42633d1993651cd2e03b3ed61:
82 Python files,198 raw and99 applicable findings (94 expressions, three
signature defaults, two exception fallbacks). Unchanged collector29b63651
calls the maintained inventory/raw/applicability collectors without filtering.
Full ordered lists/per-path counts remain retained. No applicable tools/ entry
does not justify fixture exemptions; these findings still need adjudication.
Independent final audit passes source/mode/script/output and clean HEAD/index
endpoints. Git2.39.5, Make4.3, Ruff0.15.15 and cached9164 offline/RO/nonroot grants
are retained. No property pass, test run, repeated scan or network acquisition.
Exact commands, categories and limits:
.work/qualification/python-default-inventory-after-response-20261015/REPORT.txt;
SHA256 e0fe540c8514013b2a680d6bf1f241d77661338f25b7bd241f17cf86e8e21839;
EVIDENCE.sha256 e25539983cb52ec6b11a31e1e0fe77f67f1871efaacc69d28680854828f28f81.

Contract placement follows multiline return values (2026-10-15)
---------------------------------------------------------------
Existing With/Assign value-region handling now includes Return.value, with an
empty region for bare return. Single-line returns were already supported. This
keeps formatter layout from deciding whether the same local contract can be
recorded, without reflowing producers just to place tags. One outermost generic
candidate must contain all selected candidates; sibling defaults, ENV/CLI/args/
argparse, nested lambdas, malformed metadata and unrelated statements retain
their guards. A separate enclosing exception-fallback finding remains visible.
This does not promise detection of every nested conditional exception return.
No Dict-entry, For-header or AnnAssign boundary is added.

Actual future consumers are baseline_result's None-only synthetic batch choice
and native outcome_command's required next-success encoding. No producer tag
is included here. Three actual-property methods cover both multiline shapes,
nested generic composition, strict inputs, stale/empty returns, unsupported
owners, siblings, adjacent statements and an enclosing exception finding.

Rootformat90014 exits0 with whole-AST parity; root26795 passes36 methods in
0.229s plus Ruff/checkformat. All28 old contract ASTs/assertions and the raw,
operator and exception guards are preserved by exact restoration. Full ordered
82-file inventory/raw198/applicable99 lists remain identical. Both150-file Git
snapshots, scripts, projected modes and formatter endpoints pass. Private input
f7261a24/4759ddf0 formats to f7261a24/3a8bcdc8; public live4fc0c195/0e68fc49
stayed fixed during qualification, then root integrated the executed bytes.
PORTS fe3720da is separately reviewed/bound outside the two Python overlays.
Independent source and runtime-binding review passes. No new disposition, repeat,
network, scientific rerun or global-green claim. Exact commands/results/limits:
.work/qualification/return-value-contract-policy-20261015/REPORT.txt;
SHA256 30f9557ee10213e2585add9528d1a37fff4937001ecca40ab2923253c81eef3a;
EVIDENCE.sha256 b204d6412639412355428c2ed69038b08f4103873f06693a0a059ee538f1d504.

Proxy probes declare their required primitive (2026-10-15)
---------------------------------------------------------
Two comments explain existing method-name selectors as prerequisite names for
DNS/TCP/relay and capacity/readiness/forwarding probes. They supply no alternate
implementation or observed transport result. Six existing behavioral consumers
exercise all six current branch families with injected transport/time. New test
families still require classification review; no exhaustive feature-deletion,
renaming, real routing/DNS traffic or daemon guarantee is claimed.

Rootformat64833 exits0 with AST parity; qualification565f37 exits0, six methods
in0.013s plus Ruff/checkformat. Whole owner AST/0644/raw11 ordered list stay exact;
only four nested-selector applicability findings are removed. Seven earlier
dispositions, other149 source bytes and all150 projected modes remain unchanged.
Independent source and raw audits pass. Proposal BASE168d27a is distinct from
executed BASE64b8dcd plus the sole74f620e0 overlay. During-run public live2194bc3e
remains fixed; root copies the qualified74f620e0 after terminal success. Full
source/script/formatted/mode endpoints pass, with host0664/projected0644 separate.
No new tests, source reflow, policy change, repeat or global-green claim. Exact
commands, source bindings, actual results and limits:
.work/qualification/proxy-prerequisite-selector-contracts-20261015/REPORT.txt;
SHA256 b6d58643c4c5566b3b1d46d9e65fb07d7fa1eed05b47f26bfb8b60a2d85dbf14;
EVIDENCE.sha256 c63926e9d64de37b098e1a54c66a835ccee2ddf9b8acd2ebea3ccfaafc88e83c.

Two fixture return values state their scenario contract (2026-10-15)
------------------------------------------------------------------
Baseline validation selects the declared single batch only for None; explicit
lists, including [], reach validation unchanged. Native outcome_command's
required next_success encodes whether the scripted second successful invocation
runs, not an observed cancellation or retirement result. Two comments own only
those Return.value selectors; signatures, bodies and assertions stay unchanged.

Rootformat90736 exits0 with both ASTs/modes preserved and bytes244c550d/bbb5d4c6
unchanged. Root99664 passes four existing methods in35.079s plus Ruff/checkformat:
reordered explicit versus omitted batches; explicit-empty rejection; actual
signals and next-success reset; ordinary numeric signal statuses with no next
call. Fifteen scoped ordered raw findings stay exact modulo comment lines;
only two applicability findings are removed, with every remaining finding in
order. Frozen64b8dcd plus only the two overlays, source/script/formatted endpoints
and distinct Git0644/0755 modes pass. The old public lived9003fb9/63cefd6c window
remains fixed during execution; root then copies qualified244c550d/bbb5d4c6,
separately final-bound. Orthogonal proxy edits are outside this projection.
No assertion/test addition, source reflow, policy change, cross-file148-source
conservation claim, repeat or global-green/scientific claim. Independent source
and actual-consumer audit passes. Exact commands/results/limits:
.work/qualification/return-fixture-dispositions-20261015/REPORT.txt;
SHA256 32034da45bc82ef67245ace3995680ab1e3c3bef8e8b552d4dcf94da77293505;
EVIDENCE.sha256 8d3d8731b36888121f86a769a01fd97bbabe9823e47d4c8013ac4db832cf4c60.

Wheelhouse cleanup expectations retain observation truth (2026-10-15)
--------------------------------------------------------------------
Two comments explain the closed cleanup table's delete/retain stimulus and
primary-or41 expected result. Neither expression supplies production outcome or
removal authority. Existing three subcases independently check directory
existence, status41/37/41 and attempted-path wording, while rejecting an unearned
retention claim. The multiline PRINT assertion stays a finding: its placement
is unsupported. No source reflow or policy extension is used to disposition it.

Rootformatter23b8e1 exits0 with whole-AST parity and unchangeddd5f4143 bytes;
root9064 passes the existing method/three subcases in6.357s plus Ruff/checkformat.
Whole owner AST/Git0755 and three ordered raw findings stay exact; exactly two
applicability findings disappear, with PRINT retained. Other149 projected source
bytes and all150 modes match. Independent source audit passes. Executed frozen
BASE8a5a488 plus sole overlay is separate from actual ENTRY3128705; that later
Return commit is outside this projection. Old public live2686 remains fixed in
both execution windows, then root integrates qualifieddd5f, separately bound.
Source/script/formatted/live/mode endpoints pass. No new test, runtime behavior,
unknown-retirement guarantee, repeat or aggregate-green claim. Exact evidence:
.work/qualification/wheelhouse-scenario-contracts-20261015/REPORT.txt;
SHA256 aa1357b8f2747526f81a23f684b62e2a12422422b234120270cea03289a9fcb8;
EVIDENCE.sha256 081fd18160870efae9f8805bd83cdfbca0296b48cefd99cbc13c7593aa3d54ab.

Interruption fault readers require their supplied size (2026-10-15)
------------------------------------------------------------------
Remove two unused _size=-1 defaults from local extraction/download fault readers.
Maintained callers supply positive bounds at tools/artifacts.py:195 and:370;
the helpers ignore size to inject their interruption. Bodies, assertions and
shared Response.read stay unchanged. This intentionally removes unused omitted-
size fixture support; no reader-API compatibility promise is made. Directly read
CPython sources explain historical resemblance, not a reason to retain it:
https://github.com/python/cpython/blob/v3.12.12/Lib/zipfile/__init__.py#L907-L919
https://github.com/python/cpython/blob/v3.12.12/Modules/_io/bytesio.c#L387-L413
Those APIs have optional negative read sizes; these constrained fault programs
need only the actual bounded calls. No new tests or annotation is necessary.

Rootformat9824 exits0 with AST parity; root3831f2 passes both existing interruption
methods in0.012s plus Ruff/checkformat. Exact restoration of only the two defaults
proves every old body/assertion/method unchanged; raw and applicable ordered lists
lose exactly those two function-default findings. Frozen31d6dfa plus sole502aa9b7
overlay; source/script/formatted/mode endpoints pass. Old public livef42e18a9/0664
stays fixed during execution, then root integrates executed502aa9b7/0644 as
host0664, separately final-bound. Independent source/actual-runtime audit passes.
No other-file crossmatch, omitted-size compatibility, repeat or global-green claim.
Exact commands/results/limits:
.work/qualification/artifact-interruption-signatures-20261015/REPORT.txt;
SHA256 f1dbe970c18099945c13ad1c49a34f80734c9f5820552e19e533b3bf2ff06b2e;
EVIDENCE.sha256 ffaca9bbff532238f7746a9cd580faee0155a0d910677bab15e1819b121e16f8.

Tar rejection fixtures declare their header encoding (2026-10-15)
----------------------------------------------------------------
One comment explains regular members' body length versus zero payload for these
nonregular rejection stimuli. This is authored input encoding, not substituted
observed archive metadata or a universal claim about tar member sizes. Existing
verified-source, unsafe-members and missing-setup consumers exercise regular
extraction and empty symlink/hardlink/FIFO/directory rejection before setup.
No nonempty-nonregular or all-typeflag coverage is claimed. Directly read source:
https://github.com/python/cpython/blob/v3.12.12/Lib/tarfile.py#L2062-L2081
TarFile.addfile copies exactly tarinfo.size bytes from a supplied file object;
this explains why the fixture must declare its payload length.

Rootformat9d6a8c exits0 with AST parity/unchanged84c92cee bytes; root6801ae passes
three existing methods in0.008s plus Ruff/checkformat. Whole owner AST/Git0644
and raw1 remain exact; only this applicability finding is removed. Other149
projected source bytes/all150 modes stay exact. Independent source/actual/raw
and final-manifest audits pass. BASE/ENTRY31d6dfa excludes the orthogonal artifact
edit. Old public live7aad8286/0664 is fixed during execution; root later copies
executed84c92cee/0644 as host0664, separately final-bound. All source/script/
formatted/live/mode endpoints pass. No new tests, runtime body, policy change,
repeat or global/scientific claim. Exact commands/results/limits:
.work/qualification/source-tar-fixture-contract-20261015/REPORT.txt;
SHA256 088be7c70b91451c8e997793138bb56e2b1b53629ac73e46228d60f49a90391b;
EVIDENCE.sha256 5ae59ed12d6027c269e25bb4881591fb7e605d78c2b6836a8e07fdf1c0208cec.

Contract placement follows one multiline call expression (2026-10-16 EAT)
------------------------------------------------------------------------
A standalone Call-valued Expr joins the existing reviewed value regions. Current
needs are wheelhouse PRINT and checker phase-call assertions; source reflow
would make formatting own applicability. The region includes callee, receiver
and arguments; one outermost generic must contain all selected candidates.
Existing strict ENV/CLI/argparse/lambda, sibling, metadata, adjacent-statement
and separate ancestor-finding guards remain. Discarded ENV-pop keeps its earlier
exact-call boundary. No assertion-name whitelist, purity inference or new tag.
Other multiline Expr values remain unsupported: single-line syntax support is
unchanged, so universal expression-format invariance is not claimed. Review
preferred this smaller earned boundary over admitting unused bare containers.

Three new actual-property methods cover both consumer shapes, nested/callee
composition and strict contrary cases. Root caught a source-only fixture mistake:
a handler containing only a Call does not trigger the existing fallback matcher.
V2 adds an explicit fallback Return to test a real retained ancestor finding;
the original unrun candidate is preserved. No detector expansion or failed test
run was needed for this correction. All31 old fixture ASTs stay unchanged.

Rootformat68442 exits0 with both ASTs preserved; root56912 passes39 methods in
0.238s plus Ruff/checkformat. Exact branch/doc restoration preserves remaining
policy/raw/strict/pop-first code; other148 files/all150 modes match. Full82-file
ordered inventory/raw196/applicable88 parity passes modulo changed source lines,
with complete raw/app lists retained. No producer dispositions in this slice.
Frozen3d6fa43 plus only two code overlays: fc77bfdf/bc95f634 formats to
fc77bfdf/5d9ff984, then root integrates executed bytes. Public livef7261a24/
3a8bcdc8 stays fixed during jobs; later integration is separately bound. PORTS
cf044af3 is reviewed/bound outside runtime overlays. Independent source/actual
qualification audit passes; source/script/output/formatted/mode endpoints pass.
No repeat, updated-live150 proof or aggregate-green claim. Exact evidence:
.work/qualification/call-expression-contract-policy-20261015/REPORT.txt;
SHA256 37c36115df9e80a6e19b010af475e98b1ecbf5f5cb71f66675525076f071362d;
EVIDENCE.sha256 4df311a88bcd9c0565a3aa826abfede27aa89442ff3f1fd684af2179af011ee6.

Proxy request scenarios declare stimuli and expected wire bytes (2026-10-16 EAT)
-------------------------------------------------------------------------------
Four comments explain HTTP/CONNECT header and body stimuli, expected forwarded
wire bytes, and method-specific target forms. Three existing consumers exercise
four forwarding-failure phases, port boundaries/scheme defaults, and both GET/
CONNECT first-write timeout settings under a controlled clock. No measured
wall-clock expiry, real network or substituted observed result is claimed.
All placements already used supported Assign/single-line Expr boundaries.

Rootformat971fda exits0 with AST parity/unchanged3894f849 bytes; root91c2e7
passes three methods in0.006s plus Ruff/checkformat. Whole owner AST/Git0644/
ordered raw4 remain exact; exactly four applicability findings disappear.
Other149 frozen files/all150 modes match. Independent source/actual/final report
audits pass. Frozen3d6fa43 excludes orthogonal Call changes; public live3d5f
stays fixed during jobs, then root integrates executed3894f849, separately bound
(host0664/project0644). Source/script/formatted/live/mode endpoints pass.
No new tests, runtime body, reflow, policy change, repeat or global-green claim.
Exact commands/results/limits:
.work/qualification/proxy-request-scenario-contracts-20261016/REPORT.txt;
SHA256 c1697051b892ec904eb5e4a96428a0cf6d304b17bab66d2e6ec9931d272c6473;
EVIDENCE.sha256 ef280f79476b03f5be856caeff9b275e91d7aafe702bbd387581c2eb0d1c794e.

Readiness counter schedules a declared fault attempt (2026-10-16 EAT)
-------------------------------------------------------------------
One comment explains absent counter storage as this fault scenario's first
intercepted readiness publication attempt. It does not infer no engine effects
or retirement from absence. Existing inspection-startup consumer requires count4,
one fault, exact run/run/build calls with no inspection/next reporter, retained
owned paths and no image record. Those observations earn the fourth-attempt
schedule; a constructor-required field would not strengthen that contract.
Arbitrary history deletion or concurrency safety is not claimed. Malformed
present counter text still fails instead of resetting.

Independent review corrected wording before runtime: four ATTEMPTS, not four
published receipts; the fourth exits47 before mv. Original V1/unrun qualifier is
preserved. Rootformat08a5b1 exits0 with AST parity/unchanged61c38d7f bytes;
root70806 passes the existing method in4.014s plus Ruff/checkformat. Wholeengine
AST/Git0755/raw7 ordered parity, exact1 applicability removal, other149 files/
all150 modes and source/script/formatted/live endpoints pass. Independent source,
actual-consumer and final manifest audits pass. Frozen BASE3d6fa43 differs from
ENTRY4c9b59b; public livebcb7bba8 stays fixed during jobs, then root copies the
executed61c38d7f, separately final-bound. No new tests, body, ENV policy, repeat,
unknown-retirement guarantee or global-green claim. Exact evidence:
.work/qualification/checker-ready-counter-contract-20261016/REPORT.txt;
SHA256 37185688c5368490cef8bba355d2aba4c77fbcef7818474da0442c3a7a33f019;
EVIDENCE.sha256 6e8e3d5b7ab789503a5d0fb1e59b7428d582ad2b1bbd089175010745fa26b013.

Two call expectations state their finite cases (2026-10-16 EAT)
--------------------------------------------------------------
One wheelhouse comment explains the two successful PRINT argv forms and four
rejected forms, all without engine calls. One checker comment explains the
malformed-build stop before inspection versus seven later inspection faults;
the existing test independently observes exact call suffixes and preserved
predecessor image-record bytes. These are expected-result selectors, not
synthesized engine outcomes. Source review tightened 'publication preserved' to
'image record preserved'; the original unrun wording remains retained.

Rootformat71418 exits0 with both ASTs and ea6276e9/63a0e58c bytes unchanged;
root85878 passes the two existing methods in10.459s plus Ruff/checkformat.
Whole2 ASTs, distinct Git0755/0644, scoped raw16 and ordered remaining findings
stay exact; only two applicability findings disappear. Other148 frozen files/
all150 modes match. Independent source/actual/final audits pass. BASE/ENTRY4c9b59b
includes the Call boundary and excludes the orthogonal ready-counter comment.
Public live dd5f4143/0755 and bf5ec9cd/0664 stay fixed during jobs; root later
copies executed ea6276e9/0755 and63a0e58c/0644, separately final-bound as host
0755/0664. All source/script/formatted/live/mode endpoints pass. No new tests,
source reflow, runtime body, repeat or global-green claim. Exact evidence:
.work/qualification/call-scenario-dispositions-20261016/REPORT.txt;
SHA256 cd68959bad642f9edd92c20c9dd26508f1936a55c3267f99c5001c6f7abe0534;
EVIDENCE.sha256 fa6e798e728b431e8a3e7c14389d3b601c8a50dc38631a1ee6cee24dd9125f49.

Fresh unfiltered inventory after call dispositions (2026-10-16 EAT)
-----------------------------------------------------------------
Root5973 exits0 on clean d2c9fd314015892d4b62f761cfa0abd84c1a3ed2:
82 Python files,196 raw findings,81 applicable findings across22 paths (78
expressions, one signature default, two exception fallbacks). Unchanged29b63651
collector directly calls maintained collectors without filtering, retaining full
ordered lists and every per-path row including zeros. Source150 Git blobs/modes,
HEAD/index cleanliness, runner/collector and output endpoints verify. Independent
final audit passes. Git2.39.5, Make4.3, Ruff0.15.15 and cached9164 offline/RO grants
remain exact. Categories are review guidance, not bug counts or exemptions; no
applicable tools/ entry alone proves neither production nor fixture correctness.
No property pass, test run, repeated scan or acquisition. Exact evidence:
.work/qualification/python-default-inventory-after-call-dispositions-20261016/REPORT.txt;
SHA256 784e270f82469faf31f05829c3b804813cbdd6f9987f39bee30b8be9417c40a7;
EVIDENCE.sha256 a3a24fd25f4d1749f685e4e15430a6f35496ec9e0b6bdf64ae6af024a0ff9f8e.

Baseline admission owns its finite inspection status (2026-10-16 EAT)
------------------------------------------------------------------
The optional status getter was a declared finite exit control, not a missing
external daemon outcome. Its real owner gap was ambient status leaking into
ordinary admission. Admission setUp now owns only status0; BaselineClient's
existing alias inherits that owner. Per-call faults still override it. The
standalone wrong-revision caller declares0 locally. The producer requires the
field at its original final return, after modeled stdout/diagnostics/type
mutations/hold: no reordered effects, new validator or broad profile reset.
Prior analysis/rationale is preserved at baseline-admission-defaults-study-
20261015/PROPOSAL.txt, SHAfe333c6c7dd68cd9af9757026bb6ce254118ee9f34cea0abd4657e65b488a53f
under .work/qualification/; the new proposal distinguishes that meaning from
the concrete ambient-isolation defect rather than treating every getter as a bug.

One new method constructs the real fixture under ambient37 and observes normal
image→run success, then fresh missing-owned-field failure1/image-only/no run.
Exact already-written metadata stdout and causal KeyError remain private. The
existing five explicit nonzero statuses, standalone wrong-revision and normal
Client consumers preserve cross-owner behavior. Repeated self.setUp reuses the
existing registered-directory cleanup lifecycle; no nested TestCase machinery.

Rootformat19048 exits0 with AST parity/unchangedfb6eb8e6/98af6309 bytes;
root36153 passes four methods in12.733s plus Ruff/checkformat. Exact import/
constructor/newmethod/lookup/standalone restoration preserves all old assertions
and effect order. Scoped raw/applicable ordered lists lose only this getter;
other148 frozen files/all150 modes match. Independent source/actual/final audits
pass. BASE/ENTRYd2c9fd3; original86f0 candidate owner bytes match that base.
Public live9484e4b2/0755 and525a0251/0664 stay fixed during jobs; root later copies
executedfb6/98af (project0755/0644) as host0755/0664, separately final-bound.
Source/script/formatted/live endpoints pass. The fresh inventory paragraph above
is outside this execution projection. No effect-free/no-engine-on-missing,
scientific execution, general ambient isolation, repeat or global-green claim.
Exact commands/results/limits:
.work/qualification/baseline-inspection-status-ownership-20261016/REPORT.txt;
SHA256 6b1158f30721ca01522c6db428d324a5c5f1c9ade22cef2b2fdcddb7beb4202f;
EVIDENCE.sha256 073db6141132b948c31104fa2481b02b12a166126f7f89d1719345adcbc0d39f.

Admission-only launcher fixtures declare no worker success (2026-10-16 EAT)
--------------------------------------------------------------------------
The old run_status0 default was never consumed: five omitted-status callers stop
at PRINT/admission/rejection; the sole dispatched worker explicitly declares19.
The helper now uses None for no declared worker outcome, revokes the exact
inherited FAKE_RUN_STATUS, then supplies only an explicit value. The existing
required engine lookup stays unchanged. This removes unused synthesized success
rather than adding a normal-success test just to justify it. Existing pop-contract
grammar records the revocation; no new policy or status schema is introduced.

One new actual copied-controller/finite-worker case poisons ambient0 and omits
status, supplies valid image/normal inspection, then requires1, causal KeyError,
empty stdout and exact image→run attempt evidence/worker argv. Both old implicit0
and ambient pass-through would defeat that consumer. The existing explicit19
status/metadata cleanup method and every earlier admission assertion stay exact.
No actual engine/scientific execution, rollback or no-dispatch claim is made.

Rootformat51767 exits0 with AST parity/unchanged545af6dd bytes; root37982 passes
seven methods in17.115s plus Ruff/checkformat. Exact signature/environment/pop-if/
import/newmethod restoration preserves all12 old test ASTs and required engine
body. Raw replaces function-default0 with the annotated revocation; applicability
removes only function0, with ordered remainder exact. Other149 files/all150 modes
match. Independent source/actual/final audits pass. BASE/ENTRY8771f8c; old live
1355/host0775 stays fixed during jobs, then root copies executed545/project0755
as host0775, separately final-bound. Source/script/formatted/live endpoints pass.
No repeats, invented success coverage, unrelated-lane run or global-green claim.
Exact evidence:
.work/qualification/launcher-worker-outcome-authority-20261016/REPORT.txt;
SHA256 f62138d02191440d3c38e1ffa4ff86a97e133b2db8b0f04b73784a840e7ff48e;
EVIDENCE.sha256 140c39915ed9618a5bbd98bcdc53a34de581f70002485a1a930563cef89fd976.

Operator fault expectations preserve admission authority (2026-10-16 EAT)
------------------------------------------------------------------------
Three comments describe authored role/status expectations. Malformed proxy CID
permits no start/removal; malformed worker CID permits only the already-admitted
proxy's effects. The retained proxy/worker receipt is independently compared
against c/d plus raw NUL bytes. The native status-only counterexample returns
124/7, yet probes must still reject missing/wrong exact fault-entry markers;
child-bearing cases independently verify exact owned-child cleanup. Expected
numeric status is never substituted for admitted identity or observed entry.

Rootformat666041 exits0 with AST parity/unchangedce167fc1 bytes; root78874 passes
two existing methods/subcases in1.617s plus Ruff/checkformat. Whole AST/Git0644/
ordered raw3 stay exact; only three applicability findings disappear. Other149
frozen files/all150 modes match. Independent source/actual/final audits pass.
BASE/ENTRY8771f8c excludes launcher edits; old public livec134/0664 stays fixed
during jobs, then root copies executedce167/project0644 as host0664, separately
final-bound. Source/script/formatted/live endpoints pass. No new tests, body,
reflow, policy change, repeated run or global-green claim. Exact evidence:
.work/qualification/operator-fault-expectation-contracts-20261016/REPORT.txt;
SHA256 8d7d39f164c27129e7a6807922daa7f4bbcaa759fef6819d70d131768125eeb4;
EVIDENCE.sha256 11b23440fe2f5a62509ede9310dfaa4af3af183553859df429f3e8a8c352ac96.

Native clients own their ordinary behavior (2026-10-16 EAT)
----------------------------------------------------------
CapturedNativeTests now owns only NATIVE_BEHAVIOR='' beside its existing status.
Stdio aliases and controller composition inherit that owner. Ambient behavior
can no longer select a stream/lifetime fault for an ordinary client. The required
read stays after observation-path binding, before stdin/observation publication/
streams/descendants. Other controls and accepted behavior strings are unchanged.
One new finite stdio consumer constructs under ambient stream-finite, observes
normal empty streams/success/retirement, then fresh direct missing-field failure1
with exact KeyError/no stdout and no observation or pending file. Existing
explicit timed/untimed binary-stream statuses0/7/137 and missing-STATUS consumers
preserve override and later-status consumption. No resistant poison or new helper.

Rootformat58389 exits0 with AST parity/unchangedce343eb6; root19149 passes three
methods in16.015s plus Ruff/checkformat. Exact constructor/newmethod/same-position
lookup restoration preserves all old ASTs/assertions; scoped raw/applicable lists
lose only the behavior getter. Other149 frozen files/all150 modes match.
Independent source/actual/final audits and all recorded endpoints pass. BASE/
ENTRY4d36874; livebbb5d4c6/0755 stays fixed during jobs, then root integrates
executedce343/0755, separately final-bound. Direct missing-field execution does
not prove shared-owner retirement. No broader profile, lifetime protocol, native
suite, build/scientific run, repeat or global-green claim. Exact evidence:
.work/qualification/native-behavior-ownership-20261016/REPORT.txt;
SHA256 5726df21ce1e9aec0f34864702db26fd6bfd83856816695f15e20774841e05c6;
EVIDENCE.sha256 caccb68b1e5a3f1fe32ccc0b6a5f4da4b9a70d95a5f81a8c4932a5b31b01c84a.

Build-input cases declare expected sets, names and payload form (2026-10-16 EAT)
-----------------------------------------------------------------------------
Three comments explain inference-only recursive admissions, the declared base-
variable/build-argument mapping, and oversized identity's byte-count stimulus
versus smaller literal payloads. Existing consumers read actual ignore/launcher
source and reject malformed identities while preserving predecessor bytes/inode/
directory. They do not establish an actual image build, exact oversized output
count, cap cause or reached failure phase. Lambda Path-remapping stays visible;
no source reflow, new helper, policy boundary or tests are introduced.

Rootformat86144 exits0 with AST parity/unchanged34f39a69; root43246 passes three
methods in2.478s plus Ruff/checkformat. Whole AST/Git0644/raw4 ordered parity,
exact3 applicability removals with Lambda getter retained, other149 frozen files/
all150 modes and recorded source/script/formatted/live endpoints pass.
Independent source/actual/final audits pass. BASE/ENTRY4d36874 excludes orthogonal
native edits; live63a858/0664 stays fixed during jobs, then root copies executed
34f39/project0644 as host0664, separately final-bound. No repeated run or aggregate
property claim. Exact evidence:
.work/qualification/build-input-scenario-contracts-20261016/REPORT.txt;
SHA256 7664e17967220e014b9532e590a5c2a3b88c25c7a946da20f6b53b549fd55c25;
EVIDENCE.sha256 b57c02bdd26480bf427cf0242a0fbd3f91648038838f128064016018b97fa425.

Source-closure fixtures declare drift and Git-mode expectations (2026-10-16 EAT)
-------------------------------------------------------------------------------
Two comments explain changing the first hash digit to another valid hex digit
and translating the already-admitted100644/100755 Git modes to0644/0755 expected
filesystem modes. Actual source verification rejects content drift; actual
materialization checks bytes/modes/identity independently. Coverage is explicit:
this fixture materializes0644, then chmod0755 tests digest sensitivity. It does
not separately materialize a Git100755 blob. No new test or mapping is invented.

Rootformat25524 exits0 with AST parity/unchangedab27ec6e; roote24526 passes the
two existing Git-fixture methods in0.063s with Git2.39.5, Ruff/checkformat.
Whole AST/Git0644/raw2 ordered parity, exact2 applicability removals, other149
frozen files/all150 modes and source/script/formatted/live endpoints pass.
Independent source/actual/final audits pass. BASE/ENTRY4d36874 excludes other
owners' changes; live3b593e42/0664 stays fixed during jobs, then root integrates
executedab27/project0644 as host0664, separately final-bound. No repeated run,
upstream execution, complete mode-branch coverage or global-green claim.
Exact evidence:
.work/qualification/source-closure-fixture-contracts-20261016/REPORT.txt;
SHA256 73746986391af03f149253447ba483b096c38cc0f81a0baa0efb88f9037c3223;
EVIDENCE.sha256 64749b69c1a5dff2720437f744c21aa08d66e36f591a5b6d819c27e91cc40b2d.

Fresh unfiltered inventory and native publication ownership (2026-10-16 EAT)
---------------------------------------------------------------------------
The clean b8258b9 snapshot has82 Python files/194 raw/70 applicable findings
across20 paths:68 generic expressions/two exception fallbacks/no function
defaults. Root32624 exits0; unchanged collector29b63651 scans150 Git blobs.
Independent final audit verifies source/modes/HEAD/tool/output endpoints. These
are review findings, not confirmed bugs or a global pass. Exact evidence:
.work/qualification/python-default-inventory-after-native-behavior-20261016/REPORT.txt;
SHA256 177ce954f12d72498f6d836fe0361e3eb76b8f3dfe880458c4c7ae6ad39e4b79;
EVIDENCE.sha256 a53773bcc5e99a726d6d05e2f6d717b792704b4959b68d63a38ad86c9752e590.

Native fixture construction now owns normal NATIVE_PUBLICATION_FAILURE=''.
Before: the global getter inherited an ambient fault even for ordinary clients.
After: mv requires the owned selector first in its branch, before control or
rename effects; head/rm acquire no unused prerequisite. Explicit faults remain.
The new finite ambient-status case proves ordinary quiet0/true retirement and
actual client exit. A separate fresh direct missing-field case proves1/KeyError,
unchanged source bytes/inode and absent target/control; actual head prefix-read
and rm deletion then succeed under the same missing-field environment. Direct
filesystem cases do not prove shared native-group retirement. The existing
explicit status/printf fault companion retains its private cause, promptness
and actual client/descendant retirement assertions.

Root formatter0 preserves AST/987b008f; qualifier97058 passes3 methods/5.676s
plus Ruff/checkformat. Exact restoration recovers all old AST/effect order/
assertions; ordered raw/applicable lists lose only this getter. Other149 frozen
files/all150 modes and source/script/formatted/live endpoints match. Independent
source/integrated/actual/final audits pass. BASE/ENTRYb825; livece343eb6/0755 stays
fixed throughout jobs, then root integrates executed987b008f/0755, separately
final-bound. Original unrun V1 is preserved; V2 separates ambient lifetime and
direct role tests without changing assertions. No repeat, broader schema,
native-suite, image/scientific or aggregate-green claim. Exact evidence:
.work/qualification/native-publication-selector-ownership-20261016/REPORT.txt;
SHA256 a0574d3f359b5b74ca1109ebb5289ba295281edd77736a8fe1b8ad3d6be93bd9;
EVIDENCE.sha256 f32352b5347967a20cf9dcea4e0db0dedf4c1d26800153e891f431dc9d68abd6.

Baseline inspectors own their finite fault selectors (2026-10-16 EAT)
-------------------------------------------------------------------
Before: ambient BASELINE_MUTATION/PRIVATE_ERROR/RECEIPT_TYPE selected corruption,
private bytes or nonregular streams in otherwise ordinary inspection. After:
the shared admission constructor and standalone wrong-revision caller each own
three empty normal inputs. Required reads stay at their original positions:
mutation before stdout, private error after stdout, receipt type after both
stream writes. Explicit scenario additions still override them; no aggregate
schema, early validation or change to other controls is introduced.

Two new tests separate ambient isolation from missing-input partial effects.
The ambient case deliberately requests status7 so receipts remain observable:
exact normal stdout, empty private stderr and regular nonlink streams prove
that all three poisoned inputs were overridden. Fresh missing-field cases fail1
with image-only attempts/no scientific run/private KeyError; stdout is empty
for missing mutation and already canonical for the two later reads. Existing
mutation/nonregular/private-warning/status consumers, standalone wrong revision
and inherited BaselineClient normal configuration/environment coverage remain.

Root format0 preserves both ASTs/e8f6623f+c60f2b13; qualifier2236 passes9 methods
in36.055s plus Ruff/checkformat. Exact constructor/read/new2 restoration recovers
all old ASTs/assertions/IDs and effects; ordered raw/applicable lists lose only
three getters. Other148 frozen files/all150 modes and every recorded endpoint
match. Independent source/integrated/actual/final audits pass. Actual BASE/ENTRY
7fd0247 excludes other pending owners. Livefb6eb8e6/0755+98af6309/0664 stays fixed
through jobs, then root copies executed e8f6623f/0755+c60f2b13/project0644 as host
0664, separately final-bound. Original b825 proposal/V1 remain unrun; V2 only
splits natural tests. No repeat, broader fixture profile, scientific execution
or aggregate-green claim. Exact evidence:
.work/qualification/baseline-inspector-selector-ownership-20261016/REPORT.txt;
SHA256 c5360deb26bec20787ca1bdc042b20aa1c3fc50324cb587878290be3f3396652;
EVIDENCE.sha256 40ea611ae914094cf60e960bd24326727c42d9e35f1a723df428f968e1f455c6.

Launcher inspection mode ownership and suffix encoding (2026-10-16 EAT)
---------------------------------------------------------------------
Before: checker_checkout inherited FAKE_INSPECT_OUTPUT, so ambient nul could
reject an ordinary inspection. After: that constructor owns normal; required
consumption stays after the engine-attempt log and OBSERVED_IMAGE encoding,
before fault branches or stdout. Worker-outcome declaration/revocation remains.
New separate finite cases prove ambient nul cannot block ordinary image/run0,
and a fresh missing key fails1 with image-only log, empty observed-id and private
KeyError/no public traceback. Missing input is explicitly not effect-free.

A separate local suffix-table comment explains named malformed endings versus
ordinary LF. Existing six-fault consumers check raw bytes/status/private causes
and no worker; the existing normal worker19 proves exact admission and metadata
cleanup. The oversized capped prefix does not observe its final LF; hang need
not reach suffix publication; unknown selectors remain unchanged. No new schema
or declaration-only waiver test is introduced.

Root formatter0 preserves AST/0cdc7ec6; qualifier48340 passes4 methods/16.251s
plus Ruff/checkformat. Exact constructor/new2/lookup restoration preserves old
AST/assertions/effects; ordered raw loses one getter, applicable loses getter
and suffix, with all remaining findings retained. Other149 frozen files/all150
projected modes and every source/script/formatted/live endpoint match.
Independent source/integrated/actual/final audits pass. BASE/ENTRY7fd0247 excludes
orthogonal baseline/native work. Live545af6dd/host0775 stays fixed through jobs,
then root integrates executed0cdc7ec6/project0755 as host0775, separately bound.
Original V1 stays unrun; V2 separates natural cases without assertion changes.
No repeated run, production/scientific or aggregate-green claim. Exact evidence:
.work/qualification/launcher-inspection-output-ownership-20261016/REPORT.txt;
SHA256 ca2076b2b8b16d71e816dff97217824f9a7f4bc341f54a6e18031e490b901e54;
EVIDENCE.sha256 5bf26e819c74958bc219f7837b783deb89ec3b4de49277c05b1ddc0dc4ed279e.

Native status mutation belongs to its consumed roles (2026-10-16 EAT)
------------------------------------------------------------------
The shared constructor owns normal NATIVE_STATUS_MUTATION=''; ambient text can
no longer corrupt an ordinary status. mv requires it only for target status,
at the original position AFTER legitimate control-card/earlier fault effects.
head requires it behind the original role/path short circuit. Other head,
non-status mv and rm gain no unused prerequisite. Explicit mutation cases and
unknown-selector behavior remain; this is input ownership, not a new schema.

New finite ambient and direct missing-field cases distinguish actual client
retirement from filesystem-role effects. Missing status mv/head each fail1 with
private KeyError, preserved pending/read-status bytes+inodes and absent rename
target, while acknowledging mv's already-published control card. The same missing
environment permits real ordinary move/read/delete. The existing explicit read-
error/byte/typed/link matrix retains its status/cause/retirement assertions.

V1 format0 then qualifier1 stopped at Ruff SIM102 before proof/tests. Its nested
head condition was unnecessary; V2 restores the original single and-chain with
required lookup. Failed epoch is preserved; no lint waiver or assertion change.
Root V2 format0 preserves AST/50cb7e05; qualifier29491 passes3 methods/30.318s
plus Ruff/checkformat. Exact owner/new2/mv/head lookup restoration recovers old
AST/assertions/effect order; ordered raw/app lists lose only one getter. Other149
frozen files/all150 modes and recorded endpoints match. Independent source/
integrated/actual audits pass. Explicit BASE7fd differs from ENTRY3005383; no
orthogonal overlay is executed. Live987b008f/0755 stays fixed during stages, then
root copies executed50cb7e05/0755 after terminal, separately final-bound. Direct
cases do not prove native group retirement. No repeated failed behavioral test,
broader native-suite/scientific or aggregate-green claim. Exact evidence:
.work/qualification/native-status-mutation-ownership-20261016/REPORT.txt;
SHA256 5e9691375a1cd15639d64f1c0d7f9042648082e653b7ec05bbd119759796f3d3;
EVIDENCE.sha256 fd72f7d2f6d9dec2f4a3bc7e05efc22d060759053377b2d78fcc493f51cf0842.

Full current gates expose the remaining closure (2026-10-16 EAT)
--------------------------------------------------------------
On clean f1807c422dfcbe2926281d133a69023df0c0358f, maintained make test/unit
passes382 tests/759.234s (root75503 exit0). Maintained make test/repository runs
460 tests/453.815s (root61171 Make2), with458 successes and exactly two failures:
the Python-default gate reports63 findings, not63 confirmed defects; assertion-
message posture reports one positional assertTrue diagnostic at checker launcher
line258. No other failure/error is reported. Full raw findings remain retained.
Both lanes' endpoints0 bind205 tracked files (150 parent/55 upstream), bytes/
modes, HEAD/index, gitlink/upstreamHEAD, scripts and checker image record.
No tracked mutation occurs until both terminals; parallel lanes use independent
private clients/scratch and maintained offline contained grants. This is endpoint
conservation and a unit pass, not a repository/foundation pass or live-container
inspection. Later changes cannot be retroactively qualified by this epoch.
Exact evidence:
.work/qualification/foundation-current-gates-20261016/REPORT.txt;
SHA256 04f0737fbc5684fab5b33c95237e267d6220079d2c33591a541fa68eb0c652d2;
EVIDENCE.sha256 d0bbdc6e52b83571c478181cef37b50fa0f7d4881343250cac16e12699374a20.

The observed assertion violation is repaired only by adding msg= to the existing
cleanup callback diagnostic. Deferred cleanup, its bool assertion, registration
before setUp and failure text remain unchanged. Root qualifier2237 passes the
maintained repository-message property and actual constructor-cleanup consumer:
2 methods/1.435s, Ruff/checkformat0. Exact keyword-to-original-positional AST
restoration preserves the old owner/lifecycle; actual detector reports old1/new0.
All recorded byte/mode endpoints pass; BASE/ENTRYf180, live63a0e58c/host0664 stays
fixed during jobs, then root copies executed140ff278/project0644 as host0664,
separately final-bound. No new test, policy/default disposition or broad rerun is
introduced. The previous full-run result remains historical, not all-green.
Exact evidence:
.work/qualification/checker-cleanup-message-keyword-20261016/REPORT.txt;
SHA256 b0fef5b6226ebd16ece1a224f91f89c21aa60a2621b7ab6f6e30cc8682162dc6;
EVIDENCE.sha256 c0ac5f1ec0012ced066daf3dae750f85feca4f6da674451370fbf6d6c950afed.

Admission removal fault ownership after full-gate triage (2026-10-16 EAT)
-----------------------------------------------------------------------
The63 findings span19 test/fixture files, with no additional production defect
proved. Triage groups cleanup scenarios, metadata projections, optional calls/
observed-only rescue, argv/mount parsing, expected data and checker observation
mechanics. Those purposes do not preapprove annotations: strict ENV/lambda sites
and absent-observation authority remain separately reviewable.

One concrete isolation risk is fixed here: ambient BASELINE_REMOVE=partial could
alter ordinary admission. The shared constructor now owns its empty normal input;
the required read stays inside admission-path removal before any deletion. The
Client alias inherits that owner. The standalone wrong-revision caller installs
only docker, so it gains no unused rm input. Other removal roles are unchanged.
New ambient coverage proves real admission deletion/run0/config cleanup. Fresh
missing-input cases show inspect0 fails1 before deletion, preserves exact raw
private receipts and exposes the mechanical rm KeyError with attempted-path
uncertainty; inspect7 stays7 and retains its private cause without consuming the
unused removal selector. Existing fail/partial and interrupted-removal tables
and inherited Client normal behavior remain exact. Missing removal diagnostics
are public here; inspector private causes remain private.

Root qualifier60721 passes5 methods/12.735s plus Ruff/checkformat. Formatter
562af23b to c3252c06 preserves AST; exact field/read/new2 restoration recovers all
old AST/assertions, ordered raw/app lose only one getter, other149 frozen files/
all150 modes and recorded endpoints match. Independent source/integrated/actual/
final audits pass. BASE/ENTRY2f1865c, livee8f6623f/0755 stays fixed during jobs,
then root integrates executedc3252c06/0755, separately bound. Original V1's wrong
expected LF is preserved unrun; V2 expects exact os.write bytes. Independent study
was recovered byte-exact under a separate reviewer filename after private study
name collision. No failed runtime, broad profile/schema or aggregate-green claim.
Exact evidence:
.work/qualification/baseline-removal-selector-ownership-20261016/REPORT.txt;
SHA256 6d4d198d3fb7fbc8f047058410eef3ee17f165aaecfffd71ecb7f537967b6c15;
EVIDENCE.sha256 4123223c85f4b4da51395f286e202cc2a7c5017f39d992b28d343965d1efb89f.

Finite fault scenarios close eleven classifications (2026-10-16 EAT)
-----------------------------------------------------------------
Eleven local comments across Docker-client, inference-client and package-input
fixtures explain declared fault programs and expected status/call-count/path
encodings. Existing assertions separately establish actual receipt/path effects,
private causes, signals and admitted retirement; the conditional expectations
supply none of those observations. ENV activation, payload observation and other
optional composition remain visible. Independent review corrected TERM wording:
the held-publisher test signals the caller and checks retirement, without proving
signal delivery to the publisher. No executable code, assertions or tests change.

Contained formatter/Ruff/mechanical qualification exits0. Whole three ASTs and
ordered raw findings match; applicability loses exactly3+6+2 reviewed findings,
with ordered remainder, other147 frozen files and all150 modes conserved. The
three predecessor files match f180 fullgate source hashes, and ten named owning
methods have exact retained success entries (3 unit/7 repository). These body
executions are historical; no lifecycle tests are repeated for comments. New
classification behavior is directly qualified. Final full gates remain required.

Independent source/mechanical/integrated/final audits pass; BASE2f1865c versus
ENTRYef9440b and old live owners versus post-terminal root copies are separately
bound. Source/evidence/script/formatted/live byte/mode endpoints pass. Original
wording remains unrun. Initial self-including evidence manifest was preserved and
corrected before final verification; no runtime was repeated. No policy change,
strict-input waiver, scientific or aggregate-green claim. Exact evidence:
.work/qualification/finite-fault-scenario-contracts-20261016/REPORT.txt;
SHA256 c287cb0beb928d65d03bb79e9a53d09c0006732ca7cc274a21605fdbc29d162e;
EVIDENCE.sha256 4b61b5f41e4bfe9d7dfd0c6b7388378065d08a80d39f25dba8d35d20ec130330.

Expected-data encodings close four classifications (2026-10-16 EAT)
------------------------------------------------------------------
Four comments distinguish constructed expectations from missing observations:
a different valid hex digest tests actual ZIP rejection; a finite Git double's
dirty state alone emits the expected porcelain line; present None selects the
pinned solvent map/unknown category while absent input preserves missingness;
synthetic Ruff versus Git/Make declarations select their declared package hosts.
Existing consumers earn each encoding, including the checker foreign-host
negative. Coverage stays synthetic/local or pinned-source selection: no download,
real-Git state inference, package-host Cartesian matrix or scientific accuracy.

Root contained format/qualify exits0 with Ruff/checkformat, whole four ASTs/raw
ordered parity and exactly four explicitly approved applicability removals.
Other146 frozen files/all150 modes match. Four predecessors match f180 fullgate
source hashes and five exact retained success entries (2 unit/3 repository).
No lifecycle methods are repeated; current qualification proves annotation
mechanics, with body execution retained historically. Final full gates remain.
Independent source/mechanical/integrated/final audits pass. Proposalef944 versus
execution BASE/ENTRY791c102 and post-terminal integration are explicitly separate;
source/evidence/script/formatted/live byte/mode endpoints pass, host0664 distinct
from project0644. No policy, assertions, fixture data or upstream changes.
Exact evidence:
.work/qualification/expected-data-scenario-contracts-20261016/REPORT.txt;
SHA256 39f4a719a69acfacbee67c74cf9d1349b660bc69204fcc496352d730dd52c67b;
EVIDENCE.sha256 f084eb360dd478b583e534da5696b9489f19543f044ed2c40fde6d0451e3300f.

Build output exposes its two producer modes (2026-10-16 EAT)
-----------------------------------------------------------
The former ENV ternary encoded an optional generated-fault payload versus a
required ordinary build result. Explicit if/else now names build_output and
keeps one trailing-LF write. No input waiver/helper/schema is added. Absent or
empty byte selector still requires BUILD_RESULT; string0 selects generated empty
output; generated mode never needs the ordinary result. Evidence publication,
conditional ENV reads, missing-result failure and later status handling remain.

Root qualifier55170 passes the two existing ownership/oversized-identity consumers
in3.361s plus Ruff/checkformat. Proof validates the exact branch/write shape and
two stores/one load, reverses it to the original whole AST, removes only the old
expression from ordered raw/app lists and conserves other149 bytes/all150 modes.
This is structural restoration, not universal Python evaluation-order identity:
stdout.write method lookup moves after ENV reads; standard stdout is unmodified
in this finite fixture. Actual supported consumers pass without a new test.
Independent source/pre-run/actual/integrated/final reviews pass. BASE791c102 versus
ENTRY9ec13d4 excludes orthogonal expected-data comments; live0cbb1876/0755 stays
fixed through jobs, then root copies executed8b7ff9d6/0755 after terminal, with
separate integration observations. All recorded endpoints pass. No checker-policy
change, repeated runtime, actual image build or aggregate-green claim.
Exact evidence:
.work/qualification/build-output-producer-modes-20261016/REPORT.txt;
SHA256 643f9ff865e5d2517c2ed0ef960cb1529e90ef4e27ffd6150809b6b1fabcd15d;
EVIDENCE.sha256 8da136c68e1ffb70d42ff1b8213451d3fcde74a7914b15a3b23c0bb7d5e85747.

Invocation composition closes six classifications (2026-10-16 EAT)
----------------------------------------------------------------
Six local comments explain omitted/provided scenario overlays, early scratch
versus ready-publication failure, permitted effects after rejected proxy/worker
identity, and the exact printed wheelhouse write boundary. None/empty overlay
equivalence is mechanical; no explicit-empty runtime case is claimed. Missing
required selectors remain missing. Expected effect lists do not admit identities;
printed mount checks do not prove executed filesystem writes.

Contained formatter/Ruff/qualifier exits0: whole four ASTs/raw order unchanged,
exact6 applicability removals (1+1+2+2), other146 bytes/all150 Git modes conserved.
Eight exact historical successes bind the predecessor owners: baselinec325 uses
two removal-qualification methods; other owners use six f180 unit successes.
All retained reports/manifests/logs are hash-bound and RO. Current evidence is
annotation qualification, not replayed lifecycle execution or a fullgate pass.
Independent source/pre-run/actual/integrated/final audits pass. BASE0180fc1 versus
proposal9ec13d4 and post-terminal root integration are separately recorded; all
source/evidence/script/formatted/live endpoints pass. Host0755/0664/0755/0755
versus projected0755/0644/0755/0755 remain distinguished. No policy, helper,
assertion, new test or upstream change. Final full gates remain required.
Exact evidence:
.work/qualification/invocation-composition-contracts-20261016/REPORT.txt;
SHA256 8f47bdb5a400dae912dc9bf833b6095a9de37f8794427f8ab84c093fb265d00e;
EVIDENCE.sha256 2d7da8713807a8a4f6d52ebf2aef2bf18f321197bdeb507ee9aa5651c5f459e5.

Package controller scenarios become complete rows (2026-10-16 EAT)
-----------------------------------------------------------------
The cancellation flag and three derived fault inputs now form an explicit two-
row matrix: True/hold/1/0, then False/pass/0/143. This preserves the distinction
between actual TERM and ordinary numeric143 despite their shared expected final
status, with all existing effect/retirement assertions and scenario order intact.
No helper, new test, ENV-activation or policy change belongs to this slice.

Initial preparation refused global HEAD==BASE after orthogonal commits; subsequent
format/qualify entrypoints also failed prerequisites before creating containers.
The original scripts/attempt record remain. V2 drops only that unnecessary global
HEAD constraint, retaining immutable Git0180 projection, owner-specific predecessor
equality and separate ENTRY88b recording. Root executes stages sequentially only
on predecessor success. No behavioral test ran in the original attempt.

Root V2 qualifier84181 passes the existing two-row controller method in11.799s
plus Ruff/checkformat. Exact row/name-consumer checks restore the original scalar
loop/three conditionals and whole old AST; ordered raw/app lists lose exactly3
expressions. Other149 frozen files/all150 modes and recorded endpoints match.
Independent source/pre-run/actual/integrated/final audits pass. Live SHA256fda28bfb source
remains fixed through stages; root copies qualified1a76cfdc/0755 after terminal,
separately bound. The concurrently qualified checker correction is excluded from
this BASE projection. No repeated failed runtime or aggregate-green claim.
Exact evidence:
.work/qualification/package-cancellation-scenarios-20261016/REPORT.txt;
SHA256 bf6f8a58bec8087736fe4df6b0d486688a68f32596461fe0cba359f1ed0c5407;
EVIDENCE.sha256 6b3ac36134bd55497c2a3c164e534afe5769fdd4a85a4975715d6630c028debd.

Boolean ENV activation guards retain raw evidence (2026-10-16 EAT)
----------------------------------------------------------------
Two flagged package-fixture ORs only choose branch truth for optional fault
activation; they do not supply replacement configuration. Applicability now
recognizes this context through If.test BoolOp/Not edges, requiring ENV evidence
per operand through boolean edges, a direct read or an existing comparison.
Value consumers stop traversal; opaque calls/attributes do not themselves supply
evidence. Comparisons retain the documented syntactic limits concerning aliases,
overloading and purity. No source rewrite or per-file waiver is needed.

Raw predicates/candidate generation stay unchanged. Assignment/return/call/
comparison/index/arithmetic/walrus value flow, literal/unrelated fallback arms,
opaque ENV-bearing calls and independent nested/body defaults remain strict.
Three regression groups exercise the actual repository property. Root qualifier
75051 passes42 methods/0.279s plus Ruff/checkformat, with all34 original contract
ASTs/IDs and five pure companions preserved. Exact helper/accepted-set/docstring
restoration recovers the old policy AST; only three new test methods are added.

Full unfiltered82-file snapshot BASE0180 raw186->186 is byte-identical; applicable
46->44 loses precisely those two package guards, with all other ordered findings
retained. These are snapshot counts, not current mixed-tree/global-green results.
Other147 frozen files/all150 modes and source/output/script/live/formatted/Git
endpoints pass. PORTS is separately bound. Independent adversarial source/pre-run/
actual/integrated/final audits pass. ENTRY88b and later root copies of executed
115ba270/5d7f32e5/doc4bda8ec0 are separately bound. The package-table slice is
excluded from this projection. Initial unrun harness/manifest are retained; adding
stage-exit HEAD recording changes no qualification authority or runtime test.
No raw weakening, annotation-policy broadening, package behavior change or full
repository pass is claimed. Exact evidence:
.work/boolean-gate-study/REPORT.txt;
SHA256 76858d869bdb93d08f066bde0856be96d009f02bedc3e9c8ba4b27073fdcb666;
EVIDENCE.sha256 055103345b0150f84dd81698feb10cb327136f267961bdea06f99cd857a9afc9.

Literal-record observation values own their contracts (2026-10-16 EAT)
--------------------------------------------------------------------
A comment immediately before one literal Dict key can now explain that entry's
value. Previously, independent kind/entries/config observations had no local
placement; extracting names merely to accommodate the checker would obscure
those fields. Existing raw detection, operator/CLI restrictions and callable
boundaries remain unchanged. All keys in the owning Dict must be constants;
computed/unpack records reject this placement. Ownership follows one immediate
key AST at matching indentation, not arbitrary punctuation. Sibling/key/enclosing
findings remain visible, including parenthesized literal siblings on later lines.

For example, this previously unplaceable contract is now expressible in place:
    observed = {
        # silent-defaults: allow-contract -- Absence is recorded for the consumer; proof=path.py::Tests.test_consumer
        "entries": sorted(path.iterdir()) if path.is_dir() else [],
    }
The example illustrates grammar, not an accepted proof reference: an actual
annotation requires an existing local test and reviewed meaning. No consumer
annotation is added in this policy slice, so no finding is waived yet.

Root V2 passes50 tests/0.298s and Ruff/checkformat. All37 prior contract ASTs plus
five new regression groups, shared scanner and five raw companions pass. Exact
whole-policy restoration confines changes to entry indexes/branch and explanatory
text. Full unfiltered82-path scan raw183->183 and applicable35->35 is identical;
all150 Git modes/147 non-owner files and execution endpoints match. Source/pre-run,
actual integration and final evidence audits pass. Root copies the qualified
formatted Python and separately bound PORTS after terminal0, retaining host0664.

Retained V1 failed before tests on a private proof's incorrect JoinedStr constant
selector. V2 first refused preflight because its manifest paths were relative to
the wrong cwd; no container started. Corrected absolute manifests and exact full
AST diagnostic matching preserve source/test candidates; successful formatter0
was reused. Successful V2 container/harness/endpoints are independently0. These
are qualification-harness corrections, not repository behavior failures. Final
aggregate gates remain necessary; no scientific/runtime qualification is implied.
Exact evidence: .work/dict-entry-study/REPORT.txt and EVIDENCE.sha256;
REPORT SHA25669bfd0458dd27d95829d79516ee3022e1872addb0dc7bc67ca9a8235bd9369d1;
EVIDENCE SHA25609b0fe886918ae01ac1bf9a97613452700febcc16fb3a12899a4ca3b2628888e.

Optional overrides and absent engine observations (2026-10-16 EAT)
----------------------------------------------------------------
Three comments explain existing contracts: acquisition/checker optional additions
supply no overrides when omitted; an absent Docker token records None so that
payload remains outside the original Docker-run fault target. The last comment
separately names admitted-anchor retirement rather than deriving it from absence.
For example, the existing additions or {} expression now has its reason/proof at
its owning caller or environment assignment; its source expression is unchanged.

Root V3 qualifies exactly3 applicability removals, whole-three-owner AST/raw and
ordered remainder conservation, other147 files/all150 Git modes, Ruff/checkformat
and all endpoints0. Three exact historical consumer successes are hash-bound to
the full checkpoint, with subsequent comment-only changes and the independently
qualified checker msg-keyword repair accounted for. No lifecycle replay, absent-
token/None/empty/rescue branch execution or new aggregate pass is claimed.

The first attempt correctly stopped on a gratuitous fourth annotation: the
expected-byte IfExp has BinOp branches and is never a default candidate under
the existing literal-branch predicate. Removing that comment is the complete
correction; there is no detector change. The original frozen proof already had
correct source spelling, so root's initial normalization diagnosis was wrong.
Original qualifier1 and unrun V2 diagnostic remain; V3 reuses formatter0 output
minus that comment and performs fresh format-check. All execution stages bind
BASE/ENTRY/END17e6617; integration after terminal binds13b65e3 separately. Independent
source/pre-run/actual/integration/report audits pass. Current residual32 is derived
from the separately measured35 and these3 removals, pending a fresh full scan.
Exact evidence:
.work/qualification/optional-observation-contracts-20261016/REPORT.txt;
SHA25684a490a7aa896fa16fd0f94d758dadbf2eadf34cce68b95c6ed2c04066d7b783;
EVIDENCE.sha256 b88a6e4398601bbaeb6a830b82d0584861dcc083b4dcb2aea7ca368100616c1f.

Metadata records observations, not replacement configuration (2026-10-16 EAT)
--------------------------------------------------------------------------
Eight field-local contracts use the qualified literal-record placement: shared
engine kind/entries, checker configuration path/mode/entries and package client
configuration path/mode/entries. Non-directory means other/[] in the shared lstat
observation; omitted --config means null configuration observations. Positive
consumers still require real private paths, mode0700 and empty directory entries.
No sentinel establishes successful admission, retirement or invented contents.
Before: a bare config_mode conditional supplied the recorded value. After: the
same expression has its observation contract/proof immediately above that key;
its code, raw finding and consumer assertions are unchanged.

Root prepare/format/qualify all0; Ruff/checkformat, whole-owner AST/raw identity,
exact8 application removals/ordered remainder, other147 bytes/all150 Git modes
and recorded endpoints pass. Named historical positive consumers are bound to
actual source hashes/log successes. Checker is exact f180; complete fixture and
package sources are qualified successors8b7ff9/1a76cf, with their unchanged
observation records and selected consumers separately AST-bound to f180. This
claims no whole-successor execution at f180, negative-branch coverage, lifecycle
replay or new aggregate pass. A successor-log parser defect was found and fixed
before execution. Independent source/pre-run/actual integration/report audits
pass; root copies executed formatted artifacts after terminal, retaining0755.
Residual24 is derived from32 minus8, pending the final full scan and gates.
Exact evidence:
.work/qualification/metadata-observation-contracts-20261016/REPORT.txt;
SHA256509e9dd427719aa97317fdc5b955aa116611e54dcc2a8bc3d9244e5682f46c67;
EVIDENCE.sha256 7f5fc683d2b1c92675be20c7fbd854c4a4c23c079742ddfda8f35c9572ba0dc9.

Single-line loop iterables own their contracts (2026-10-16 EAT)
------------------------------------------------------------
A dedicated preceding comment now owns only a For.iter expression ending on the
header line, under the existing generic/outermost/reason/proof/indentation and
operator/callable restrictions. Targets, body, else and siblings stay outside.
Multiline iterable and dedicated AsyncFor-header ownership remain unsupported.
Previously the whole loop was too broad a placement. Now an optional --mount
iteration explains omission at that header; all supplied mounts are still
checked. Acquisition's caller registry explains the absence of observed anchors;
it never turns missing observations into evidence of process retirement.

Root V2 passes54 tests/0.380s and Ruff/checkformat; full unfiltered82-file raw
183->183 and application24->22 lose exactly those two annotated iterables.
Whole-policy restoration, both consumer ASTs, all145 non-owner bytes/150 modes
and endpoints pass. Exact historical f180 source hashes and29 successful methods
bind the unchanged consumer bodies; no lifecycle replay, absent-registry or
zero-mount branch execution is claimed. Independent source/pre-run/actual live
integration and report audits pass. Root copies four executed formatted Python
files plus bound PORTS after terminal, retaining host modes.

V1 ran all54 tests with one real failure: a second old unsupported-For expectation
was missed in source review. V2 explicitly relocates both original For cases to
positive coverage and preserves all remaining old test ASTs/assertions. It
formats only the changed test owner and reuses the three other successful outputs.
The original failure stays retained; no detector is weakened to hide it. Final
full gates remain necessary. Exact evidence:
.work/for-iter-contracts/REPORT.txt;
SHA256d26f4bf68130271407f833b564532ac0476a5dc4c4cf25efc6b5233199165b0d;
EVIDENCE.sha256 b025ce8a5b2ebae4e2e388e49a659580a6ddde6991af8bdea6bee8c3c09e788b.

Comparison compositions remain predicates at value consumers (2026-10-16 EAT)
--------------------------------------------------------------------------
The assigned publication_failure value combines comparison predicates through
And/Or. Application classification now admits that OR's silent-default label
without rewriting the fixture or changing raw detection. Compare leaves compose
through BoolOp/Not in any consumer; bare ENV values, names, calls and literal
fallback arms remain strict. Nested defaults and a function-default label on the
same AST remain independent. Existing If-only ENV activation logic is unchanged.
This retains the existing syntactic limits: no alias, overload or purity proof.

Before: assigned OR-of-AND-of-Compare produced a replacement-input finding.
After: only that label is admitted; an ENV value OR replacement remains red.
Root qualifies58 tests/0.394s, Ruff/checkformat and full unfiltered82-path raw
183->183/application22->21, removing only that Docker predicate. All46 prior
contract ASTs, four new regressions, whole-policy restoration, other147 bytes/
all150 modes and endpoints pass. The merged candidate preserves the preceding
For changes. Independent source/pre-run/actual integration/report audits pass;
root copies executed formatted outputs and bound PORTS after terminal0.
No lifecycle replay or global green is claimed. This snapshot excludes the
orthogonal finite-output slice; combined18 is derived pending a fresh scan.
Exact evidence: .work/comparison-composition-study/REPORT.md and EVIDENCE.sha256.
e1f93f84508e6c399f2388e6b3951be9ee3f26db23bb4dede7c0ecd5b56f8845  .work/comparison-composition-study/REPORT.md
86b7cd98c93b3bcd246673f85b8d823be624defa599c9b9fbff873954f66212a  .work/comparison-composition-study/EVIDENCE.sha256

Finite fixture outputs share one descendant stream decision (2026-10-16 EAT)
--------------------------------------------------------------------------
Previously stdout and stderr repeated the same failed-leader/held-pipe choice.
A single descendant_output now owns both descriptors: failed-leader discards
both, while held-pipe inherits both to hold capture pipes until retirement.
This expresses their existing coupling without a helper or new mode. Child,
PID receipt, fault marker and status ordering are unchanged. The disagreeing
CID expression is unchanged and gains its finite contradictory-receipt contract.

Root cached contained qualification passes Ruff/checkformat and both existing
actual consumers in5.071s: create cancellation with retained contradictory bytes,
and failed-leader/held-pipe with independently observed descendant retirement.
Exact shared-selector restoration recovers the whole old AST. Fixture raw11->10
removes only a duplicated source decision; application3->0 admits the two actual
contracts. Raw policy is unchanged. Other149 bytes/all150 Git modes and recorded
endpoints match; each stage starts/ends0f459b0, while frozen BASE/ENTRYbb58e8d
remain separately recorded. Root copies executed formatted b6c250a5 after terminal,
retaining0755. Independent source/pre-run/actual/report audits pass.

The all-e input/all-f contradiction remains source reasoning: current cancellation
consumers exercise all-c/all-d IDs and all-e output. This frozen snapshot excludes
later orthogonal checker changes; combined18 is derived pending a fresh scan.
No global pass is claimed. Exact evidence:
.work/finite-fixture-outputs/REPORT.txt;
SHA25644ec9d376c79d6484cffc7b4a8987f115aeb611aab5350b158921c406c2bb9ab;
EVIDENCE.sha256 7be4db377457966a474ccade65142fdedf96b5f6e7c13a5086b9506038c1bafb.

End-to-end checkpoint and risk-based adjudication (2026-10-16 EAT)
---------------------------------------------------------------
Fresh maintained make test/unit and make test/repository ran at fixed8cadeba.
Unit384/790.093s:383 passes, one failure, no errors/skips. Repository476/469.888s:
475 passes, one failure, no errors. Both source/mode/Git/upstream/image/script
endpoint statuses are0, including all205 tracked files per lane. Unit failed
waiting five seconds for removal-ready before sending SIGTERM; its cause is not
established. An isolated unchanged test passed4.593s in the checker image, with
that image difference explicitly recorded. The missed marker does not establish
a production signal-handling defect.

The repository failure comprises18 findings in7 test/helper files, not18 proven
runtime defects. Risk review finds one real assertion blind spot: projecting any
non-worker CID to proxy ignores exact identity and deletion flags. The proposed
missing-entire-tmpfs mutation would add meaningful existing-grant coverage; the
checker already rejects absence via count0. Other findings record initialized
observer sets, optional overrides, mount flags, trace/receipt/phase observations,
full-pipe/race handling or required Path pass-through. Reviewed observation
contracts can use existing grammar; two Lambda placements remain discussion
points. Do not rewrite those behaviors or widen policy syntax merely to clear
all18. Prepared observer/grant comment candidates remain unapplied; their
container qualifications remain unrun.
Source contexts and exact18 are retained in the fresh repository stderr at8cadeba;
production-path absence in this finding list is not proof of production correctness.

Exact removal identity replaces a lossy role projection (2026-10-16 EAT)
---------------------------------------------------------------------
The attach-interruption test now compares complete ordered removal arguments:
    ["rm", "--force", "d" * 64], then ["rm", "--force", "c" * 64].
Previously any non-worker CID became proxy, and flags were ignored. The unchanged
rm filter preserves detection of missing, extra, repeated and reordered removals.
All other interruption/output/retirement assertions remain unchanged.

Contained qualification runs the actual existing test once and captures its real
D-then-C history. Executing the old/new assertion ASTs against mutations of that
history proves old acceptance/new rejection of wrong CID and missing/wrong/extra
flags. Candidate order/count rejection remains. Ruff/checkformat, exact whole-
source AST restoration, other149 blobs/all150 modes and recorded endpoints pass.
Root copies the executed formatted artifact after terminal0, preserving0755.
Owner raw9->8/application3->2 removes the lossy projection itself, with no policy
change or added annotation. Residual17 is derived from the measured18 minus1;
full gates will be rerun after the readiness correction. Independent source,
pre-run, actual integration and report/evidence audits pass.
Exact checkpoint and assertion evidence SHA256s follow:
5324a186e2c83434b7d22be07d60a3ef077e2651272e1985b098a56b2dfaa365  .work/qualification/foundation-e2e-gates-20261016/REPORT.txt
4fa6fc75f0b9787b2b72aa4aeb5774632a051f6735f446ff22260018418ef0bf  .work/qualification/foundation-e2e-gates-20261016/EVIDENCE.sha256
da9746991c64a5a0c2a49672753dd0c336205f61a1a8c4aa28e7fed5884f3a79  .work/exact-removal-assertion/REPORT.txt
5b66fc3aadf7c8fe3594e7e4a0e39babee00e88b697bfe603dabd5e46d4c2e2d  .work/exact-removal-assertion/EVIDENCE.sha256

Explicit observation budgets for the removal checkpoint (2026-10-16 EAT)
----------------------------------------------------------------------
The failed full-unit test never reached SIGTERM: its five-second setup wait
missed the post-build removal-ready marker. Cause remains unproved. The helper
now requires an explicit seconds argument: three existing waits retain5, and
this whole-build checkpoint gets15. This is bounded engineering tolerance,
not a production completion guarantee; it may hide slower setup and reports
an absent checkpoint ten seconds later. The failure names marker and budget.
The signal/release sequence, communicate(timeout=5), status143, exact streams,
removal/no-new-report/image retention assertions and cleanup bodies are intact.
No production script or upstream source changes.

Contained focused qualification: four existing signal/output methods pass in
26.862s; format/full-module AST conservation and recorded endpoints pass.
Frozen source8cadeba and live97cb1da are recorded separately. Cached checker9164
adds Git/Make/Ruff to the maintained Python base; this focused pass does not
prove equivalent full-lane behavior or explain the earlier failure. Root copies
only the executed formatted owner, retaining host0664. Independent pre-run and
actual evidence/source review pass; full maintained gates remain next.
Exact SHA256 references:
6beba2c4378b7215896a8c7a17ca3ea6e9d800c514c503faf28370d046c48318  .work/removal-readiness-fix/qualification/REPORT.txt
0987854c956b061ee8d006052a613f13dc620bfaa532fc17cffcc05820743ec5  .work/removal-readiness-fix/qualification/EVIDENCE.sha256

Missing-whole-tmpfs coverage without policy changes (2026-10-16 EAT)
-----------------------------------------------------------------
Add two lines to the existing writable-tmpfs negative test: remove the actual
rendered --tmpfs flag and its following value, then require rejection. Existing
missing-size, oversized and extra-grant cases and all comments remain intact.
The checker already rejects zero writable tmpfs mounts; this closes a coverage
gap rather than fixing demonstrated runtime acceptance. No new method, helper,
exception annotation or policy grammar. The fixture-rendered baseline is retained;
this selected method does not separately assert acceptance of unmodified argv.

The initial qualification harness incorrectly assumed historical raw182 and
stopped before the selected test; endpoints0. Preserve that attempt. Corrected
V2 compares old/new ordered inventories without guessing their count and reuses
pinned snapshots and the successfully formatted artifact. Existing method passes
once in0.398s; Ruff/format, exact whole-owner AST/byte restoration, other149 bytes,
all150 Git modes and recorded endpoints pass. Measured raw181/applicable17 are
unchanged. Root integrates the executed formatted two-line change, preserving
host0664. Independent pre-run and actual evidence/source review pass. Full
maintained gates follow; earlier four-comment candidate remains unapplied/unrun.
Exact SHA256 references:
cbb86c2dd4a7c7432c607afb9c20d44ff3c50e2758b9340be39f5f9430e8e2e0  .work/missing-tmpfs-coverage/REPORT.txt
7227d5cb1771a9ec484f40030810668d6a55c166750215280b59b7944dc7865f  .work/missing-tmpfs-coverage/EVIDENCE.sha256

Maintained gates after substantive corrections (2026-10-16 EAT)
-------------------------------------------------------------
At fixed clean2b18fb9865d8b7af4aea819976e14c3172c6f61d, actual maintained
make test/unit:384 tests/772.126s, all pass. make test/repository:476/457.041s,
475 pass, one failure, no errors/skips. Combined860/859 pass. Repository failure
is exactly17 findings in7 test/helper files from the silent-default property;
no whole-repository pass or completed foundation is claimed. Both per-lane
endpoint statuses0 cover205 tracked files (150parent+55upstream), source/modes,
HEAD/index/cleanliness, unchanged upstream pin, checker image record and scripts.
The previously failing removal-checkpoint method passes in this full unit lane;
that is current-test evidence, not proof of the original missed-marker cause.

Before: full8cadeba had unit383/384 and repository475/476, with18 findings.
After: full2b18fb9 has unit384/384 and repository475/476, with17 findings.
Exact-CID assertions remove a real acceptance blind spot. The missing-tmpfs
mutation covers absence already rejected by the consumer. Longer bounded setup
improves test tolerance while preserving the five-second cancellation assertion.

Risk disposition: two observer-set initializations, four writable-grant parser
representations, three package/mount helpers, three checker-engine observations
and three checker-launcher observations are candidates for precise contracts
using existing annotation boundaries. Review alone does not establish execution
of every contingency branch. Two mount-translation Path lambdas implement native
path pass-through but lack an existing owned annotation placement. They are not
established runtime defects. Do not force behavior changes, blanket fixture
exclusions or new grammar merely to obtain green. Existing observer/grant comment
proposals remain unapplied and their original qualifications unrun. The separately
trimmed missing-tmpfs case has the measured qualification documented above.

The public gate remains honestly red pending policy disposition; CI stays deferred.
No upstream changes, acquisition, image rebuild or push in this checkpoint.
Precise residual contexts: packet repository/stderr; rationale/evidence limits:
packet DISPOSITION.txt. Exact SHA256 references:
ec88a5aadf7cb20dff5f1b973ed6768da98c96758709bb9a32d4fc1f82ecaf1c  .work/qualification/foundation-final-gates-20261016/REPORT.txt
6293e8aceb1ca9b9dc47e9e2505812fec84b4ba4689357b1557500dc28ed818a  .work/qualification/foundation-final-gates-20261016/EVIDENCE.sha256

Four writable-grant representation contracts (2026-10-16 EAT)
-----------------------------------------------------------
Retain parser behavior and document its enforcing consumers: a missing next token
retains a forbidden option key, repeated options accumulate rather than overwrite,
unsuffixed sizes denote bytes, and absent tmpfs counts0 and fails the count1 guard.
Only four allow-contract comments are added; the whole-tmpfs mutation stays.
Contained qualification at8b101ad: Ruff/format, exact comment removal restores
all owner bytes/AST, ordered raw181 unchanged, application17->13 removes exactly
these four expressions. Three existing methods pass in3.123s; recorded endpoints0.
Unsuffixed-size coverage remains source reasoning, not a dynamic branch claim.
A common frozen150-file Git tree restricts the source grant and excludes private
.work copies; no policy grammar, runtime or upstream changes. Independent source,
pre-run and actual evidence review pass. Root integrates the qualified candidate.
Exact SHA256 references:
2d936f3970d009a48e41e1a9bafdd123c7394aed8f774d601642ed09f768f247  .work/grant-intent-closure/REPORT.txt
0c6ea60d8c1545a58a7eb599c999cc4409e784ec553b6f829b49aca6f8502911  .work/grant-intent-closure/EVIDENCE.sha256

Package and checker fixture representations (2026-10-16 EAT)
-----------------------------------------------------------
Six existing-boundary contracts document optional per-call overlays, bare mount
flags represented as True and checked by identity, separate cleanup ledgers,
inspection-only receipt paths, and the image-inspect hold-phase name. No behavior,
helper, policy grammar or proof method changes. Source reasoning covers alternate
phases, non-inspection receipts and supplied stage overlays; it is not branch
execution evidence. The named methods prove their specific consumer assertions.
Contained qualification at8b101ad: both ASTs identical, removing exactly six
comments restores both files byte-for-byte; ordered raw181 unchanged and exactly
six applicability removals17->11. Three existing methods pass in21.350s, with
Ruff/format and recorded endpoints0. Frozen150-file Git source grant excludes
private copies. Independent source/pre-run and actual evidence reviews pass;
root integrates the executed candidates. Combined counts await a maintained run.
Exact SHA256 references:
3a88e3f65491de6b063ec4f901df4db2dfcbecdcf87193d21c2cedb89b768bb0  .work/fixture-intent-closure/REPORT.txt
310b66b4ad537490cc2e2c09e59e96f00f655bc5acb342bb95ef25f2c761ab23  .work/fixture-intent-closure/EVIDENCE.sha256

Observation sets, full pipes and disappearing processes (2026-10-16 EAT)
----------------------------------------------------------------------
Five contracts explain the two caller-matched observer registries, absent call
ledger as no ledger candidates, nonblocking full-pipe stimulus, and disappearing
proc entries as no positive match. None authorizes signals from absence: rescue
rechecks live caller/session anchors, reporter identity and existing deadlines.
Existing proof references identify consumers, not execution of every fallback.
The current exact-CID assertion and fifteen-second setup budget stay intact.
Contained qualification at8b101ad: AST/byte restoration and raw181 unchanged,
exactly five applicability removals17->12; two existing methods pass in13.660s,
Ruff/format and recorded endpoints0. The first run stopped before proof/tests:
formatter output dropped the acquisition fixture's executable bit. Preserve its
EXE001/status1/endpoints0; V2 repairs only private modes644/644->755/644, with
identical formatted bytes, fresh receipts and no formatter repeat. Root copies
those qualified artifacts into the existing owners. Independent source/pre-run
and actual evidence review pass. Combined2 is derived pending maintained gate.
Exact SHA256 references:
103288ed7f692a5dab4fc42384a33822f50bb96f5d58a292322be14731b5a985  .work/observer-intent-closure/qualification/REPORT.txt
7f10f7e5f9b1b6e273a7c43a810d3d53bfebb73f76181719c9d36c829c5e9b65  .work/observer-intent-closure/qualification/EVIDENCE.sha256

Strict gate and explicit lambda-result ownership (2026-10-16 EAT)
--------------------------------------------------------------
Maintained repository gate at cleaneb1608f:476 tests/437.411s,475 pass, one
property failure listing exactly two Path-adapter defaults; recorded endpoints0.
This is measured, not derived. Its contract is zero applicable findings across
authored sources including fixtures (test_python.py at eb1608f:698-703 and
sources.py inventory), not zero raw candidates. These adapters map fixed mounts
into isolated fixtures and preserve generated native paths; replacing that useful
boundary or excluding fixtures would lose meaning or coverage. Earlier exact-CID
review demonstrated why fixture behavior belongs in the checks.

The user chose a plain explanation, without proof-reference ceremony:
    # silent-defaults: allow-lambda-body -- [explanation]
Require nonblank text immediately before the lambda default result at matching
indentation. Other tags retain their current rules. Operator inputs, nested
lambdas, siblings and surrounding consumers stay outside this admission.
Workshop result: "Redirect /input, /stage and /output into this test; generated
temporary paths already point there." A fresh reader understood both behaviors;
source review confirms the fixed mappings and temporary creation under mapped
output. No new adapter helper, raw detector change or production rewrite.

Explanation-only qualification:56 tests/0.411s all pass; Ruff and formatter AST
checks pass, including fixture parity against frozen source. Raw181 across82
files stays unchanged; exactly two applicable findings become0. Original final
endpoint1 is preserved: identical154 mode entries appeared in different order.
Independent review and corrected sorted old/after/current comparison0 establish
unchanged modes/hashes/HEAD/index without repeating tests. Root integrates the
four executed formatted artifacts; final maintained gates remain next.
Literal lambda signature defaults remain outside existing raw detection; the
signature-boundary test uses an independently detectable mapping default.
Follow-on review finds proof-symbol validation on the other tags similarly
ceremonial: even a pass-only method satisfies it. That separate deletion candidate
does not justify removing actual behavioral or filesystem-boundary tests.
Exact checkpoint and explanation-only evidence SHA256 references:
0cad25800af93762151e1c89b6626458682551d52efd5b19f9ed7fe0144ff3f1  .work/qualification/foundation-contract-gates-20261016/REPORT.txt
fd3d1e22b5c7f894ff9b4ded504e72e995a1198ea2ef93b8d2256e614fadc160  .work/qualification/foundation-contract-gates-20261016/EVIDENCE.sha256
75542d7bb1cfa7c8d44c65267f449c67a96ad00776a34f3cccd11bc1b740bc4a  .work/lambda-explanation-only/REPORT.txt
24257bef63f65336857880498b8aa52cef66c82b835a51a833177411e9f0fa6e  .work/lambda-explanation-only/EVIDENCE.sha256

Final maintained foundation gates (2026-10-16 EAT)
------------------------------------------------
Fixed clean63860066ce04370a2fdc99b940427f037b4998ba:
make test/unit:384/785.119s all pass; make test/repository:480/463.423s all pass.
Combined864 tests, no failures/errors/skips. Both actual Make/harness statuses0;
both endpoint statuses0 cover205 tracked source files, modes, clean HEAD/index,
upstream HEAD/gitlink, checker image record and scripts. No pending policy failure.
The explanation-only lambda tests and repository-wide zero-applicable property
pass in this full maintained run. Raw181 is the separately conserved focused
semantic inventory; fixture runtime ASTs remain unchanged.

Foundation requirement audit maps pinned contained checker/Git grants, producer
provenance, immutable capture/observed admission, paired publication and native/
environment/proxy boundaries to current owners and actual passing tests. Existing
image/scientific refresh remains bounded CPUfloat32fold0 evidence; production
artifacts/native/client source hashes still match its bindings. No new model
run, acquisition, upstream change or push; CI remains deferred. This closing
notes-only change follows the measured revision and is not claimed as its source.

The requested excess-engineering review found one high-confidence follow-on:
_contract_proof_exists checks a named symbol, not relevance or execution; its
contract-test fixture accepts a method containing pass. Make other tags reason-
only and delete that resolver/proof-only fixtures as a separate cleanup candidate.
Keep actual operator, expression, placement, filesystem and behavioral checks.
Exact final evidence SHA256 references:
3e256eb4fa4465a27afe59c40383eeb5cfb4b7daa25d6cd85c10f06bebd720c9  .work/qualification/foundation-closure-gates-20261016/REPORT.txt
4f71fb851de0bbeff623302c88e0ca0169a2b5ea5a80cb7b5191fdfaeb289724  .work/qualification/foundation-closure-gates-20261016/EVIDENCE.sha256

Remove proof-symbol ceremony from annotation rules (2026-10-16 EAT)
-----------------------------------------------------------------
All three contract tags now require a nonblank explanation. Delete proof-field
parsing and _contract_proof_exists: locating a test symbol never established its
relevance or execution. Delete its artificial proof-file/symlink fixtures and
one proof-target-only method, preserving blank explanations and every semantic
placement/operator/typed-handler/ENV-pop/neighbor restriction. Actual filesystem
and behavioral tests are unaffected. Existing source links remain human context.
Two-file code/test delta is net104 lines smaller, with no replacement abstraction.
Contained focused qualification:66 tests/0.479s pass, Ruff/format AST checks pass,
ordered raw181 and applicable0 unchanged, all phase/endpoint statuses0. Root
integrates only the two executed formatted owners. Full repository gate follows.
Precise private qualification SHA256 references:
cef22d7f0ab3bc231109f3f132bf488284ee4192b1946d51b84dcb3c80c95f0a  .work/proof-ceremony-delete/REPORT.txt
5bbfb172cd9e431974a268d2f916a7d74e93b5cc757003fc06d7866e1fb6c07b  .work/proof-ceremony-delete/EVIDENCE.sha256

Proof-ceremony deletion: full maintained result (2026-10-16 EAT)
-------------------------------------------------------------
At fixed cleanb60cbc31692670ac9229de6145db863de7ec8174, actual
make test/repository passes479 tests/440.351s; Make/harness0 and endpoints0.
One proof-target-only method was deleted from the previous480; semantic and
behavioral checks remain. Production, runtime-unit and image inputs are unchanged.
The porting guide now describes explanation-only annotations and the dedicated
lambda-result boundary; its obsolete proof-validation requirement is removed.
This documentation-only follow-up comes after the tested source revision.
Exact final evidence SHA256 references:
d1ff0c7d56f3baa001b1db7c92641f09926c8ebb8c2889130a72b5a096a45117  .work/qualification/proof-ceremony-gate-20261016/REPORT.txt
218d07a8aa76dcceb54c37d1782fe96bb5a317443b22434097f46261b3c37ae0  .work/qualification/proof-ceremony-gate-20261016/EVIDENCE.sha256