specs/023-verified-publication-corrections/evidence-history.md
Rama main · réplica de lectura del repositorio original.
# Evidence history: Verified publication corrections
Historical implementation and verification records retained from `tasks.md`.
The [task list](tasks.md) owns current status, remaining work and delivery requirements.
Earlier CI waivers are historical and have been revoked. No historical source test
or private experiment substitutes for current runtime or live acceptance.
Current acceptance and remaining work are maintained in the [task list](tasks.md#current-acceptance-work). The [complete archived record](evidence-history-through-20261020-4164dd6.md#evidence-history-verified-publication-corrections) retains the original bytes from revision `4164dd6`. Historical sections below link to that record; the 2026-10-20 entries remain verbatim.
- [Configured cache result and remaining closure](#configured-cache-growth-and-remaining-closure--2026-10-20)
- [Passive workflow correction](#passive-workflow-health-correction--2026-10-20)
- [One-request diagnosis](#one-request-workflow-metadata-diagnosis--2026-10-20)
- [Combined source integration](#combined-owning-source-integration--2026-10-20)
## Evidence
[Archived evidence](evidence-history-through-20261020-4164dd6.md#evidence).
## Convergence assessment and evidence
[Archived evidence](evidence-history-through-20261020-4164dd6.md#convergence-assessment-and-evidence).
## Retained execution context before compaction (2026-10-10)
[Archived evidence](evidence-history-through-20261020-4164dd6.md#retained-execution-context-before-compaction-2026-10-10).
## Authenticated image gate before complete verification — 2026-10-10
[Archived evidence](evidence-history-through-20261020-4164dd6.md#authenticated-image-gate-before-complete-verification--2026-10-10).
## Reader and backup verification 2026-10-11
[Archived evidence](evidence-history-through-20261020-4164dd6.md#reader-and-backup-verification-2026-10-11).
## Current hold-release work (2026-10-10)
[Archived evidence](evidence-history-through-20261020-4164dd6.md#current-hold-release-work-2026-10-10).
## Installed candidate and backup handoff 2026-10-11
[Archived evidence](evidence-history-through-20261020-4164dd6.md#installed-candidate-and-backup-handoff-2026-10-11).
## Reviewed launcher and source delivery 2026-10-11
[Archived evidence](evidence-history-through-20261020-4164dd6.md#reviewed-launcher-and-source-delivery-2026-10-11).
## Published source and rollout preparation 2026-10-11
[Archived evidence](evidence-history-through-20261020-4164dd6.md#published-source-and-rollout-preparation-2026-10-11).
## Original-lock startup review 2026-10-11
[Archived evidence](evidence-history-through-20261020-4164dd6.md#original-lock-startup-review-2026-10-11).
### Outer-backup prerequisite accepted — 2026-10-12
[Archived evidence](evidence-history-through-20261020-4164dd6.md#outer-backup-prerequisite-accepted--2026-10-12).
## Ready Writer-session source proposal 2026-10-12
[Archived evidence](evidence-history-through-20261020-4164dd6.md#ready-writer-session-source-proposal-2026-10-12).
## Negative-five Writer-session source successor 2026-10-12
[Archived evidence](evidence-history-through-20261020-4164dd6.md#negative-five-writer-session-source-successor-2026-10-12).
### DDL source and image delivery — 2026-10-12
[Archived evidence](evidence-history-through-20261020-4164dd6.md#ddl-source-and-image-delivery--2026-10-12).
## Published successor image preparation — 2026-10-12
[Archived evidence](evidence-history-through-20261020-4164dd6.md#published-successor-image-preparation--2026-10-12).
## Current candidate runtime acceptance — 2026-10-12
[Archived evidence](evidence-history-through-20261020-4164dd6.md#current-candidate-runtime-acceptance--2026-10-12).
## Cache capacity and rollout preparation — 2026-10-12
[Archived evidence](evidence-history-through-20261020-4164dd6.md#cache-capacity-and-rollout-preparation--2026-10-12).
### Cache guard delivery — 2026-10-13
[Archived evidence](evidence-history-through-20261020-4164dd6.md#cache-guard-delivery--2026-10-13).
### Cache guard runtime verification — 2026-10-13
[Archived evidence](evidence-history-through-20261020-4164dd6.md#cache-guard-runtime-verification--2026-10-13).
## Native backup refusal and original-image restart 2026-10-13
[Archived evidence](evidence-history-through-20261020-4164dd6.md#native-backup-refusal-and-original-image-restart-2026-10-13).
## Startup repair delivery and remaining installed integration 2026-10-13
[Archived evidence](evidence-history-through-20261020-4164dd6.md#startup-repair-delivery-and-remaining-installed-integration-2026-10-13).
## Active native rollout and owning integration 2026-10-13
[Archived evidence](evidence-history-through-20261020-4164dd6.md#active-native-rollout-and-owning-integration-2026-10-13).
### Reviewed installer and host-lease implementation
[Archived evidence](evidence-history-through-20261020-4164dd6.md#reviewed-installer-and-host-lease-implementation).
### Ordinary repair rollout and independent observation
[Archived evidence](evidence-history-through-20261020-4164dd6.md#ordinary-repair-rollout-and-independent-observation).
## Queue admission delivery and selected pack preflight 2026-10-13
[Archived evidence](evidence-history-through-20261020-4164dd6.md#queue-admission-delivery-and-selected-pack-preflight-2026-10-13).
## Reviewed source delivery 2026-10-14
[Archived evidence](evidence-history-through-20261020-4164dd6.md#reviewed-source-delivery-2026-10-14).
## Configured-base source correction 2026-10-14
[Archived evidence](evidence-history-through-20261020-4164dd6.md#configured-base-source-correction-2026-10-14).
## Host reboot checkpoint 2026-10-14
[Archived evidence](evidence-history-through-20261020-4164dd6.md#host-reboot-checkpoint-2026-10-14).
## Post-reboot authority diagnosis 2026-10-14
[Archived evidence](evidence-history-through-20261020-4164dd6.md#post-reboot-authority-diagnosis-2026-10-14).
## Recovery delivery checkpoint 2026-10-14
[Archived evidence](evidence-history-through-20261020-4164dd6.md#recovery-delivery-checkpoint-2026-10-14).
## Recovery delivery and storage cleanup 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#recovery-delivery-and-storage-cleanup-2026-10-15).
### Verified backup and tagger-history diagnosis — 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#verified-backup-and-tagger-history-diagnosis--2026-10-15).
### Prepared recovery and retained-source lookup — 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#prepared-recovery-and-retained-source-lookup--2026-10-15).
### Corrected tagger reader delivered and selected image verified — 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#corrected-tagger-reader-delivered-and-selected-image-verified--2026-10-15).
### Reviewed identity adoption and ordinary availability — 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#reviewed-identity-adoption-and-ordinary-availability--2026-10-15).
### Combined worker recovery and pack matching 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#combined-worker-recovery-and-pack-matching-2026-10-15).
### Configured worker recovery prerequisites 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#configured-worker-recovery-prerequisites-2026-10-15).
### Merged recovery and configured installer follow-up 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#merged-recovery-and-configured-installer-follow-up-2026-10-15).
### Verified native successor rollout and bounded cache policy — 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#verified-native-successor-rollout-and-bounded-cache-policy--2026-10-15).
### Installer delivery and upstream queue-health compatibility — 2026-10-15
[Archived evidence](evidence-history-through-20261020-4164dd6.md#installer-delivery-and-upstream-queue-health-compatibility--2026-10-15).
## Ordinary pack automation and reader backup follow-up — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#ordinary-pack-automation-and-reader-backup-follow-up--2026-10-16).
## Verified reader backup and data preservation — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#verified-reader-backup-and-data-preservation--2026-10-16).
## Retained annual release matching — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#retained-annual-release-matching--2026-10-16).
## Pack archive and companion acknowledgement — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#pack-archive-and-companion-acknowledgement--2026-10-16).
## Retained intake versus processing work — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#retained-intake-versus-processing-work--2026-10-16).
## Bounded passive pack discovery — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#bounded-passive-pack-discovery--2026-10-16).
## Published annual and pack repair images — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#published-annual-and-pack-repair-images--2026-10-16).
## Verified rollout receipts and pending data comparison — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#verified-rollout-receipts-and-pending-data-comparison--2026-10-16).
## Native post-rollout preservation comparison — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#native-post-rollout-preservation-comparison--2026-10-16).
## Workflow observer attribution — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#workflow-observer-attribution--2026-10-16).
## Selected-pack preflight and bounded worker reads — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#selected-pack-preflight-and-bounded-worker-reads--2026-10-16).
## Fresh selected-pack backup milestone — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#fresh-selected-pack-backup-milestone--2026-10-16).
## Connected repair and selected catalog follow-up — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#connected-repair-and-selected-catalog-follow-up--2026-10-16).
## Selected canary contention and evidence custody — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#selected-canary-contention-and-evidence-custody--2026-10-16).
## Shared worker digest generation bounds — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#shared-worker-digest-generation-bounds--2026-10-16).
## Worker runtime and refreshed catalog baseline — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#worker-runtime-and-refreshed-catalog-baseline--2026-10-16).
## Duplicate scheduler rows and delivery follow-up — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#duplicate-scheduler-rows-and-delivery-follow-up--2026-10-16).
## Delivered source and first selected attempt — 2026-10-16
[Archived evidence](evidence-history-through-20261020-4164dd6.md#delivered-source-and-first-selected-attempt--2026-10-16).
## Configured cache reservations and fresh pack container — 2026-10-17
[Archived evidence](evidence-history-through-20261020-4164dd6.md#configured-cache-reservations-and-fresh-pack-container--2026-10-17).
## Selected pack admission contention correction — 2026-10-17
[Archived evidence](evidence-history-through-20261020-4164dd6.md#selected-pack-admission-contention-correction--2026-10-17).
## Selected preparation guard contention — 2026-10-17
[Archived evidence](evidence-history-through-20261020-4164dd6.md#selected-preparation-guard-contention--2026-10-17).
## Installed preparation successor and cache follow-up — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#installed-preparation-successor-and-cache-follow-up--2026-10-18).
## Selected recovery preflight and authority validation cost — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#selected-recovery-preflight-and-authority-validation-cost--2026-10-18).
## Current worker implementation verification — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#current-worker-implementation-verification--2026-10-18).
## Ordinary import and metadata order — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#ordinary-import-and-metadata-order--2026-10-18).
## Portable reader milestone complete — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#portable-reader-milestone-complete--2026-10-18).
## Metadata correction delivered and ordinary rollout preparation — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#metadata-correction-delivered-and-ordinary-rollout-preparation--2026-10-18).
## Published ordinary-pipeline proof and pending data acceptance — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#published-ordinary-pipeline-proof-and-pending-data-acceptance--2026-10-18).
## Operational preservation check follow-up — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#operational-preservation-check-follow-up--2026-10-18).
## Selected-backup journal hold — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#selected-backup-journal-hold--2026-10-18).
## Maintained Komga scope producer target-runtime proof — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#maintained-komga-scope-producer-target-runtime-proof--2026-10-18).
## Guarded selected run and configured scope observation — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#guarded-selected-run-and-configured-scope-observation--2026-10-18).
## Selected dispatch refusal diagnostics — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#selected-dispatch-refusal-diagnostics--2026-10-18).
## Original reader library transport correction — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#original-reader-library-transport-correction--2026-10-18).
## Saved attempt custody and disconnected reader query — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#saved-attempt-custody-and-disconnected-reader-query--2026-10-18).
## Configured reader helper startup profile — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#configured-reader-helper-startup-profile--2026-10-18).
## Saved-only protected-root preparation — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#saved-only-protected-root-preparation--2026-10-18).
## Finite metadata and cache preflight — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#finite-metadata-and-cache-preflight--2026-10-18).
## Native authority transaction read cost — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#native-authority-transaction-read-cost--2026-10-18).
## Current configuration and catalog facts preparation — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#current-configuration-and-catalog-facts-preparation--2026-10-18).
## Published transaction-cost fix and scoped backup — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#published-transaction-cost-fix-and-scoped-backup--2026-10-18).
## Post-rollout cache metadata closure — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#post-rollout-cache-metadata-closure--2026-10-18).
## New native configuration and catalog generation — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#new-native-configuration-and-catalog-generation--2026-10-18).
## Physical planning and fresh cache readiness — 2026-10-18
[Archived evidence](evidence-history-through-20261020-4164dd6.md#physical-planning-and-fresh-cache-readiness--2026-10-18).
## Saved directory proposal and configured cache follow-up — 2026-10-19
[Archived evidence](evidence-history-through-20261020-4164dd6.md#saved-directory-proposal-and-configured-cache-follow-up--2026-10-19).
## Read-side telemetry correction and strict preservation — 2026-10-19
[Archived evidence](evidence-history-through-20261020-4164dd6.md#read-side-telemetry-correction-and-strict-preservation--2026-10-19).
## Conditional provenance review and telemetry rollout — 2026-10-19
[Archived evidence](evidence-history-through-20261020-4164dd6.md#conditional-provenance-review-and-telemetry-rollout--2026-10-19).
## Configured cache growth and remaining closure — 2026-10-20
PR #401 delivers the compact acceptance notes through current-head CI. All seven required checks pass; the reviewed and merged trees match. Post-merge Source lint, Spec Kit and all four repository-validation jobs pass. The configured GitHub and Gitea main branches match the local main revision. These prose-only changes require no image deployment. Subsequent implementation uses an isolated worktree because another chat owns unrelated changes in the shared checkout.
The finite owned-alias correction preserves every unrelated metadata check and passes 15 controls in the accepted worker runtime, including a disposable three-bind physical-alias case. Four additional target-runtime controls prove the actual plan-to-caller/helper binding and reject stale pins. The unchanged broad suites are not repeated. One fresh configured attempt stops at the five-second metadata preflight before entering the operator, creating a container or writing a payload. A separate read-only timing observation closes the unchanged 71,112-entry Frame in 1.34 seconds; the production preflight bound remains unchanged.
The next fresh, coordinated attempt completes the inner configured test: exactly 65,536 bytes are written, accounted for and removed; an extra byte and an over-budget reservation are refused. Usage increases from 45,727,739,904 to 45,727,805,440 bytes and returns exactly to its starting value. The owned leaf is empty. The effective maximum remains 48 GiB with a 32 GiB reserve. No queue/attempt writes, import, ACK or worker-start authority is granted by this result.
The outer check refuses final closure because an unrelated direct child of the native configuration mount changes modification and change timestamps. Source, configuration and lock-namespace closure pass, but retained mount-source closure does not. The exact test container is independently confirmed exited with code zero, PID zero and no OOM; both coordinating pauses are released. The empty owned directory and test evidence remain retained. The current diagnostic lacks that child's identity and file type, so neither a directory nor a regular file is established and no writer is attributed. A separate read-only observation sees a workflow rollback journal appear, while a later twenty-second directory-only observation sees no directory changes. Neither observation identifies the earlier changed child. T030 stays open until the owning outer closure and exact directory cleanup pass.
## Passive workflow health correction — 2026-10-20
Source tracing finds a separate write path behind `getHealth`: after ten seconds, workflow intake refresh can persist its cached decision and emit an intake-transition event. Default workflow-store reads also repeat a permission change on an already private database, changing its ctime. These findings establish source behavior, not the identity of the unrelated child refused by the earlier configured cache test.
The correction makes health compute intake status without saving the record or event. Ordinary intake keeps its default persistence and uses the persisted paused state for hysteresis; it still records a transition first observed by health. Default store access changes permissions through the opened descriptor only when its mode differs from `0600`. Existing-only publication access stays unchanged. Missing-store initialization remains a separate existing write boundary.
Four new regressions pass on the host and in Mylar's Python 3.10 runtime using frozen public source and disposable state. They verify initialized default and existing-only health with database hash/full metadata, DATA-directory metadata and namespace unchanged; later ordinary intake still persists its decision and event; paused hysteresis and missing-storage refusal remain correct; nonprivate permissions are still repaired. The isolated target check has no live application mounts or network access and closes its source witnesses. The focused host workflow/store/health run executes 104 tests: 103 pass and one existing upstream-source fixture check skips because that fixture is unavailable. That skip is not target-runtime or installed-source acceptance. Source maps, combined validation, hosted CI, image publication and configured deployment of this correction remain pending.
## One-request workflow metadata diagnosis — 2026-10-20
A separately reviewed no-payload observer performs one existing health request without starting a container, importing, acquiring Writer or allocating cache data. It saves the raw response before the unchanged metadata comparison, then completes the independent process/configuration join, post-inspect and original-source closure even when that comparison refuses. Five focused failure-path controls pass before execution.
The configured observation identifies the changed direct child as regular `workflow.sqlite`, with modification and change timestamps differing. The same-comparison refusal is retained. All original-source, process/configuration, static service-epoch and planning joins pass. This establishes a new observation consistent with the known intake-refresh write path; it neither uniquely identifies every concurrent writer nor reconstructs the earlier unrecorded child. No extra payload, cleanup acceptance, import or ACK follows. The passive workflow correction still requires normal source delivery, publication and scoped deployment before another cache acceptance attempt.
## Combined owning-source integration — 2026-10-20
PR [#405](https://github.com/bolens/homelab/pull/405) combines passive health/store observation with the prospective archive protocol. The original 994-case/63-suite private-copy run, repository validation, full local gate and independent integration/failure review pass. Hosted native validation catches a missing direct lifecycle pin; its admission, preparation and Parent consumers are corrected without changing acceptance predicates. The successor adds ten explicit plan13 mapping/argument-forwarding controls and updates the fixed owning wrapper budget for its actual suite inventory. The corrected owning path passes 769 controls in 27 suites plus all 1,004 recovery controls in 63 suites with zero skips and unchanged originals; `make ci-local` passes on the merged PR #404 base. Hosted and installed-image verification remain pending; these source controls alone are not genuine installed factory proof. See the concise [archive integration record](../024-verified-archive-repair/evidence-history.md#configured-path-handoff-integration--2026-10-20). Ordinary Mylar remains on the verified prior image; no import, ACK or full-worker start is claimed.
## Evidence compaction and current delivery boundary — 2026-10-20
The complete earlier history is retained byte-for-byte in [the dated archive](evidence-history-through-20261020-4164dd6.md). The initial compaction preserved all 92 existing heading anchors, including duplicate headings, and its four current-day evidence sections verbatim. The refreshed index also preserves the later Activity section unchanged. The archive SHA-256 is `19a7e58e8fe325ba8a30ec2461654a2b1487e5f1954eceebe09bc98a59b847c3`. Initial link checks cover 101 local targets and 48 incoming references; independent review and negative controls pass. No acceptance claim changes through this compaction.
The combined source candidate in PR #405 passes the owning native runner (769 controls) and the 1,004-control recovery collection with zero skips. The subsequent Docker-context correction admits the exact manifest-pinned scenario document; all 16 context-contract tests and the complete local CI gate pass. Required hosted checks, matching published-image verification and live rollout remain pending. Genuine installed factory, NFS publication, import/ACK, recurring recovery and bulk acceptance remain open.
## Passive Activity snapshot correction — 2026-10-20
Source review found a second status-read mutation: `workflow_web.snapshot()` used the default persistent intake refresh. Three regressions reproduce database hash, full file-signature and namespace changes on stale reads, including the admitted existing-only Store and an unintended persisted hysteresis sample. The snapshot now requests `intake(persist=False)`, matching health. Ordinary intake still persists its latch and transitions. The focused host run passes 106 controls with one explicitly unavailable native-fixture skip. Inspected snapshot callees show no additional durable writes; authenticated CSRF initialization remains in-memory.
The current configured-base source pin, installer manifest pin, declared source manifest and both current copy maps are refreshed together. Historical preimages and the installed SDK cohort remain unchanged. PR #403 delivers compatible runtime tracks, available Jammy patch packages and the immutable NetExec dependency correction after all 41 hosted checks pass. The next PR #405 candidate incorporates that reviewed main. Hosted delivery, matching installed-image verification and the fresh no-payload/cache closure remain pending; this source result grants no configured growth, import, ACK or bulk acceptance.
## Combined bootstrap integration and lint correction - 2026-10-20
PR [#405](https://github.com/bolens/homelab/pull/405) now includes the disposable application bootstrap and native-catalog fixture source in one candidate. The combined `a9126c2` passes 769 native controls across 27 suites and 1,048 recovery controls across 65 suites with zero recovery skips and unchanged originals. Workflow coverage has 106 passes and one unavailable host-only native-fixture skip. All 18 image-context tests, full local CI and normal hooks pass. Independent security, contract and failure-path reviews find no actionable issue.
Hosted Source lint catches five unused imports or bindings. The corrective `9bf4208` removes them without changing behavior or assertions and refreshes four owning source hashes. All 50 affected fixture tests, all 849 selected Python files under the exact Ruff E9/F rules, full local CI and normal hooks pass. Normal hosted checks are required on that current head. The original failure remains retained.
Actual image/runtime, disposable creation, complete Parent/Birth/NFS execution, configured cache closure and live import/ACK acceptance remain pending. No live service, comic file, worker or task acceptance changes in this batch.
The later `435d5f2` candidate adds the independently reviewed finite disposable creator and corrects the native runtime fixture comparison. Its owning run passes 769 native and 1,069 recovery controls with zero recovery skips and unchanged originals. All 71 focused fixture controls pass on Python 3.10, all 852 selected Python files pass Ruff E9/F, and image-context, full local CI and normal commit checks pass. The original failures remain retained. Hosted verification is running; actual image/application, configured cache and import/ACK acceptance remain open. See [the creator and runtime-compatibility record](../024-verified-archive-repair/evidence-history.md#disposable-creator-and-runtime-fixture-compatibility-2026-10-20).
## Combined source delivery — 2026-10-20
PR #405 merges normally as `6dbbb33527136ca44dfaf986105efd0a4baba764`. Its tree exactly matches the independently reviewed `435d5f2` candidate. All seven required checks pass; the complete check inventory is 41 successes and the expected Spec Kit update skip. Final paginated feedback and security review have no unresolved findings. The SHA-256 artifact-integrity finding is dismissed as a false positive only after independent review of all four flows: complete private JSON artifacts are checked against original references; passwords are not authenticated with that digest. The checksum remains intact and the CodeQL check passes without a rerun or waiver.
GitHub main, eligible local main and the configured mirror are synchronized to this merge. The matching main image publication is running. No image pull, service restart, import, ACK or new cache payload ran for this source delivery; actual publication/source proof, installed execution and fresh protected rollout remain required. The permanent worker remains inactive at the last verified live baseline. The separate next mapping batch passes 769 native and 1,094 recovery controls, but remains draft source rather than installed or live acceptance.
## Published worker installed-runtime checks — 2026-10-20
The worker image published from PR [#405](https://github.com/bolens/homelab/pull/405), merge [6dbbb335](https://github.com/bolens/homelab/commit/6dbbb33527136ca44dfaf986105efd0a4baba764), passes isolated installed-runtime verification with exit code zero. All 42 expected modules have canonical `/app` origins and shared types, with no source overlay. The selected pack/import collection runs 168 controls on Python 3.13.5 with zero skips; this is not a repeated full-suite result. Publication provenance and the independently inspected local image identity join the same main commit.
These controls use disposable fixtures. No configured import, ACK, canary retry, worker activation or adoption ran. Genuine installed factories, actual NFS, selected retained-pack import, a later automatically consumed capture, restart reconciliation and fresh ACK remain required. All four canary histories and uncertain outcomes stay retained; recurring recovery remains unaccepted.
## Native image proof and harness refusal — 2026-10-20
The PR #405 Mylar publication passes trusted main CI and exact source/context provenance checks. Its immutable image is pulled and independently identified. Isolated source capture verifies all 180 expected native files and three authentication files; the separate installed cohort passes canonical source/origin/type checks.
The 198-component stage remains unaccepted. Its first attempt exposes two fixture problems: independently constructed fake application modules are collected into one process, and canonical-file guards reject symlinked fixture sources. Targeted old/fresh-process and alias/regular-copy reproductions establish both causes without changing production code or assertions. A separately reviewed successor isolates all 17 selectors and labels byte-copy execution separately from canonical installed proof. Its publication selector passes all 114 assertions, then private-copy metadata closure refuses. That drift must be diagnosed before accepting another successor; the original image/source checks are retained. No native rollout, canary import, ACK, service restart or application-data change occurs in these isolated attempts.
## Native image proof accepted successor — 2026-10-20
A separately reviewed successor passes all three isolated stages against the Mylar image published from [PR #405's merge](https://github.com/bolens/homelab/commit/6dbbb33527136ca44dfaf986105efd0a4baba764), image identity `0ee9db10f14e…`. Public-source capture verifies 180 native files and three authentication files. The separate installed-cohort stage verifies canonical `/app` origins and shared types. The component stage executes 198 controls with zero skips: 157 identity/publication, 18 queue/health, seven passive-workflow and 16 NFS-algorithm controls. These component checks use explicit private byte copies and do not replace the separate canonical installed proof. All three stage exit codes are zero.
The retained private proof receipt has SHA-256 `7be62913fb6247ad82f3f389bb6b9c7d9e553ccb9582147499a5363138e4024f`; its reviewed proof contract SHA-256 is `d43eb3f5e7f5b42d28a23a064a2533d1b3b0060b0ed3a57974325baf488f81a1` and runner SHA-256 is `32f29d6a082321a73929fe930cf5defea4512d999bd4b2a330a57024b6598c18`. Diagnosis of the [earlier refused attempts](#native-image-proof-and-harness-refusal--2026-10-20) establishes that isolated `-I` children ignore environment-only bytecode suppression. Exact regular private fixtures are made read-only before their initial metadata witnesses, preventing import-created bytecode from changing their namespace. Full source metadata closure, installed application checks and original refusal evidence remain intact; no production guard is waived and no source path is spoofed.
This is installed-image source/type and isolated-component evidence. Genuine installed factories, an actual NFS server/publication, configured acceptance, import/ACK and the aggregate milestones remain open. The run performs no service lifecycle operation or permanent-worker start and does not repeat the full maintained gate. Ordinary Mylar remains on the last verified prior image pending a fresh protected rollout.
## Scoped native image update and inherited-label check — 2026-10-20
The current image-only scope is about 131 MiB across 12,328 nodes. Its consistent backup, isolated restore and independent source/restore verification pass. The selector changes in place, and only Mylar is recreated with the verified PR #405 immutable image. It becomes healthy; Komga remains running and the permanent worker remains inactive. The independently derived prospective Compose model changes only the image and matching runtime environment value. Its configuration hash and platform identity match the actual new container. No canary, import or acknowledgement starts.
The final preservation checker stops before catalog checks because its old label rule permits only two Compose changes. Five additional build/OCI labels are inherited from the replacement image. Original old/new immutable image inspection replies are captured with equal repeated reads. The corrective checker must derive exact inherited changes from those originals and protect explicit Compose label overrides, rather than ignore labels. Full catalog/configuration/retained-file acceptance and configured cache closure remain open; the verified backup and failed check are retained. Both coordinating chats' writer pauses are released while this source correction is prepared.
## Native405 exact-key preservation comparison — 2026-10-20
The published PR #405 image is running healthy after a verified affected-state backup and independent restore. The corrected checker joins the original image metadata and published index/platform/config chain. Upstream OCI revision labels are inherited; the separate installed-source and publication proof binds the homelab commit. The label correction passes 11 controls in Mylar's Python 3.10 runtime. It does not waive catalog preservation.
A count-only diagnostic then finds changes in issues and job history, with unchanged schema, table sets and row counts. Its eight focused runtime controls pass. A separate fresh exact-key diagnostic passes four additional runtime controls and closes all six independent source/preservation observations. All 16,432 unique issue keys remain present. Exactly 111 rows change only DateAdded, from NULL to an ISO date matching the observed native local day; all are Wanted before and after. Every other typed issue cell matches. The existing helpers.DateAddedFix backfill has this predicate and is reachable from the exposed upcoming route through fly_me_to_the_moon. These facts establish compatibility with that writer, not proof of its invocation.
The diagnostic deliberately retains the original refusal and grants no acceptance, import or ACK. Job-history scheduling timestamps and one status still require source-specific classification. No backup, image update, comic import or canary start was repeated. Mylar and Komga remain available, the permanent worker remains inactive, and writer coordination pauses are released. The signed-in DDL preferences load and the post-processing monitor reports a running worker with no waiting jobs; unresolved downloaded singles, pack reviews and NZB handoffs remain visible. Aggregate tasks stay open.
## Scheduler and cyclic scanner preservation — 2026-10-20
The current native-image catalog comparison now classifies the exact Wanted/NULL DateAdded backfill and the duplicate-safe scheduler changes. JobName is not unique in the owning schema. The classifier preserves typed row multiplicities and every other cell; the five changed scheduling rows include one source-supported Running-to-Waiting transition. Seven focused controls pass in the actual Python 3.10 runtime.
The first full readout then exposes an invalid verifier assumption: a library scan cursor cannot be ordered across completed sweeps. The owning scanner resets its cursor and revisits entries. Independent review and six actual-runtime controls verify removal of only that ordering assertion, retaining exact record shape, policy, time bounds, key sets, events and raw change evidence. The next full readout reaches a different protected workflow-record change and refuses acceptance. Its temporary comparison snapshots were discarded on failure, so a diagnostic must retain the relevant original record differences before classifying them; no new baseline is accepted.
The verified affected-state backup and original image/source receipts are retained. No backup, restart, import, acknowledgement or worker start was repeated for these comparisons. Mylar and Komga remain available, the permanent worker remains inactive, and both brief coordinating pauses are released. Full native preservation, T030 configured cache closure and selected-pack recovery remain open.
## Native405 data preservation accepted — 2026-10-20
The original-bound full preservation check now passes against the running PR #405 image and the retained verified affected-state backup. Original image/publication/source proof, intended Compose/configuration, catalog schema and typed records, retained downloads, backup copies, stopped-canary history and peer profiles all close. The source-specific issue backfill, duplicate-safe scheduler bookkeeping and cyclic scan cursor remain explicit comparisons; actual raw row digests and change counts remain truthful.
A same-context diagnostic retained both workflow projections before scratch cleanup. All 15,216 record keys remained present. Of 138 changed records, the only newly unclassified type was six library observations changing updated_at and their outer timestamp alone. Every path, identity, policy, phase and reason stayed exact. All eleven independent diagnostic closures and final source closure passed. The owning observation writer refreshes those timestamps. Its narrow successor requires the exact six-field shape, path-derived key, unchanged non-time payload and strict timestamp bounds. Independent review, predecessor-refusal regression and four new controls in the actual runtime pass; the subsequent full check exits successfully with no import or acknowledgement grant.
Mylar and Komga stayed running throughout these comparisons; both coordinating chats are released. No backup, image update, canary or permanent-worker start was repeated. This closes current native image data preservation, not configured cache growth, selected-pack import/ACK, connected archive factories, NFS or bulk acceptance. Those retain their own unchecked tasks and original prerequisites.
## Native405 cache observer accepted — 2026-10-20
After full native preservation passed, one original no-payload observation succeeds against the current process and inactive worker. It saves raw health before predicates, joins current configuration and policy, and closes the original mount-source witnesses and independent post-inspection. Exactly one health call occurs; no Writer lock is acquired and zero payload bytes are written. This establishes temporal correlation and clears the observer prerequisite, not positive growth or publication authority. T030 still requires a fresh coordinated 64 KiB growth/capacity-refusal/accounting test with exact cleanup and all outer closures. Earlier refused attempts remain retained.
## Native405 positive cache test and retained outer refusal — 2026-10-20
One fresh, independently reviewed generation binds the current process, configuration, policy and source capture. The isolated configured test exits successfully and verifies positive 64 KiB allocation/removal, over-budget and extra-byte refusal, accounting and retained originals. Its source files, configuration and Writer namespace close. The parent then refuses cleanup acceptance because the native configuration's workflow.sqlite changes modification and change timestamps. No content change or responsible writer is established by that metadata observation alone.
A separate read-only check confirms the exact owned test container is exited with code zero and no live process. The parent retains the empty owned leaf, original result and source-refusal evidence; the attempt is not replayed or promoted to full acceptance. Both coordinating pauses are released. T030 remains open for a contract-preserving outer-closure and exact directory cleanup solution that permits ordinary Mylar operation.
## Workflow preservation controls and preflight refusal — 2026-10-20
The new whole-interval workflow witness retains exact inode/namespace custody, two detached consistent snapshots, typed preservation and strict final source closure. It reports raw metadata equality separately rather than treating a semantic comparison as byte identity. Both independent reviews pass. Six source controls pass, and five public behavior controls pass in the running image's Python 3.10 runtime with zero skips and closed source witnesses. These isolated checks grant no configured acceptance.
One separately reviewed fresh binding then stops at the initial metadata preflight with witness-original-changed after 1.43 seconds. It acquires no Writer lock, writes zero payload and starts no test child. The result does not identify the changed file or its writer. The attempt and earlier histories remain retained; both coordinating chats are immediately released. A bounded diagnostic must identify the metadata witness before any further growth attempt. Mylar and Komga stay running, and the permanent worker remains inactive. T030 remains open.
## Cache handoff and post-snapshot refusal — 2026-10-20
The planning-only directory witness passes 13 controls in Mylar’s actual Python runtime. The next attempt stops before growth because its sealed helper is mode 0400 while the original source reader requires 0600 or 0644. A byte-identical 0600 successor preserves the historical helper; three real producer-to-reader regressions pass locally and in the target runtime, including original-mode refusal, hash and metadata closure.
A fresh coordinated attempt then completes the child’s 64 KiB allocation, capacity refusal, accounting and payload removal. The child exits zero; both detached workflow snapshots, typed comparison and saved preservation proof complete. The outer verifier subsequently refuses `workflow-source-full9` because the live workflow database changes after the AFTER snapshot while the proof is being saved. No writer or harmlessness is established. The original contract deliberately requires equality through cleanup, so this attempt remains refused and its empty owned leaf and history remain retained. Both coordinating chats are released immediately.
Two independent reviews recommend a separately versioned observation contract ending content preservation at the sole consistent AFTER snapshot following verified child termination. Later custody and exact owned-resource cleanup must remain strict, with subsequent raw drift and unverified current contents explicit. Such a successor must not claim preservation through later proof I/O, refresh its endpoint or grant import, ACK, factory, NFS or worker-start authority. Implementation and focused regressions precede any new configured attempt. T030 remains unchecked; Mylar and Komga stay available and the permanent worker remains inactive.
## Configured cache guard accepted — 2026-10-20
T030’s source, contract and published-image gates are retained, including restart, crash, thread/process reservation exclusion, retry reuse and filesystem controls. The new snapshot-ended observation contract passes independent review and fourteen host controls; its thirteen unchanged behavior controls then pass in Mylar’s actual Python runtime with zero skips. The separately named static parity control remains host-only, so no private historical profile is mounted into the runtime test. Both test sources and output custody close, and the disposable runtime-test container is absent.
A single fresh configured generation then exits zero after both coordinating chats acknowledge their brief pause. It writes and removes exactly 65,536 owned payload bytes, verifies positive allocation, capacity and extra-byte refusal, accounting and retained originals, and removes its exact empty owned leaf. All unrelated source/configuration/Writer and service-profile closures pass. Both chats are immediately released; Mylar and Komga remain running, and the permanent worker stays inactive. The retained driver receipt has SHA-256 `f4372788046ad70d5a5824f92ec287bf4a1d76f53ea13fb1cb00667086473b66`.
The sole AFTER snapshot and unchanged typed comparison establish workflow preservation through the explicit endpoint after verified child termination. Exact inode/namespace custody and immutable evidence checks continue afterward. Raw before/after metadata equality is false; later raw equality to the AFTER snapshot is true for this run. Current live contents and semantic preservation through cleanup remain explicitly unverified. The recipe’s automatic task/import/ACK/NFS/factory/START grants stay false; independent task review establishes T030 completion from the full source/image/configured evidence chain. Earlier refused attempts and their evidence are preserved, with no replay or retrospective acceptance. Selected import/ACK, later recurring capture, connected Parent/NFS, repair and bulk tasks retain their own gates.
## Integrated recovery sources delivered — 2026-10-20
PR [#449](https://github.com/bolens/homelab/pull/449) is normally squash-merged as [f0881c1](https://github.com/bolens/homelab/commit/f0881c1c9c229da2b4f0e668d3e8462c8e035acc) after every required check passes. The merge tree exactly matches the reviewed source head. It delivers the genuine active-input assembler, finite original host-engine intents and disposable bootstrap scope mapping while preserving the existing registered birth/session path and denial of unbound create/start calls. Independent reviews, 1,219 reader controls across 72 suites, 40 scope-parent controls and JDK21 verification pass. The matching worker candidate passes 915 tests and its separate 42-module installed proof; the native candidate passes all 21 Modern controls, final runtime/library checks and genuine final-image CBR preservation/repeat/CRC/cleanup.
Source delivery and component-image proof do not supply the connected factory/NFS or actual selected-import/ACK acceptance required by T026/T029 and feature 024 T012/T015. Normal main publication is running; no deployment or experimental worker starts. The existing effective observer is also compiled from exact tracked sources into private scratch, with all five class hashes matching the pinned map and no network or Docker operation. It is preparation for genuine connected execution, not a reader observation or approval.
## Published449 image verification — 2026-10-20
PR #449 merged with all required checks; trusted main publication and repository validation passed. The native image is `sha256:39fbcf0cadfee84be2b0c879a8860842cb15d417aa417fccd054fe366a513532`; the matching worker is `sha256:0a0f78ccdcc3e5b1ecb6c7c048fd3f3b4eb917d7397358513604ad302bed971c`. Both local image inspections join the exact published digests and linux/amd64 platform. GitHub's two Pillow alerts now report fixed.
The published native image passes one isolated public-source capture: all 180 native files, three authentication files, both original s6 startup scripts and the exact archive SDK core join. Its 217-member public tar and final source closure pass; the exact owned container is removed. Receipt SHA256: `aab67410dcd515de54382de03c0c13130e88a56cb8415b83269a441474333ce3`. The actual startup script declares `python3 /app/mylar3/Mylar.py --nolaunch --datadir /config/mylar`; this supplies an image-bound test precondition, not an observed running test daemon.
The matching worker passes all 42 installed-module/type checks and canonical SDK parity, with unchanged checker inputs, final source closure and temporary-container absence. The full 915-control checked-build evidence remains separate; this installed check does not claim the tests ship in the final image. Independent review corrected the private launcher's output custody before execution; production sources were unchanged.
Mylar and Komga remain running on their prior accepted images, and the permanent worker remains inactive. No comic import, acknowledgement, live image rollout or connected NFS/factory acceptance follows from these isolated results. T026/T029 and the live acceptance tasks remain open.
## Disposable reader-parent staging and network prerequisite — 2026-10-21
The reviewed owning installer completes against the accepted published native and worker sources. Its separate required-102 SDK projection joins the current native180 map, while the Creator retains its complete current map. The worker observer's source, exact one-module map and original image metadata remain independently bound. All 27 generated original output references and final source closure are retained. Receipt SHA256: `e4aae88693e01977095431e2b7b6228ef8beec53022ff0e0e6dc91d8e309f881`. These are staged artifacts; no connected factory or runtime admission follows.
The first disposable Creator generation verifies all three original images, then receives a nonzero Docker response at internal-bridge creation. No test container creation occurs. Independent read-only inspection confirms the expected network is absent. A separate fresh diagnostic confirms Docker reports `all predefined address pools have been fully subnetted`; it creates no network. Preserve the original failed generation and resolve this host prerequisite before starting a fresh generation. The source-only SourceCohort schema and 1,219-control/72-suite inventory are identified, but no actual causal source-fixture run, NFS, terminal, import or acknowledgement acceptance is claimed.
No live service restart or library mutation occurred. T026/T029, feature 024 T012/T015 and the related live acceptance tasks remain open.
## Disposable NFS bind prerequisite isolated — 2026-10-21
After specific authorization, the unused unrelated network is removed only after
its exact saved profile and zero references across the complete 255-container
census are rechecked. Both coordinating chats are released immediately. The next
fresh Creator generation successfully creates its own internal network, then
refuses its first container creation. No test containers are created; all failed
generation evidence remains retained.
A bounded read-only diagnostic establishes that the daemon identity can stat the
local configuration directory but receives EACCES at the NFS library source. A
separate new empty fixture proves the limited alternative: searchable `0711`
ancestor directories with a private `0700` library leaf permit the exact selected
native image to bind that leaf read-only and access it as UID 1000. Its disposable
container is independently confirmed absent and its three owned empty directories
are removed. No existing directory permissions, exports, service images or live
library contents change. This is a source-bind prerequisite result, not connected
factory, NFS transaction, import or acknowledgement acceptance. The owning
explicit disposable geometry contract and its regression coverage remain required.
The private bind result and independent cleanup result are retained under SHA256
`80ded3989ad527a29b5b89ebc70beded4863c2dee5f1d2924f2f608e2d467cd8`
and `0404b940ff55977f0241b219968e1a507f67901209e0c0730bddb7c98a66f69a`,
respectively. The original failed generation is not adopted or replayed.
## Coupled disposable recovery source verified — 2026-10-21
The initial combined correction changes the SourceCohort runtime predicate,
retains bounded first-failure Docker diagnostics privately, and adds explicit
Creator v3/searchable geometry v2 across every owning consumer. The runtime
predicate is subsequently found incorrect: the probe invokes the daemon
interpreter, which remains Python 3.10. Only Modern ComicTagger uses the private
Python 3.13 interpreter. The source-run receipt below is historical and does not
prove a correct native runtime predicate.
Only new scratch/common ancestors permit traversal; library/retention leaves,
local state, legacy production checks and exact mount/identity custody remain
private and unchanged. Current operational source pins and generated maps close
together. The earlier full run refused a stale consumer pin; that failure is
retained rather than reclassified as a pass.
The required adoption module changes, so the reviewed current supplier advances
only its adoption hash in the complete SDK and existing-cohort closure, plus the
correlated cohort digest. Historical base manifests and the original configured
output references remain preserved. Regressions reject mismatched old/new bases
and SDKs, and reject replacing an original output with equal bytes on a new inode.
This prospective supplier is not installed-image evidence.
The sealed combined source passes all 1,239 owning controls across 72 suites with
zero skips under Python 3.10, with both the owning source closure and the entire
packet's hash/full-metadata closure intact. Separate affected effective-scope and
NFS-adoption suites also pass. Independent reviews cover the geometry consumers,
runtime checks and diagnostic privacy. Source packet SHA256:
`83df7f264596bb713fe1e86f18d38250839a8546f6ce9794641fdbd0b8d1f1d0`;
actual full-run receipt SHA256:
`055178f15cf7ac26ee94e0c830fdc0cc8be8ba3b22ffc63c55a986522229a899`.
New matching native-image publication, actual installed-source capture and a new
configured supplier generation remain prerequisites for connected execution.
Earlier image evidence cannot cover changed adoption bytes. No live rollout,
comic import, acknowledgement, full-worker start or final task acceptance follows
from these source controls.
## Hosted CI closure and interpreter correction — 2026-10-21
Hosted CI on PR #461 rejects two stale source manifests: the effective-scope
build inventory and the authenticated standalone native test bundle. Both
failures remain recorded. The effective-scope repair refreshes current source
hashes and adds a regression through the actual source reader. Its complete
JDK 21 gate passes 61 Python controls and 37 Java cases without changing compiled
hashes or public dependency facts.
The same review catches an incorrect Python 3.13 assumption in SourceCohort.
The tracked Dockerfile explicitly requires daemon Python 3.10 and private Modern
Python 3.13.16. The probe invokes `/lsiopy/bin/python3`, so its predicate must
remain 3.10. The earlier 1,239-control source result tested the wrong predicate
and cannot establish installed runtime acceptance. The corrected predicate and current source-family pins pass independent review.
The complete authenticated collection passes 148 controls without skips on
system Python 3.14.8. Its seven copy controls, including the real 26-control
broker subprocess, pass. Managed Python 3.10 passes 34 SourceCohort controls and
nine Dockerfile/runtime-contract controls. That managed runtime lacks the
`fcntl` sealing constants needed by the separate crypto collection, so it does
not establish native authenticated-runtime acceptance. No constants or guards
were changed to conceal that gap.
Mandatory local validation now includes the authenticated-copy and effective-scope
source-reader suites. Reviewed correction patches have SHA256
`fade7a2d461b8706a4fefa6f9f04e35ed486cc4a179b317d17308211b3b4ce64`
and `cea1e30c4ef3258e0d4639510011564d0ca9c22cb5865b2743ff5095f8c15aed`.
The corrected integrated source passes all 1,239 controls across 72 suites under
managed Python 3.10 with zero skips and unchanged original sources. Successor
receipt SHA256:
`76542eaf220c8173caf6cb653e3f5af079c2e38f397aecdcb7df82bbb4ff92cc`.
Repository validation passes with the new owning checks enabled. Installed
factory, publication and configured acceptance remain false. Required hosted
image CI remains pending. No live service change occurred.
## Next-generation preparation and Clark integration — 2026-10-21
Clark PR #460 merges as `0c9018f` after all current-head checks pass. The actual
isolated Chromium/CDP result verifies hostname attachment, page JavaScript,
forwarded HTTPS discovery, prefetched browser preservation and launcher exit.
The exact exited test container and private network are removed with absence
verified. Its original attach CLI return code was not retained; the canonical
result and daemon exit code zero remain the observed facts. This is not live
ingress TLS or deployment acceptance. The media branch includes the reviewed
Clark tree and requires fresh combined-head CI before its own merge.
The public-source capture successor permits exactly the reviewed adoption leaf
change among 180 expected module hashes based on the original capture, preserving
the other 179 values and
53 installers. The disabled supplier freezes the current installer, 13 source
roles and 10 NFS roles. It requires a future original capture/map/publication
join before deriving SDK102 from actual values. Twelve focused controls pass
for each preparation on host and Python 3.10, with independent review. Neither
has run its operational phase or refreshed the historical 27 output references.
Review holds an earlier private request wrapper because its launch entry bypasses
preparation checks and its source loader reopens mutable files. It was never
activated. The reviewed replacement only assembles the existing 12-key Creator
request data from pinned JSON templates. It has no loader, launch, activation,
transport or output interface. Twelve data/composition controls pass on both
host and Python 3.10 using disposable fixtures and explicit transport doubles.
Reference shapes confer no authority: Root still must
verify fresh originals and use the existing owning Creator for execution.
New native publication/image/capture bindings and new-parent facts remain unset. No live
service, import, ACK or configured factory acceptance follows from preparation.
The capture, supplier and data-only packet seals are respectively
`8577c51822335c154b1033ffc9c4befe3fabea5fd52b77845bcb46f01f293632`,
`bcea7f299f5947252682d0728c4fa58d4c5f37be3b00564132a4a77ed4b249c3`
and `7c609053419581087e0a0d7959301f28dc9f30cf601571e9b59541defc08ee30`.
## Build warning corrections — 2026-10-21
GetComics' cached HTML parser leaked its file handle and used deprecated
BeautifulSoup calls. A checked adapter replaces the 15 active legacy calls,
preserves the parser's decisions and closes the handle on success or failure.
Eleven controls pass with real BeautifulSoup on Python 3.10 and 3.14; installed
native failover tests now reject deprecation warnings. The original fixture
remains unchanged.
The bootstrap regex uses a raw literal with identical AST and regex value.
Its current digest consumers are updated together. Sixteen anchor controls
pass on both interpreters. Eight SQLite test-fixture connections now close
after their transactions; all 40 Bridge/Annual controls pass on both versions.
Allocation traces identify those fixture leaks separately from production code.
These corrections grant no configured acceptance. They change source identities
beyond the adoption-only PR #461 generation, including GetComics and the
installer inventory. Its disabled capture/supplier packets must not be reused
against a later warning-corrected image; require matching publication, original
capture and a fresh configured generation before continuing the live gates.
The complete corrected recovery collection passes 1,239 controls across 72 suites
on Python 3.10; the authenticated collection passes all 148 controls on host
Python 3.14 with the actual archive SDK. Both report zero skips. Repository
validation and independent review pass. Hosted image CI and configured acceptance
remain separate requirements. The refused first runs remain diagnostic history.
The completed build also exposed a preproof fixture child that was killed without
being reaped on expected refusal paths. Cleanup now always waits for that exact
child and requires its recorded return code. The owning 48 controls pass on
Python 3.10 and 3.14 with zero skips and no subprocess ResourceWarnings after
forced collection. Production subprocess handling is unchanged. Current finite
copy maps include the corrected fixture.
Pre-merge source review found the optional GetComics entry still used its prior
hash. Replaying the checked adapter against the original captured public source
derives `b19d1254…c5866`; reversing the change reconstructs the exact original.
The current base, installer and regressions advance together, preserving the
102 required/180 known names and historical manifests. This is a prospective
source expectation; actual published-image capture remains required.
### CI verification scheduling — 2026-10-21
The completed PR #461 Mylar build took 36m 3s; its verification layer took
2,095.1s. Compilation dependencies were cached. The publication/tagging suite
ran 117 tests in 624.003s after the parallel owning suites had finished. The
Modern tagger's separate 21 tests took 47.489s. Repeated genuine archive/proof
checks contribute to runtime; caching those freshness decisions is not valid.
A separate scheduling candidate moves publication/tagging to the front of the
existing four-worker pool, with an independent source copy and private fixtures.
All tests, source checks and failure propagation remain mandatory. Per-suite
elapsed times include source preparation and child execution. Hosted before/after
measurement is required before claiming a speedup; no configured acceptance or
formal task completion follows from this scheduling change.
### Cacheable image verification stages — 2026-10-21
PR #463 merged after all hosted checks passed. Its completed Mylar build ran
verification in 1,219.1 seconds (20m 19s), compared with 2,276.8 seconds (37m 57s)
for PR #462. The pooled 117-test publication/tagging suite took 466.729 seconds.
These are observed individual builds, not a guaranteed duration.
The next implementation separates the fixed tagging dependency closure from the
remaining image checks. Both branches share the exact installed archive SDK and
Modern runtime. The tagging branch copies 90 explicit source files and runs all
117 tests with zero skips; the remaining branch has three owning-suite workers.
A mandatory aggregate checks the tagging receipt against current source hashes.
The default standalone verifier retains the full collection. Neither branch
caches configured freshness decisions or grants operational acceptance.
PR #464 contains the split. Full repository validation, source lint and
independent review pass. The actual `tagging-checked` image stage passes all
117 tests with zero skips in 430.125 seconds; the stage takes 431.0 seconds.
An unrelated reader-fixture edit reuses the complete tagging stage (BuildKit
`CACHED`), without rerunning its tests. Changing one declared source invalidates
the stage and refuses the stale manifest before test execution. All 43 hosted
checks pass, with one expected Spec Kit update skip; feedback, unresolved threads
and default/PR CodeQL alerts are clear. PR #464 merges as
[`81ef39b010e11da7967ecb3f6d29cdd4a78c0eb7`](https://github.com/bolens/homelab/commit/81ef39b010e11da7967ecb3f6d29cdd4a78c0eb7).
Local main and the authorized mirror are verified at the same merge commit.
No formal task checkbox advances from this build-only proof.
The hosted PR #464 job takes 29m 44s. Both verification branches execute: the
tagging stage takes 666.3s and the remaining checks take 1,743.9s, overlapping
as designed. The mandatory aggregate takes 0.1s. This run does not show a cold
build speedup; the verified benefit is reuse of the unchanged tagging stage.
[GitHub Actions cache visibility](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#restrictions-for-accessing-a-cache)
follows branch scope, so another PR cannot assume access to this PR cache
before a matching main build seeds its cache.
The warning-fix image published from PR #462, merge `335226b`, also completes
its trusted main publication. Its
actual daemon identity, registry provenance and new isolated source capture join:
all 180 native sources and both startup scripts match, original source custody
closes and the disposable container is removed. No application starts during
this capture. SourceCohort and connected Parent acceptance remain required;
the disabled prior source packets confer no configured authority.
The matching original-bound supplier ran successfully: it derives the required
102 SDK sources from the captured 180 and prepares a new generation of all 27
original installation outputs. Source custody closes; no container or service
changes occur, and lifecycle/configured admission remain false. Creator v3,
current daemon-3.10 SourceCohort, NFS and import/ACK acceptance are still required.
Superseded private bundles with the incorrect 3.13 daemon predicate stay inactive.
### Creator configuration AST correction — 2026-10-21
The fresh disposable Creator reaches the actual pinned configuration source,
which declares `_CONFIG_DEFINITIONS = OrderedDict({...})`. Its parser expected a
bare dictionary and refuses before any of the three created test containers
starts. Scoped cleanup removes exactly those three never-started containers and
the empty private network, with source closure and no force, volume or service
changes. Failed-attempt evidence remains retained; no application processing,
import or ACK occurs.
The correction accepts only the existing literal dictionary or one exact
`OrderedDict` call around that dictionary. It evaluates no configuration code;
unknown wrappers, arguments and dynamic definitions still refuse. All 39 Creator
controls pass, and the complete recovery collection passes 1,241 controls across
72 suites on managed Python 3.10 with zero skips. The retained run's SHA256 is
`a80c2cf193a9166df286ddb21c96c234e7ac6334d522bf3e5ee9b27ded1f7cf3`.
These source results do not establish Creator startup, SourceCohort, connected
Parent/NFS or terminal acceptance. Matching source pins and a fresh reviewed
generation remain required before another operational attempt.
### Creator startup diagnostics and pending source closure — 2026-10-21
An owned disposable startup reproduction confirms only the observed
`HostConfig.OomKillDisable` transition from `false` to `null`; every other
immutable field must match. The reproduction fixture is removed. The next
Creator attempt reaches native startup and then refuses its inspection. Exact
cleanup removes its three fixture containers and private network with source
closure, retaining the failed generation's files without replay. This supplies
no connected factory, processing or import/ACK acceptance.
A separate CLI-only reproduction, without contacting the daemon, confirms that
Docker's deprecated `--time` spelling writes its warning to stdout. The paired
`--timeout` spelling avoids contaminating the checked command reply. The source
correction also adds safe private profile diagnostics and fixed trusted-frame
reporting. All 49 Creator and 29 bootstrap controls pass on Python 3.10. These
are focused results; actual startup and the complete current source closure
remain separate gates.
PR #465 head `8f29b35` fails two outer aggregate assertions that still expect
1,239 tests while its owning collection returns 1,241. Both failures remain
recorded. Those exact expectations now advance to the new 1,251-control
inventory, retaining their assertions. The first full outer run catches a
stale CurrentRoles bootstrap source pin and remains a failed attempt. After
updating that exact pin and its manifest, all 14 outer checks pass in 94.719s
on Python 3.10, including the complete 1,251-control collection. Independent
review verifies every declared source-map hash and current semantic pin.
Historical 1,239/1,241 results and installed proofs retain their original scope.
The next actual Creator starts both disposable services and passes the reader
JAR, native process and unclaimed-status checks. Its one enrollment POST returns
HTTP 400. The failed request and private diagnostics are retained without replay;
no factory, NFS, import or ACK acceptance follows. The generated email has a
74-character local part, exceeding the pinned validator's 64-character limit.
A bounded email correction and read-only status check remain in progress; the
saved error does not establish the server's exact rejection reason.
The email correction uses a 58-character local part and preserves the full
nonce/CID and API-key comment bindings. All 50 Creator controls pass on host and
Python 3.10. The final 14 outer checks pass in 86.724s, including all 1,252 owning
controls with zero skips. The pinned [Komga claim controller](https://github.com/gotson/komga/blob/2ab7a5a61a8b8bb12a6edd576fed380b4b613c99/komga/src/main/kotlin/org/gotson/komga/interfaces/api/rest/ClaimController.kt)
requires email validation; the corresponding [validator](https://github.com/hibernate/hibernate-validator/blob/8.0.3.Final/engine/src/main/java/org/hibernate/validator/internal/constraintvalidators/AbstractEmailValidator.java)
limits local parts to 64 characters. The earlier HTTP 400 remains a retained
failed attempt, not evidence of successful or absent enrollment.
PR #465 head `0b6e98a` then exposes a second bootstrap-hash consumer in Komga's
effective-scope verifier, outside the native collection. Its exact semantic pin
and the two affected manifest rows advance together; a direct current-source
regression prevents silent drift. All 62 Python checks and 37 JDK 21 closure
cases pass through the exact failed CI command, with no optional-tool skips.
Spring replay and configured scope acceptance remain unverified. Normal CI must
pass on the corrected head before merge.
The original-bound INNER installation export also succeeds: all 27 original
files, hashes, namespace and directory identity close unchanged. Only a new
private six-key result and its original-wrapper reference are written. No
installer, Docker or lifecycle runs. A separate one-GET diagnostic confirms
the third fixture remains unclaimed, with all three role epochs unchanged.
Historical Creator-source divergence is explicit; this diagnostic grants no
factory or mutation authority.
### Fresh isolated enrollment and restart refusal — 2026-10-21
The third generation's two test services stop, all three containers and its
private network are removed, and its files and failure evidence remain intact.
A fresh fourth generation using Creator `1804072a` and Bootstrap `18db2194`
passes actual reader enrollment/API-key creation, virgin configuration
backup/restore and native initialization. Its planned native restart succeeds,
then the preservation verifier refuses a changed MAC address. No attempt is
replayed, and no production service changes.
The retained native capture `22e79151` and network capture `aff075f1` agree on
the new native endpoint ID and MAC address. Only the native sandbox, endpoint
and MAC fields change; all other network fields and non-network container
configuration remain equal. The native epoch changes as intended. Exact owned cleanup then stops both
test services, removes their three containers and private network, and retains
all initialized data and evidence. A narrow paired restart successor is being
implemented; SourceCohort, connected factories, NFS, import and ACK acceptance
remain open.
Independent review also corrects the prospective private SourceFixture helper's
verified-byte imports, final original closure and cleanup after a lost start
reply. Its 23 host/Python 3.10 controls pass, with targeted independent rechecks.
The helper remains disabled and grants no runtime or publication acceptance.
Original installation outputs and earlier failed generations stay retained.
The combined source correction joins native endpoint/MAC changes to the same
original network and commits profile, epoch and network together only after all
role checks pass. It also derives the stdin parity program from the owning
installed-file probe and original 180 filenames, without embedding expected
hashes. Arbitrary map printers refuse; the existing Parent still compares the
complete observed map. Core tests and writer-fixture sources require canonical
bytes and grant no execution rights. Original configured Parent custody stays
bound to the original installation.
Independent reviews pass for both changes. Bootstrap 33 and SourceCohort 38
controls pass on Python 3.10. The integrated 14 outer checks pass in 90.856s,
including all 1,260 controls across 72 suites with zero skips. The direct semantic
pins, all current copy maps, Komga's 62 Python/37 JDK 21 checks, Source lint and
full local CI pass. The new batch still requires hosted CI, delivery and fresh
connected execution. No aggregate acceptance checkbox changes.
## Single-authentication batch and interrupted fixture — 2026-10-21
The fifth disposable Creator attempt retained a deadline refusal at its read-only
native inspection. Public startup/configuration copies completed, but the first
start path had not reached a start intent. The attempt is not replayable; current
container state must be established before exact owned cleanup. No connected
factory, NFS, import or ACK acceptance follows.
The operator requested one authentication for related privileged operations. The
next launcher will authenticate before starting command deadlines and execute a
finite batch with the existing identity, phase, output and cleanup checks. No
persistent Docker access is authorized. The launcher is implemented and
independently reviewed. Its 24 new controls and the existing 50 Creator controls
pass in Python 3.10. The complete 1,284-control, 73-suite cohort and its 14 outer
controls pass, with zero skips; full local CI also passes. Actual Root identity,
privileged transport and connected execution remain pending. Aggregate task
markers are unchanged.
PR #466 merged after 14 passing hosted checks and one expected skip. GitHub,
local main and the configured mirror agree on the reviewed merge. The new
host-only batch transport retains the selected image/SDK originals and requires
no image replacement merely to exercise it.
## Recovered storage notes and old-worktree cleanup — 2026-10-21
The retained 2026-10-15 task note records 115 old unused private cache records
in the first 866.5 MB pass. It describes the separate 84-image cleanup as a
no-force pass limited to October 7 or earlier task-local images. The
[archived cleanup record](evidence-history-through-20261020-4164dd6.md#recovery-delivery-and-storage-cleanup-2026-10-15)
preserves the accepted storage history and later delivery status. These recovered
task-note details are historical attribution, not a new cleanup execution or
operational verification.
The old PR #341 worktree contains only two modified spec 023 documents. Its
committed tree matches the merged PR exactly. Three added evidence paragraphs
already survive in the archive, and two have newer verified delivery results.
The complete uncommitted patch and Git snapshot `686b4ec3` are retained in a
private bundle. Independent unbundling verifies both original document blobs.
After checking ignored outputs and current source dependencies, cleanup removes
only this old worktree without force. The exact squash-integrated branch ref is
removed after bundle and tree verification, retaining the archive ref. The app
archive request remains queued and is not counted as completed archival. No implementation or aggregate
acceptance checkbox advances from this documentation reconciliation.
## Single-authentication execution and binding refusal — 2026-10-21
The actual privileged batch passes its identity check: processing returns to
UID 1000, saved Root cannot be regained after final drop, and the exact Root
probe client is terminated and reaped. It then verifies all three earlier test
containers were Created and never started, removes those exact containers and
their private network, and preserves their data and journals. No service stop
is issued. These are executed results, separate from the 25 private wrapper
controls passed on host and Python 3.10.
The next UID 1000 binding phase refuses after writing its first exclusive
request file and before writing the companion reference. The wrapper records
only identity and cleanup as completed, exits nonzero and never enters
activation. The incomplete generation and all outputs remain retained. No
request, cleanup or activation is replayed. Fresh connected fixture execution,
factory/NFS acceptance, live imports and acknowledgements remain unproved.
## Catalog runtime contract and per-operation diagnostics - 2026-10-21
The second single-authentication batch passes its Root identity check and the
corrected fresh-directory binder. The seventh isolated generation passes reader
enrollment, virgin backup/restore, native initialization and its planned restart.
Catalog seeding then refuses before connected recovery. The worker remains
never-started. This attempt changes no production service. Its request, journal,
partial catalog operation and all earlier histories stay retained without replay.
Read-only examination of the retained fixture identifies the contract mismatch:
Mylar creates its database at mode 0644 inside its UID/GID 1000 DATA directory at
0700. Its schema and integrity checks pass. The helper had required mode 0600,
and its old unit fixture manually set that mode. The corrected helper accepts
only 0600 or 0644 under the retained private DATA directory, preserves the exact
database mode, and verifies directory custody before committing. Real SQLite
creation with umask 022 reproduces the old refusal and passes the correction.
Directory replacement or permission drift before commit rolls back.
The Creator now retains a separate bounded private failure record for each
original operation intent. An expected earlier probe failure can no longer hide
a later catalog failure. The original first-failure record stays unchanged.
Fixed diagnostic function/line reporting adds no configuration or row values.
The integrated source passes 53 Creator controls, 33 catalog controls and 24
privilege-batch controls in Python 3.10. All 14 outer checks pass, including the
complete 1,299-control collection across 73 suites, with zero skips. Source maps
and aggregate counts change together. Hosted delivery, fresh configured
execution and eventual import/catalog-to-ACK acceptance remain pending. These
results do not complete the remaining feature 022-024 acceptance tasks.
## Seeded catalog date contract and retained processing failure - 2026-10-21
Exact owned cleanup of the seventh fixture stops only its reader, removes all
three test containers and their private network, and retains the original data
and journals. The eighth isolated generation then passes catalog seeding with
the startup-created 0644 database inside its private 0700 DATA directory, and
its native restart passes. One forceProcess request is submitted and consumed
by the post-processing queue. Processing stops with a TypeError when the pinned
consumer slices a fixture row's null LatestDate; a valid ReleaseDate did not
satisfy that separate field contract.
The retained fixture database passes quick_check. The native and reader remain
retained, and the worker remains Created. No request is replayed, and no import,
ACK, connected-factory or NFS acceptance is inferred. PR #470 consolidates the
committed catalog correction and passes all required hosted checks on candidate
`3b6f74f5`. It is squash-merged as `4a2670f9`; PR #468 is closed as superseded.
GitHub, local main and the configured mirror agree on that revision. The separate
date-fixture source correction supplies LatestDate, LatestIssue
and intLatestIssue matching each seeded issue. Three added regressions verify
cross-table coherence, execute the pinned genuine processor date-selection
block and reproduce the null-date TypeError. The processor fixture differs from
the installed image, so this is source-block coverage, not installed-processing
proof. All 36 catalog controls pass on host and Python 3.10; all 14 outer checks
pass, including 1,302 controls across 73 suites without skips. The finite checked
copy adds only that existing processor fixture and closes at 690 source files.
Fresh configured execution remains required. All 16 remaining aggregate task
markers stay open.
## Genuine isolated bootstrap completed - 2026-10-21
The ninth finite batch exits successfully through identity, owned cleanup, fresh
binding and activation. Both genuine Mylar queue imports complete, followed by
reader scan/progress checks and restart. The fixture worker remains stopped;
original receipts, data and earlier failed generations remain retained. This
accepts the isolated bootstrap milestone only. Connected factories, NFS,
publication, retained live-DDL recovery and fresh catalog-to-ACK acceptance remain
unproved; all 16 remaining aggregate task markers stay open.
PR #471 merges as `84573600b2c5457f2c29e51a301c3ab885fcf7c9` after passing
normal hosted CI. Local main, GitHub and the configured mirror are synchronized.
The 1,302-control/73-suite source proof remains distinct from this genuine
isolated execution and from the remaining configured acceptance gates.
The complete 022–024 task lists are reconciled against this checkpoint: 21/24,
25/33 and 13/18 tasks are complete, respectively (59/75 overall). Stale current
failure and unimplemented-capability summaries are replaced; historical failures
remain unchanged. The remaining execution order separates delivered components
from SourceCohort/connected proof, physical and aggregate acceptance, fresh DDL
ACK/recurring consumption, and final library/bulk/retention checks. All task IDs
and completion states are preserved, and local evidence links resolve.
## SourceCohort preparation held - 2026-10-21
The next finite source-verification batch completes its fresh input-staging
phase, then stops in preparation with a ValueError. The invocation phase never
starts. The retained error output does not identify the refusing check or prove
test-container cleanup; both remain unverified pending bounded diagnosis.
Original inputs and failed-attempt logs are preserved without replay. This
isolated attempt changes no production service and does not invalidate the
accepted generation-nine bootstrap. SourceCohort, connected factories and all
16 remaining task acceptance gates stay open.
## SourceFixture private-directory handoff correction - 2026-10-21
The diagnostic-v3 attempt stops in the owning Emitter's unchanged bundle guard
before control-suite execution. A directory census identifies exactly one
supplier intermediate, `config/test_fixtures`, at 0755 instead of the required
0700. A distinct supplier creates all 19 directories at 0700 and all 693 helper
and payload files at 0600 before capturing references. Source bytes, maps and
the admission guard remain unchanged. The complete genuine `_bundle` method
reproduces the predecessor refusal and accepts the corrected projection;
35 existing and three new focused controls pass on host and Python 3.10.
The newest failed-generation census then confirms zero matching containers;
the earlier failed attempt also retains its verified cleanup receipt. A fresh
corrected batch then passes staging, genuine Emitter preparation and the
separate installed verification phase. All 1,302 controls across 73 suites pass
with zero skips. Installed-source/type checks pass before and after execution;
source/runtime closure and exact owned-container cleanup with absence proof
also pass. The original SourceCohort receipt is retained for the next consumer.
Both failed histories stay retained without replay. Fresh effective-scope and
current-role observations, connected factories, archive terminal, NFS, retained
live import and ACK acceptance remain open, as do all 16 aggregate task markers.
The accepted generation-nine bootstrap is unaffected.
## Active-input parent precreation correction - 2026-10-21
The host assembler required an existing probe parent and its signature, but the
owning Parent must create that directory and requires a null incoming signature.
The corrected assembler retains the absent nonce-named parent, the original
existing grandparent's full identity and the exact operation/probe output join.
Only the two known absent intermediate parents receive explicit ancestor anchors;
no recursive fallback or directory creation is added. Final closure refuses late
parent birth or grandparent drift. The owning Parent and lifecycle are unchanged.
All 19 focused controls pass, including the genuine Parent precreation source
block and complete lifecycle creation method with explicit disposable mount/role
doubles. The complete 1,306-control/73-suite collection passes on Python 3.10 with
zero skips and original source closure; all 14 owning runner controls pass.
Independent source/integration review, source-map closure and local repository
validation pass. Hosted delivery remains pending.
These are host tools excluded from installed application modules. Installed SDK,
image and all 16 consumed SourceCohort role originals remain unchanged. The
accepted earlier receipt remains its actual 1,302-control generation; it is not
relabelled or replayed. Fresh effective/current-role inputs and genuine connected
factory, archive-terminal, NFS and live import/ACK acceptance remain required.
## Private NFS owner-read boundary - 2026-10-21
The bounded read-only generation-nine geometry check completed successfully:
UID 0 received EACCES for all three original geometry directories, while
effective UID 1000 could enumerate their exact bounded namespaces. Ancestor,
original identity and current metadata closure passed. The check changed only
effective UID temporarily; it does not prove equivalence to the complete child
credential profile, Docker bindability, NFS mutation or publication acceptance.
Permissions and export settings were unchanged. The private checkpoint retains
the exact diagnostic source hash and observed metadata.
The combined source implements explicit owning-UID reads and the causal
malformed-directory-marker transition inside the existing stopped-reader/Writer
action. The transition derives from the actual imported archive, preserves its
valid genesis and requires byte-exact forward repair. Rollback restores the
malformed successor. It cannot substitute a separately seeded archive or reset
a failed attempt automatically.
The actual metadata-only owning-reader check passed against the three original
NFS directories using the reviewed combined Parent source. It enumerated two
common-root entries, two library entries and an empty retention directory,
closed original source/directory custody, and restored Root identity. It made no
Docker calls or application writes. This resolves the host read-access
prerequisite, while full NFS mutation, installed factories, repair and ACK remain
unproved. The original installation and SourceCohort receipts remain immutable.
Integrated review caught a public-source callback mismatch before activation.
The full source run also caught legacy constructor-call drift and mock fixtures
that did not model the owning Parent. Their corrections preserve the original
assertions; the full source gate must pass before connected execution.
No task checkbox changes.
The revised checked installer completed an actual private installation with
27 new output references and source closure. It retained the unchanged active
parent's original source URI and preserved the accepted earlier installation
and SourceCohort. No container or service changed, no lifecycle ran, and the
installation explicitly grants no configured admission. The integrated source
gate remains required before the connected action.
The final combined source passes all 1,392 controls across 75 suites on Python
3.10 with zero skips, plus all 14 outer collection/preservation checks. Source
custody closes before and after the private-copy runs. Independent integrated
review, Python 3.10 syntax, Ruff, Markdown, repository validation and normal
`make ci-local` pass. Legacy constructor calls and all original adverse
assertions are preserved. Historical failed runs and the earlier installation
generation remain retained. The final-source checked installation subsequently passed with 27 new outputs,
original source closure and no lifecycle or configured admission. Its original
receipt identity was captured separately; earlier generations remain unchanged.
Hosted CI is the next delivery check. Connected factories, NFS mutation, repair and
catalog-to-ACK acceptance remain open. All 75 task IDs/order/states are unchanged.
Hosted security analysis flagged a negative test that added group-read access to
its disposable directory to provoke mode-drift refusal. The test now removes
owner-write access instead. It exercises the same refusal and exact FD closure
without granting another principal access. Production permissions and all
assertions are unchanged; the source-manifest pin follows the corrected test.
Hosted security and image checks must pass on the updated PR head before merge.
## Authenticated empty source-proof stderr - 2026-10-21
A bounded Root metadata check confirmed that the accepted original SourceCohort
is unchanged and its successful stderr is empty. The producer already permits
this result, while generic host readers correctly require nonempty documents.
A separate reviewed candidate adds a dedicated exact-cohort stderr reader and
routes the owning composer, assembly, parent preparation and child projection
through it. It preserves the original full identity, hash, private mode and
late closure; ordinary empty documents and mismatched roles still refuse.
Neither originals nor prior receipts are padded, replaced or refreshed.
The candidate passes all 1,397 controls in 75 suites and all 14 outer preservation
checks on Python 3.10, with zero skips and original source closure. The exact
reviewed source changes are integrated in a separate worktree. The successor
checked installation, all 27 original outputs and the separate reference export
now pass in one authenticated batch. The original source graph closes across
all 20 references. Delivery and fresh configured observation remain pending.
The separate caller and projection now have reviewed role-specific routes and
pass 12 host/Python 3.10 controls with zero skips; activation remains disabled. The subsequent authenticated capture verified both original
logs and the readiness receipt by hash/full identity, with the cohort's original identity
unchanged. No configured repair, factory, NFS mutation or
ACK acceptance is claimed, and task checkbox states remain unchanged.
PR #476 merged after all hosted checks passed and its security conversation was
resolved. The squash tree matches the reviewed head. Local main and the Gitea
mirror follow the reviewed merge; source worktrees referenced by original
installation receipts remain retained.
## Connected repair preflight corrections — 2026-10-21
PR #476 is merged after passing hosted CI and security review. The authenticated
empty-stderr successor in PR #477 is merged after passing hosted CI. It passes
1,397 source controls across 75 suites,
all 14 outer checks and the checked installation, verification and reference
export of 27 outputs. Connected acceptance remains pending.
The historical installed 1,302/73 proof remains a separate generation.
Source inspection identified two fixture preparation requirements before the
next fresh observations: scratch must be owned by the UID/GID1000 archive child,
and the image's declared `/config` volume needs an explicit read-only original
bind alongside the narrowly writable `/config/mylar` DATA bind. Independent
review confirms these preserve the existing scope and exact mount guards.
These are preflight source findings, not configured repair failures or proof of
execution. A new empty local mode0700 scratch was then created as UID/GID1000
after checking the original parent identity, local filesystem and absence. No
existing directory permissions changed. Owning repair, NFS mutation and fresh
import ACK remain unproven. All 75 task IDs and states remain unchanged: 59
complete and 16 open.
## Bootstrap profile and source-origin continuity — 2026-10-22
The combined configured batch refused `bootstrap-original-profile-epoch` during
the effective observer, before CurrentRoles, owning Parent execution, reader stop
or archive repair. Three original saved errors independently retain that same
cause and source boundary. Production services were untouched, and no retry or
acceptance followed. The retained reader profile and epoch match between the
original plan and result; only the recorded native restart changes its epoch.
The observer expected legacy `Created` where the owning static projection uses
`NetworkSettings`. The source correction uses the owning projection and keeps
exact reader epoch and network comparisons. A related source audit found that
CurrentRoles assumed historical helper/probe/scope originals lived beside its
current module and expected the parser in the reader-fixture directory. The
correction preserves the authenticated original helper context and adds the
actual loaded config parser as an explicit byte-pinned source role. A newer
observer can retain unchanged older owning modules without relabelling their
original paths or file identities.
Focused source controls and independent review cover the observed projection
failure, original URI refusal, mixed generations and late source drift. The
updated aggregate passes 1,401 controls across 75 suites, and all 14 outer
controls pass under Python 3.10. The observer’s source/compile gate also passes,
including its 43 parent controls and 37 JDK closure cases. Full local CI and
history secret scanning pass. Hosted CI, delivery and a new causal SourceCohort
remain required before another configured attempt. The previous SourceCohort remains historical; its effective-parent URI
and digest cannot be retargeted to the corrected observer. No new factory, NFS,
repair or import ACK acceptance is claimed. All 75 task IDs and checkbox states
remain unchanged: 59 complete and 16 open.
## Paired readiness preparation refusal — 2026-10-22
PR #480 merged after passing hosted CI; its squash tree matches the reviewed
head, and GitHub main, local main and the Gitea mirror agree. The corrected
source worktree remains frozen for its original references.
The next combined Root batch refused at `source-original-readiness-nonce`
during SourceFixture preparation. Its fresh request nonce was paired with an
older readiness input. The emitter, fresh observations and owning Parent never
ran in that attempt. The paired-input correction passes six isolated controls
and independent review. The next batch verified the prior cleanup and exact
container absence, then completed a new causal SourceCohort and verified its
own disposable-container cleanup. Its unchanged P690 context remains labelled
1,302 controls across 73 suites, separate from the current F source collection.
The corrected effective observer and current-role capture passed. Read-only
projection then refused `original-empty-lock-FD`. The original writer lock
contains the exact 22-byte `media_writer.PROTOCOL` marker; the observer had
assumed an empty lock file. The installed lease reference was independently
confirmed against the authenticated installation table. No Writer lock was
acquired and the owning repair Parent did not run. Correct the observer to verify
the owning protocol’s exact bytes through the original FD and full file identity;
do not truncate or replace the lock to satisfy the old assumption. Prior accepted SourceCohorts remain intact;
no connected factory, repair, NFS mutation or import ACK acceptance follows.
All 75 task IDs and states remain unchanged: 59 complete and 16 open.
## Writer protocol projection and assembly boundary — 2026-10-22
PR #481 merged with all required hosted checks passing. Its reviewed and squash
trees agree, and GitHub main, local main and Gitea agree. The completed local
notes branch was removed; its reviewed commit remains archived. Its worktree is
reused for the next focused source change rather than creating another checkout.
The private projection now derives the exact protocol marker from the original
SourceCohort writer source and checks its bytes, size, FD/path identity and hash
through final closure. Seventeen controls pass on host and Python 3.10, including
old full-producer failure followed by corrected success, wrong source pins,
damaged/replaced markers and late drift. Independent review cleared the frozen
source and the next actual bindings. No lock file was reset or truncated.
The next single batch completed a new causal SourceFixture: 1,302 controls across
73 suites, exact source closure and owned-container cleanup/absence. Its cohort
digest is `247a5f17963dac248dcfa92b559bd210f2052ec8ede51949dbddbcb3a35bb19a`.
Effective observation, current-role capture and protocol projection then passed.
The active assembler refused `active-output-custody` before Writer acquisition,
Producer invocation or repair Parent execution. Production services were unchanged.
A disposable test on the same Btrfs filesystem reproduces a stale listing from
a reused directory descriptor immediately after adding a file. The maintained
assembler must apply the already documented fresh-relative-descriptor census,
retaining original directory identity, exact names and final closure. The source correction now passes all 25 owning controls on host and Python 3.10,
including the complete stale-listing path, replacement during an empty census,
and mixed source generations with strict alias and drift refusals. Independent
review cleared both the source and its exact integration maps. The full Python
3.10 runner passes 1,401 controls across 75 suites, zero skips, with original
source closure. All 14 outer controls, full local CI and history secret scanning
pass. The unchanged later hardlink-cleanup helper also passes five
disposable Btrfs runs; that supplies no actual NFS or lease proof. Delivery and
another fresh owning attempt remain pending. This is no factory, NFS repair,
publication, import ACK or bulk acceptance. All 75 task
IDs, ordering and checkbox states remain unchanged: 59 complete and 16 open.
## Owning producer entry after assembler delivery — 2026-10-22
PR #482 merged with all required checks passing. The merged tree equals the reviewed
source tree. GitHub, local main and the configured Gitea mirror agree on the merge.
The five-file actionable-task refinement remains under PR #483 with normal CI.
The fresh G batch passes its original causal SourceFixture contract, source closure
and exact owned-container cleanup/absence. Cohort digest:
`cb8b073689449389cdc36ae6b9ac99fea27f89fbc45ad4e9cccd6ae55221e7e1`.
Current roles, protocol projection, active assembly and NFS intent construction pass.
The producer invokes the owning entry once, then exits without an accepted terminal
return. The retained traceback confirms `run_operation` entered Parent construction,
which refused `configured-overlay-exact-approved-edits` before its owning execute.
The packet mapped the operation to its host path, while the installed admission
correctly targets the fixed child path `/_operation`. No new overlay mechanism is
missing; the new packet must correct that destination. No replay or
factory/NFS/publication/ACK acceptance is inferred.
Process exit also reports a common-root descriptor double-close. Source inspection
confirms that actor release closes registered directory FDs before a weak-reference
finalizer closes the same numbers again. The admission-refusal path has the related
raw-close ownership problem. A focused ownership correction and FD-reuse regression
are implemented and reviewed under T026; the installed E outputs and every failed history remain
immutable. A changed host Parent needs a fresh checked configured installation,
not replacement of unchanged native/worker SDK evidence.
An independent read-only live check confirms both services healthy and the permanent
normalizer Created. A later filtered pack/API check confirms native publication ready,
pack automation enabled and the exact historical selected capture still present with
zero inventoried members. No import, inventory publication or acknowledgement ran.
Task IDs and states remain 59 complete and 16 open.
The integrated source now closes each common-root descriptor through its original
owner once, handles admission refusal through the same deregistration path, attempts
all cleanup and preserves an earlier operation error. The producer also rejects an
operation child path other than `/_operation` before opening the Parent. Original
source reproductions fail the descriptor-reuse and wrong-path controls; corrected
source passes. Installer, CurrentRoles and assembler pins and all source maps join
the exact new bytes. No existing installed file, receipt or admission was relabeled.
Python 3.10 passes 1,406 recovery controls in 75 suites with zero skips and original
source closure, all 14 outer controls, and seven import-copy controls. System Python
passes seven authenticated-copy controls. The managed Python 3.10 broker child
refuses because its `fcntl` lacks `F_SEAL_WRITE`; the saved diagnostic preserves
that original error. Required target-runtime CI remains applicable. Full local CI passes after installing the locked development
packages in the new worktree. Independent source/map review clears the integrated
candidate. Hosted delivery, fresh installation and connected execution remain open.
The subsequent isolated H installation and independent INNER export both succeed.
All 27 configured outputs retain their verified original bytes and identities;
there are no container, service, import or restart actions. The original E outputs
remain intact. The receipt, INNER and outer digests are respectively
`252598ce1e8a171d157a5a4db515ccae699ba5a2eb3cf8d821b9e9bbd090335e`,
`a151af15abd4b6ffab425490254d3321d9e3251fdd71bba17d3a37c2ed3ca5ce`
and `adabff253012f8cd82d8574278f20ee30c5b763bf599ffe1b79529344833378f`.
This establishes installation integrity only. New owning observations, correctly
mapped operation, connected factories, NFS/terminal acceptance and fresh import ACK
remain under their open tasks. PR #483 has since merged with passing refreshed CI;
PR #485 carries the source corrections through normal CI.
The first H continuation stops at SourceFixture log construction, before any
stage/prepare/invoke phase or owning recovery entry. The private arming preparer
prefixed filenames such as `sourcefixture-stage.stdout`; the unchanged runner
requires `stage.stdout` and the other seven exact names in their own exclusive
private directory. All eight logs remain empty and the SourceFixture state root
is absent. Preserve this generation and its refusal; prepare a distinct successor
and exercise the genuine log validator before another attempt. This is a private
preparation correction, not a relaxation of the runner or new task acceptance.
PR #485 subsequently merges as
`2a5a12a0a9610d92cfe1f3a4ce4b8eb0c5f5b95f` after every required hosted check
passes. Its tree matches the reviewed candidate. The private preparer successor
now exercises the genuine SourceFixture `Logs` constructor: prefixed filenames
refuse, while the exact eight leaves in a separate guarded directory pass on
Python 3.10 and 3.14. The corrected packet is prepared with a new nonce and new
original references; no recovery acceptance follows preparation alone.
The corrected H run passes all SourceFixture phases and verified owned-container
absence, fresh observations, assembly and intent construction. It enters the
installed Parent's `execute_archive` and returns an uncertain hold. Its operation
contains only the initial intent; no child-creation, stop or execution intent is
present. Independent read-only checks match both provider Parent pins, all three
fixture runtime profiles/epochs, target and unrelated full9/SHA, all geometry
full9 and empty retention. Production Mylar/Komga are healthy; the permanent
worker remains Created. This supports a prechild disposition, not acceptance or
reconstruction of the suppressed historical cause; preserve the attempt held.
A separate reproduction using the actual caller loader and Parent method finds
the caller's canonical engine binding conflicts with Parent's absent-name guard.
The private controller successor releases only that exact owned binding and
preserves foreign replacements. Actual six-module loading/sealing and hidden-cause
diagnostic controls pass on Python 3.10 and 3.14. Public H source and all Parent
guards remain unchanged. The reviewed successor uses a distinct packet, nonce,
outputs and fresh observations; it cannot replay the retained attempt or claim
an import ACK from preparation or component checks.
The next distinct H attempt again passes the source phases and reaches the owning
Parent. Its retained cause identifies `Inputs.ref` applying a generic nonempty,
private read before the owning role-aware projection. The original empty cohort
stderr therefore refuses with `ref-attributes`; public source files would fail
that duplicate policy too. The attempt remains held with its initial intent and
private projection directories; no child-create, stop or execute intent is present.
These observations do not grant cleanup, replay, resume or acceptance.
The prospective correction removes only that duplicate read. Parent and Tree
still verify the named origin, original full9 and SHA, role-specific permissions,
copy integrity and final closure. Regression controls exercise those actual methods
with an explicitly unadmitted context fixture; they do not establish configured
Parent or NFS acceptance. A new checked installation and fresh original-bound
execution remain required after source validation and normal delivery.
The integrated correction passes all 1,410 recovery controls in 75 suites through
the owning Python 3.10 copy/closure runner, all 14 outer controls and seven import
copy controls. Independent behavior/security and pin/map reviews find no remaining
source defect. The 258-file reader manifest and both 436-row outer maps close
against the new bytes. Full local CI, Markdown checks and focused Ruff pass.
Normal hosted delivery and a fresh checked installation remain pending. Task
states remain 59 complete and 16 open across features 022–024.
While PR #487 runs normal hosted CI, the distinct I installation and independent
export both succeed. All 27 configured outputs verify against the new source
bindings. The original H outputs remain intact. INNER, origin and outer receipt
hashes are respectively `55a9fb42876fb69704e894008583b9ec4c1418fd54a462edb4ce2014c7ba64f6`,
`16da4091447c8f54962549174d3afb32ab801164a2426dcc240ff5ed50cb106d`
and `86f9f33601ae1697131547c9bbc6251eee75fee2c439d1a116f9d400405a9fab`.
No container lifecycle, library, import or restart action runs. This completes
installation integrity only. Fresh configured execution, NFS/terminal proof and
import ACK remain pending under the existing open tasks.
The corrected read-only H3 query joins provider pins to the generated configured
Parent through the original H INNER and saved entry intent. Both provider pins
match. All three fixture profiles and process epochs match their originals,
target/unrelated full9 and SHA match, G/L/R full9 match and retention is empty.
The operation still contains only its initial intent, with private preparation
directories retained. These are bounded disposition observations, not continuous
NFS custody or acceptance. Preserve H3 held and require a distinct fresh request.
The distinct I run passes SourceFixture staging, preparation, invocation and owned
container absence. The owning Parent now projects the empty stderr, public sources,
cohort receipt, effective review and scope successfully. It then refuses with
`unmapped-child` when `Inputs.outer` sends the original host operation-output path
to the child-to-host mapper. The assembler declares a host path and the Parent
already registers its original/physical/virtual output join. Project that original
host path directly to the child, and test the complete outer projection with real
nonidentity mappings before creating the next checked installation.
I remains held without replay. The operation has its initial intent and four
projected input documents, with no child-creation or stop intent. Its child-control
namespace has 35 entries. Read-only checks confirm the fixture native and reader
still running and its worker still Created. This closes neither NFS nor terminal
acceptance; task states remain unchanged.
PR #487 merges as `c015f05e303fd8c77098bd0d7f1443db9804d488` after every
required hosted check passes. Its tree matches the reviewed head. GitHub, local
main and the intended Gitea mirror match that merge. The I disposition query also
matches original file hashes/full9, geometry, empty retention, generated provider
pins and all three original profiles/process epochs. It remains a prechild hold.
The output-path correction passes all 1,412 controls in 75 suites under Python
3.10, all 14 outer controls, seven import-copy controls and full local CI. The
complete outer-input regression uses real nonidentity `Paths`, the owning Tree
and distinct original, physical and virtual output paths. The predecessor refuses
`unmapped-child`; corrected projection preserves hash joins and protected roots,
and still rejects foreign paths. Independent review of all coordinate/ref paths
finds no further confirmed conversion defect. Source pins and all finite maps
close. New checked installation, hosted delivery and actual execution remain open.
The distinct J installation and independent export verify all 27 configured outputs
without lifecycle actions. INNER, origin and outer receipt hashes are respectively
`4119e71652c75eb270e42d3573482380320a04e4e5bffdce78a398c36d937676`,
`3bef59417b17d4edf60ca3e4ddce3a77b1502e304f1308aedfad30f378bff981`
and `7c7ae97c7525cef94645ea303b336e3fdb20546efd7682d37c87db656767bb40`.
The I disposition query confirms exact original payload/full9, geometry, retention,
provider and runtime-profile/epoch matches. Installation integrity and prechild
disposition grant no execution acceptance. PR #488 runs normal hosted gates;
fresh J observations and owning execution remain pending.
The J continuation and its actual ordinary-user bound graph pass independent
review. The one finite privileged owning run is active; no terminal result or
acceptance is assumed. The source armer records J’s 1,412 host controls separately
from the unchanged 1,302-control/73-suite SourceFixture lineage. All prior consumed
attempts remain retained. The explicit rollback case is mapped to the owning
version-3 archive request’s `terminal=rollback`, using a distinct fresh fixture
generation and its own bootstrap/catalog/readiness/stopped backup; changing a
consumed forward request is prohibited. Task markers remain unchanged pending
original owning proof.
The J owning run exits held without replay at
`nfs-namespace-own-running-child`. It passes the repaired projection and creates
the NFS child; the original failure is during that child’s genuine role-namespace
frame, before reader stop. The operation retains ten journal/input files and its
child-control namespace. Read-only inspection confirms the fixture native and
reader still running and worker Created. The combined profile/running predicate
does not by itself establish that the child exited. Exact child state and retained
profile diagnostics are required; no NFS, terminal or task acceptance follows.
The exact-child observer verifies the J create-intent’s command, image, label and
mounts. The child is now exited with code 2 after the Parent closed its input;
that observation cannot recover the earlier frame-time profile. Its raw inspect
and bounded logs remain private. The retained independent none-network
reproduction confirms exactly five startup differences: endpoint/network/sandbox
identifiers populate, SandboxKey matches `/var/run/docker/netns/` plus the sandbox
prefix, and the default OOM field changes from `false` to `null`. The same original
CID, image and Config match. Its terminal record clears endpoint and sandbox
fields, preserves NetworkID, and retains Config and StartedAt. These observations
support a bounded source correction; they do not retroactively accept J.
The follow-up source batch covers the strict transition helper, Parent/session,
probe/lease, phase/worker and active-parent terminal consumers together. Created
provenance remains immutable, the first validated running profile is retained,
and terminal teardown has its own bounded comparison. Global static projections,
original service epochs and all publication/import grants remain unchanged.
The implementation and complete owning tests are recorded below; configured
execution remains pending.
PR #488 merges as `b64a776c8102ec52f1da3dbcd6470d06312bb578` after all
checks pass and no unresolved review conversations remain. Its tree matches the
reviewed head. GitHub, local main and the intended Gitea mirror match that merge.
The pinned J sources remain unchanged; the lifecycle follow-up is isolated in a
new worktree. Its pure typed transition controls pass on Python 3.10; configured
acceptance remains open.
## Typed isolated-child lifecycle correction — 2026-10-22
The integrated host correction validates only the reproduced none-network startup
and teardown relations. Created profiles remain immutable; the first accepted
running and terminal profiles are sealed separately. Parent/session, phase/worker,
probe/lease and active-parent consumers share guarded typed comparisons. Exact
service profiles, process epochs, Writer restrictions and publication grants are
unchanged. Independent review finds no actionable regression.
The first complete run exposed three optional worker diagnostic writes inside an
already sealed terminal registry. Removing only those writes restores the genuine
nested-pipe composition without weakening its final registry comparison. Persisted
raw worker-profile diagnostics are absent on that path; existing immutable runtime
profiles and protocol checks still apply. Prior failed histories remain unchanged.
The corrected source passes all 1,460 controls across 75 suites through the owning
runner on Python 3.10, with zero skips, and all 14 outer checks. The seven import-copy
checks, focused Ruff, Markdown, `make validate` and `make ci-local` pass. Semantic
pins and both 436-row copy maps close; the 258-file and byte/time budgets are
unchanged. These are source/component results. Hosted delivery, a fresh checked
27-output installation and coherent source cohort, then genuine forward and
separate fresh-fixture rollback execution remain required. No task, live import,
ACK, reader-resume or bulk authority follows from these tests.
### Writer-session CI fixture correction — 2026-10-22
PR #489’s first hosted native-image run fails while compiling the complete owning
Writer callback into its mechanical test factory: the factory lacks the callback’s
three new running-profile closure variables. The production callback already has
those bindings. The fixture starts at an established running row, so it now seeds
that exact static profile, lifecycle epoch and StartedAt value. All 15 existing
Writer assertions and nine dependent negative-session assertions pass on Python
3.10; production checks and startup-transition tests are unchanged. Both declared
copy maps are refreshed. The complete `run_publication_reader_controls.py` family passes on Python 3.10,
including its outer checks and separate 1,460-control pass with zero skips;
local CI passes. Hosted verification remains required. This correction supplies
no operational acceptance.
## Lifecycle delivery and fresh fixture generation — 2026-10-22
PR [#489](https://github.com/bolens/homelab/pull/489) merges as
`7130a7fd510d5104bdddac384163f41f538ab425`. The reviewed head and squash merge have
the same tree. All hosted checks, final main validation and native-image
publication pass. GitHub and the intended Gitea mirror agree. The correction
retains immutable Created provenance and exact running/terminal comparisons.
A distinct checked K installation and independent export verify all 27 original
outputs. The original native/worker image and SDK evidence remains bound to its
unchanged inputs. The actual selected-native-image SourceFixture completes all
1,460 controls across 75 suites with no skips, closes its source references and
verifies its own helper is absent. A genuine Producer/Parent attempt then refuses
NFS child creation before reader stop: an earlier retained helper already owns
the name derived from that immutable Bootstrap nonce. The original attempt and
helper remain preserved. This is no terminal, replay or reader-resume grant.
A fresh Creator batch passes its actual privilege-isolation check, binds fresh
inputs after authentication and completes the owning Bootstrap, native catalog
processing, reader scan/progress and queue observations. Its local/NFS parents,
three roles, catalog and genesis are distinct originals. The next forward packet
joins those originals through the owning fixture-document checker and passes all
47 preparation controls, including the actual 692-file bundle check. Its new
effective-parent/readiness pair still requires causal SourceCohort execution
before fresh observations and genuine Parent entry. Forward and separate rollback
acceptance remain open. No task checkbox or production/bulk authority changes.
The next L packet completes its own actual 1,460-control/75-suite SourceFixture,
source closure and owned-helper absence, followed by fresh role and effective
observer capture. Active-input assembly then refuses before Producer/Parent entry:
preparation created the private probe directory, while the owning contract
requires absence so Parent alone can create it. No reader stop or archive
operation occurs. The consumed packet remains unchanged. The correction leaves a
new proposed path absent and tests the actual owning precreation predicate on the
real rejected and proposed NFS paths. These filesystem checks run in a separate
child so their imports cannot disturb the verified-loader control family.
The corrected M packet passes 49 preparation controls, including the actual
precreation predicate against the rejected existing path and proposed absent
path. Its own selected-image SourceFixture again completes all 1,460 controls
across 75 suites, closes original sources and verifies owned-helper absence.
Fresh role and effective observations pass, active-input assembly succeeds and
the genuine Producer enters the owning Parent.
M then holds during NFS namespace bootstrap, before reader stop. The original
create and first-started profiles identify its exact newly created helper. A
bounded read-only check finds that helper exited with code 2 and no OOM event.
Its log contains the first namespace request only. The Parent's protected trace
finds the helper's original host process absent before writing the reply. The
packet's 120-second budget and roughly 47-second container lifetime do not
establish a timeout. The underlying child failure remains undiagnosed because
the child entry point suppresses its exception. Native and reader roles retain
their original running epochs, and the permanent worker remains Created.
The consumed M request, helper and original records remain preserved. There is
no accepted NFS-ready, forward terminal, reader stop, resume or archive operation.
Separate rollback execution has not begun. Another SourceCohort nonce cannot
release M's Bootstrap-derived helper name. Further work must first establish the
child/transport failure, then use a distinct reviewed generation for any new
execution. No task checkbox changes.
The prospective child diagnostic preserves refusal exit code 2 and emits only
coarse exception categories, fixed transport reasons and at most eight approved
source callsites. Unknown source basenames become `external`; exception text,
locals and host paths are excluded. Four new controls cover frame bounds,
redaction, the actual generated-name CLI entry and closed stderr. The new
controls fail against the previous source. All twelve child transport controls pass
on Python 3.10. This correction does not identify M's lost historical exception
or grant a new execution. The original installation and operational source
worktree remain frozen; changed host bytes require a distinct checked generation.
A separate real named-FIFO reproduction exposes a transport defect: the child
captures full9 metadata for its inherited FIFOs and refuses after its own write
changes mtime/ctime. The original anonymous-pipe fixtures do not expose that
behavior. The correction retains device, inode, complete mode and ownership,
matching the owning host pump's FIFO identity contract. A real two-way named-FIFO
exchange now passes, while a real permission change and descriptor replacement
still refuse. Regular control-file identities and hashes are unchanged. This
reproduction establishes the source defect, but M's suppressed historical
exception cannot prove that it caused M's exit. The six new controls increase
the exact owning collection to 1,466 across the same 75 suites. No operational
acceptance follows from this prospective correction.
## Superseded current-queue notes through EE/EF — 2026-10-28
PR #537 delivered the NFS descriptor correction with matching publication,
180-module capture, SDK103 and startup-source proof. The four installed-image
discovery/import/lost-reply/rename cases pass. PR #540 delivered the equal-directory
fact comparison correction. PR #541 separates the input/output budgets. EE/EF
passes that boundary and reconstructs the genesis archive, then holds on an
external terminal-record path. Correct its mapping and route NFS reads through
the existing UID1000 owner reader before refreshing host controls and using a
new fixture. Target genesis bytes, unrelated full9/hash and all 24 native tables
remain preserved; the stopped reader remains held. SDK103 remains the required selection. Reuse unchanged proofs
only for their exact image/source inputs. Changed host controls require fresh checked installation outputs;
unchanged installations may serve distinct fixtures. Source delivery alone
cannot establish accepted runtime terminals. The current shared work finishes
the stopped-reader handoff and owning terminal path. Ordinary native
preservation, T030 cache guard, T031 identity recovery and T032 control-state
adoption retain their recorded acceptance.