specs/024-verified-archive-repair/evidence-history.md

Rama main · réplica de lectura del repositorio original.

# Evidence history: Verified archive repair

Historical implementation and verification records retained from `tasks.md`.
The [task list](tasks.md) owns current status, remaining work and delivery requirements.
Earlier CI waivers are historical and have been revoked. No historical source test
or private experiment substitutes for current runtime or live acceptance.

## Evidence

- Preliminary evidence (2026-10-08): private package controls and selected-runtime tests pass, and an isolated private repaired copy preserves all 30 members, 28 ordered pages, root metadata and compressed content from the scoped original. The original full signature/hash is unchanged and the test container is retained stopped. No production source installation, owning adoption or live import is inferred. Source-only diagnostic integration is under independent review.

- Design review (2026-10-08): independent review accepted the prospective spec, plan, research, model, contract and ordered tasks. All 11 affected Markdown files pass lint and the working diff passes whitespace validation. This completes the design review. Owning repair preparation/adoption and live acceptance remain open.

- US1 source progress (2026-10-08): native and worker diagnostics are integrated with exact generated module/test parity, installed-function capability checks and fixed retained-history/report messages. Each new host set passes 21 preservation, 26 stable-source and 9 owning-path controls. Staged local CI passes, including repository validation and secret scanning. The matching worker image passes all 500 controls without skips. The native baseline image passes 1,317 controls across 80 suites without skips. Its final supplement correction passes all 32 maintenance and 10 pack-binding controls in an isolated non-root image layer built from that exact baseline. Supplement authority ignores read access time while binding SQLite reads to the original open descriptor and preserving full file/parent identity and mutation checks. Independent review clears the integrated diagnostic-only source. This completes T002–T007. No live image rollout or repair adoption ran.

- Owned preparation review hold (2026-10-08): the source-only prototype passes 40 host controls, but independent review reproduces a transient directory replacement that can return a foreign read descriptor while the original pathname and parent identities are restored. That prototype is not integrated or installed. The correction must bind every hash, byte read, copy and readback to its expected open descriptor and enforce xattr bounds before bulk reads. T008–T010 remain open.

- Owned preparation correction (2026-10-08): the corrected source-only prototype pins directory/file descriptors for reads and private copies, enforces xattr bounds before reads and passes 47 host controls without skips. Independent review reproduces the original alias race and verifies the corrected original custody. Authenticated preparation/status routing is a separate source-only proposal. Neither proposal is integrated or installed, so T008–T010 remain open.

- US2 source integration (2026-10-08): the independently reviewed preparation/status source is installed with exact current Controller/Writer and catalog-derived source, bound descriptor reads/private creation, exclusive custody and passive status. Owning routes and negative-retirement purpose guards have 102 native and 60 worker host controls. Actual installed-SDK/image verification remains pending, so T008–T010 remain unchecked and no adoption or live acceptance is claimed.

- Final-boundary correction (2026-10-08): independent review reproduces a late inactive catalog alias after ordinary-purpose checks. The corrected source moves all semantic callbacks before the complete direct claim/absence closure. Both regressions now retain review, and the 100-control source gate passes. The corrected native runtime and full worker image gates remain pending.

- Corrected source gate (2026-10-08): independent review repeats both late catalog-alias and late negative-marker faults and verifies terminal refusal after the complete final direct closure. All 102 native host controls pass without skips, staged local CI passes, and the full worker image passes 504 controls without skips. The corrected native installed-image build is waiting for OS authentication. T008–T010 remain open until that gate passes. No live repair or writer release ran.

- US2 installed-image acceptance (2026-10-08): the corrected native image passes 298 selected controls across nine suites without skips, including all 102 preparation/routes/purpose controls and the genuine installed Controller/Writer factory check. The final worker image passes all 504 controls without skips; its read-only non-root smoke verifies 28 runtime module hashes, zero effective capabilities and diagnostic-only repair classification. Exact native and worker image identities are retained privately. This completes T008–T010 for preparation/status only. Adoption, aggregate reader/native recovery, live rollout and current-library acceptance remain unfinished. All 161 controls across the five suites changed by current main also pass without skips in the exact candidate image. Local merged CI and final documentation hooks pass.

- Repair admission progress (2026-10-08): archive preparation/status now refuses either negative-retirement hold through its final direct checks. The shared native and worker Writer guards cover the terminal successor, closing the interruption window before ordinary processing can resume. All 130 affected host controls pass without skips. Dedicated repair adoption, exact reader preservation, durable dispatch and rollback remain under implementation in T011–T013. These checks do not establish installed-image or live adoption acceptance.

- Recovery implementation progress (2026-10-09): the source adds both archive-repair pending/terminal markers to native and worker Writer admission and the final direct preparation/status checks. All 108 affected host controls pass without skips, including malformed markers, recovery-flag refusal and markers introduced by the last callback. Independent review repeats both marker names after each last callback and confirms refusal. The selected Mylar Python 3.10 runtime passes all 99 native controls without skips in an isolated container using public source and disposable fixtures; this is runtime compatibility proof, not installation or live recovery acceptance. The live Mylar source check confirms its explicit DATA directory before configured-root binding; no service or library state changed. Reader admission, WAL commit/rollback and parent/provider integration remain under review. No live recovery, DDL import or broad library acceptance is inferred.

- US3 integration progress (2026-10-09): native reader, same-payload adoption, dispatch and independent verifier sources are integrated with their portable 62-control suite; the separate worker transport has 30 controls. The corrected reader lease refuses callback attempts to replace its admitted mode/inode baselines, confirmed by independent original-fault repros. An integration review found request/status API dispatch before Writer construction; both routes now use the existing Writer under ordinary admission, with 39 owning API controls passing. The worker records intent and attempt before HTTP outside Writer, then uses passive status after uncertain responses. Queue acknowledgement remains queued-review with false mutation/publication grants. Installed lifecycle/configured-scope dependencies, owning child execution, durable terminal history/reconstruction and full reader/native acceptance remain pending. T011–T018 stay open; these tests grant no import, cleanup or live repair authority.

- Integration follow-up (2026-10-09): the installed source list now includes the checked reader lifecycle and configured-native-scope modules. Their portable fixture suites pass 45 and 28 host controls without skips; source-pin substitutions in the latter are explicit authored fixtures, not actual installed factory acceptance. Review also found periodic repair dispatch starving jobs beyond its first 32 and aborting unrelated maintenance after HTTP failure. Round-robin selection and transport-only exception containment fix both; the 30-control worker suite covers 33 jobs across two cycles and lost-response retention while another job proceeds. Owning imports, installation parity, genuine parent/provider execution and live acceptance remain pending. Task ordering and existing completion requirements are unchanged.

- Integration runtime check (2026-10-09): all 204 selected controls pass without skips on the actual Mylar Python runtime: 62 archive adoption, 39 owning API, 45 lifecycle, 28 configured-scope and 30 worker transport checks. This isolated run mounts frozen public source only and uses disposable fixtures; it does not prove candidate-image installation or live recovery. Repository validation, Ruff and full local CI pass. Independent review verifies queue request/status with the real fixture Controller/Writer, all 33 jobs reached across two dispatch cycles, and timeout retention without blocking another job. Original task completion gates remain in force.

- Recovery follow-up (2026-10-09): independent source review finds four additional lifetime/mapping defects: a parent callback can substitute a native proof, configured scope can refresh mutable seals, a reader destination overmount can shadow the native source, and the inherited pipe can be redirected by refreshing descriptor facts. The corrective source anchors original seals and pipe identities, snapshots proof before callbacks and checks reader destination-to-host projection. All 52 lifecycle and 31 configured-scope host controls pass; the original four reproductions now refuse. The pinned upstream argparse source also accepts abbreviated configuration/datadir switches; finite exact launch-option parsing refuses those aliases. Corrected-image and delivery gates are still pending.

- Worker and rollback progress (2026-10-09): the frozen PR #272 worker candidate passes all 540 actual image controls without skips. Its final non-root smoke verifies all 29 production module bytes against frozen source and zero effective capabilities. A separate source-only typed rollback provider passes 29 host controls, including actual SQLite five-row reversal and five-source filesystem restoration; lost COMMIT/response, closed WAL connections and uncertain phases retain custody. It is not installed. The native baseline image now passes 1,585 controls across 90 suites without skips. A corrected image layer passes 84 selected controls (52 lifecycle, 31 configured-scope and one installed archive-factory check); its final image copies only the two corrected production helpers. A read-only final-image check confirms exact source bytes, absence of test files, UID 1000 and zero effective capabilities. Full local CI passes, including history secret scanning. These checks do not establish genuine stopped-reader parent execution or live recovery acceptance. Continuous parent, durable independent terminal observation, actual NFS, library/DDL recovery and release remain unfinished. No live service or library state changed.

- Recovery delivery and portable-test progress (2026-10-09): PR #273 is merged at `7677bae8`; primary local main, GitHub and the authorized mirror match. A separate canonical recovery-cohort proposal now has 682 host controls across 22 suites, with zero skips; root repeats the complete run from a relocated copy. Tests bind the exact successor source bytes and keep predecessor fixtures outside the production installer. These are source controls, not installed factories or live recovery acceptance. Parent handoff, independent terminal observation, actual NFS behavior and final library/DDL acceptance remain open.

- Canonical recovery integration (2026-10-09): the tracked adapter installs 21 new helpers and checks three existing helpers, with exact pins for all 24. The private-copy build runner corrects checkout file-mode and root-build fixture ownership without changing production bytes; root repeats all 682 host controls and the actual native layer passes the same 682 controls plus fresh installed origins/hashes/SDK identities. The final-image check verifies all 24 production source bytes, excludes tests/fixtures, and confirms UID 1000 with no effective capabilities. The provider/preimage/terminal-observer suite passes all 59 controls twice in actual Mylar Python 3.10.12, including a moved-tree repeat; its native/lifecycle boundaries remain explicit fixtures. Full staged local CI passes. Ruff finds and fixes one redundant test import; the affected 47 host controls and full changed-source Ruff check pass afterward. Source review identifies historical backup/row producer pins that must be updated coherently with fresh nine-role proof production before owning admission; parent pin remains absent. No live recovery or release is claimed.

- Reader recovery prerequisite checkpoint (2026-10-09): canonical cohort source delivery is merged in PR #274, and local/GitHub/mirror source state matches. The corrected backup/rows/admission proposal passes 75 source controls twice in the selected Mylar Python 3.10 runtime, without skips. Actual running-child handshake, installed owning composition, fresh stopped-reader backup/restore and NFS acceptance remain prerequisites of T012/T015; no archive adoption, reader restart or library recovery is inferred from these controls.

- Recovery integration prerequisite (2026-10-09): the next source batch connects the canonical birth helper/lifecycle with the current backup producer/provider/terminal observer. Installer predecessor callback drift now refuses replacement; isolated fixture copies resolve the public Git-mode test failure without relaxing production source permissions. The host integration passes 721 cohort controls, 137 recovery executions and eight runner controls, zero skips. The corrected image and local CI pass; actual installed factory handoff exposes a missing bundled dependency path in the standalone provider. Owning loader correction, repeat handoff proof and archive adoption/current-library acceptance remain pending.

- Installed handoff follow-up (2026-10-09): actual canonical SDK loading exposes the missing fixed bundled-library bootstrap and then the pinned upstream image’s group-writable config/main sources. The provider now uses the fixed bundled path, and the candidate build closes config/main modes to 0644/0755 while preserving their exact bytes; fresh image verification checks those source boundaries. All 721 cohort controls, 143 recovery executions and eight runner controls pass in the selected runtime after the bootstrap correction. Independent SDK review then reproduces an original ancestor being refreshed between source reads; the corrected loader retains first map/source ancestors and refuses conflicting later merges. All 33 provider controls pass, and independent review repeats the original refusal. Native observer V2 passes 34 host controls and peer review of the corrected launch/process closure, but actual protected parent/daemon and full live acceptance remain unfinished. No live service, library or database mutation ran.

- Final connected-image verification (2026-10-09): the corrected final image passes 721 cohort, 146 recovery and eight runner controls with zero skips in Mylar Python 3.10.12. Fresh verification checks all 25 installed production module bytes, exact canonical SDK/type sharing, config/main pinned bytes and safe modes, UID 1000 and zero effective capabilities. Genuine installed birth/lifecycle/configured-scope factories share the same original pipe through eight challenge frames; parent observations remain explicitly synthetic and every live/publication grant stays false. The owning SDK ancestor regression and independent review pass. Full staged local CI passes. Protected parent invocation, current backup/restore, NFS and complete live library/DDL/repair/bulk naming acceptance remain unfinished; no live mutation or hold release is claimed.

- Delivery and next combined recovery batch (2026-10-09): PR #275 is merged at `32344cfd`; primary and integration checkouts, GitHub and the authorized mirror match. Required hosted checks are restored after the user-authorized CI waiver; local CI and commit hooks pass. The next coordinated batch combines portable parent, corrected native observer, phase-custody and factual terminal reconstruction. Peer review reproduces a late reader-pair signature refresh in the phase proposal while original input/custody bytes remain unchanged; that proposal is held pending immutable original-vector correction. Actual protected parent/daemon/NFS/terminal and full live recovery acceptance remain open. No lifecycle, library, reader database, DDL or bulk naming change ran.

- Combined parent and terminal successor checkpoint (2026-10-09): integrated the immutable original-vector phase correction, unique physical worker-bind mapping and finite critical runtime comparison. Independent terminal review repeats the prior late-helper failure and now observes refusal before ACK; the complete final observational closure follows all helpers. The combined host runner passes 277 checks with zero skips. Native/worker destination differences no longer cause a false hold; ambiguous mappings and critical process/state/mount changes still refuse. Genuine installed terminal factory, protected parent, terminal producer/scheduling, NFS and full live acceptance remain open. No live service, library, reader database or DDL mutation ran.

- Combined candidate-image proof (2026-10-09): the unchanged accepted image passes all 721 cohort checks, 277 composed recovery checks and eight runner controls with zero skips in Python 3.10.12. Fresh parity confirms all 25 installed modules; genuine installed birth/lifecycle/configured-scope factories share the original pipe, with UID 1000 and no effective capabilities. Parent observations are explicitly synthetic. The new factual terminal factory and protected/NFS/live execution remain separate unfinished gates; no live hold is released.

- Terminal factory and NFS helper checkpoint (2026-10-09): the genuine terminal provider CLI passes in the accepted image through the original pipes and canonical installed SDK/Writer types. Both fresh disposable scenarios pass: forward factual observation with every right false, and late real current-database mode change refused without ACK. Each exercises 17 challenge frames. Parent and durable declarations are explicitly synthetic; owning mutation provenance, protected process and NFS/live acceptance are unverified. The corrected NFS helper passes 31 isolated selected-image controls and independent review; these use local fixtures, not the live export. A fresh native daemon probe refuses at primary API configuration validation; the cause is under investigation without changing configuration. Terminal composer/scheduling and protected acceptance remain open.

- Native saved-configuration correction (2026-10-09): actual Mylar saves API/HTTPS booleans as `True`/`False`; the read-only probe previously required numeric spellings and refused the enabled primary API. A regression reproduces that refusal. The corrected probe accepts only finite boolean spellings, still refuses disabled API, enabled HTTPS and unknown values before transport, and preserves all original process/config/source closures. Native 39, full recovery 282 and runner eight host controls pass with zero skips; independent review repeats mixed-case and unknown-value checks. The exact corrected buffer now passes against the actual existing daemon, with fresh process/config/source binding, held startup state and census revision 13. This read-only evidence changes no live setting or data and grants no recovery authority.

- Combined corrected-helper image proof (2026-10-09): a single fresh isolated candidate-image run passes recovery 282, runner eight, both genuine terminal CLI scenarios and NFS-helper 31 local-fixture controls with zero skips. The NFS V3 source pin/copy delta independently verifies exact corrected native-probe bytes and unchanged V2 ancestor, lifecycle, kernel and test fixes. Actual live NFS support remains unproved. Scheduler V1 review reproduces a late resume-intent metadata change accepted before restart; immutable V2 now refuses it without restart and passes 84 source controls, but composed mapped observer/producer and protected runtime acceptance remain pending. No live lifecycle or media/database mutation ran.

- Connected repair implementation checkpoint (2026-10-09): PR #277 is merged and source copies are synchronized; the combined selected-image gate passes 282 recovery, eight runner, two genuine terminal scenarios and 31 local NFS controls without skips. Source review confirms existing typed preparation, reader lease and same-path adoption primitives; the integrated source now adds the missing typed reversed terminal-clear consumer and independent rollback verifier, including coherent installation and code-availability reporting. Root repeats 62 success and 26 rollback controls without skips and verifies all frozen preimages and source hashes. Type-sensitive receipt joins reject Boolean/numeric aliases and foreign operation/hash evidence. Actual selected-runtime and installed-origin checks remain pending. Dedicated repair provider/action, existing-preparation reconstruction, current reader acceptance and durable import/history consumption remain separate prerequisites. T011–T013 remain open, with no live adoption or hold release.

- Terminal provenance integration checkpoint (2026-10-09): the independently reviewed correction is integrated with the original execute ACK/report and canonical terminal reference export, finite forward/rollback observation, fresh current reader-pair custody and retained private output/phase-directory identities. Root repeats 334 recovery and eight runner controls with zero skips; both prior literal failures now refuse acknowledgement. Parent admission remains disabled. Independent archive rollback review identifies an initial durable-write lost-acknowledgement path returning the wrong error phase. The integrated correction now enters Held/uncertain while retaining both markers; root repeats both literal failures, 28 rollback, 62 adoption and 13 installation-source controls without skips. The final corrected candidate image and genuine owning runtime remain pending; the first isolated build is diagnostic evidence only. No live service, library, reader database or DDL mutation ran.

- Final selected-image verification (2026-10-09): the corrected isolated image passes one combined run of 433 unittest controls, both genuine canonical terminal CLI scenarios and 64 local-fixture NFS-helper controls, with zero skips, Python 3.10.12, UID 1000 and no effective capabilities. The private launcher now includes the required adjacent terminal helper and retains CLI errors; no production dependency or fixture type was replaced. Fresh installed-origin and source-map checks pass. Parent/execute declarations remain explicitly synthetic in the CLI harness, and NFS controls use local fixtures. Actual owning terminal provenance, approved live NFS, connected parent admission, reader indexing and library/DDL acceptance remain open. No live service or application data changed.

- Connected recovery review (2026-10-09): The next connected batch adds an existing-preparation factory, success/rollback factual vectors and a dedicated archive-only provider. Independent review reproduces two late changes: a different comic examined by owner policy can change without being carried into the verifier full-file closure, and a final file-type helper can change preparation metadata after its closure. Both proposals remain unintegrated pending corrected immutable successors and repeated literal regressions. T011–T013 and live acceptance remain open.

- Corrected recovery checkpoint (2026-10-09): independent review clears the existing-preparation successor after its final claim loop stops invoking a replaceable file-type helper. Root repeats 228 preparation/adoption/rollback controls and integrates the coherent owning installer and source closure. The NFS bridge fixture successor passes all 163 controls in the selected Python 3.10.12 image, UID 1000, with its source bundle read-only and original hashes/full signatures unchanged; this is local-fixture runtime proof only. The corrected full-policy verifier and dedicated archive provider remain under independent review. Actual protected NFS, parent admission, reader indexing, repair/import and current-library acceptance remain open.

- Full-policy verifier correction (2026-10-09): independent review clears the corrected success and rollback vector verifier after both original late same-inode other-comic mutations now hold. Every policy-observed source retains its original full signature/hash and ancestors through final verification. Root repeats 102 controls without skips and integrates the matching source pin and owning image test. The dedicated provider remains held on its missing original preparation-file/directory join; corrected provider review, installed image, parent composition and live acceptance remain pending.

- Connected archive image/provider checkpoint (2026-10-09): the corrected native candidate passes 241 selected controls with zero skips, fresh installed-source/type checks and the unchanged disabled parent admission. Independent review clears the dedicated archive provider after original preparation metadata and completed-directory identities are carried through verification and final acknowledgement. Root integrates that provider, its corrected verifier fixtures and explicit source closure; all 374 recovery controls pass without skips and preserve original public sources. A test-only bundled-dependency name now avoids collisions with host-installed libraries. Native/reader lifecycle composition and original directory-custody transfer, real NFS and protected/library/DDL acceptance remain unverified.

- Parent composition review (2026-10-09): portable NFS review catches a covering nested configuration mount that can select the wrong Writer root; the unintegrated successor remains held pending full original-mount projection. Neutral backup producer review also reproduces an early restore-file attribute roundtrip accepted after original signatures were refreshed. Both proposals require corrected immutable successors before integration. Repository validation, eight recovery-runner controls and production Python 3.10 syntax/lint pass on the currently integrated batch. No live hold release or data change ran.

- Portable NFS integration (2026-10-09): root verifies frozen source hashes and preimages, independently reviews the complete original-mount projection correction and integrates the portable active/stopped bridge with explicit source closure. Config-file and Writer shadow mounts and ambiguous mappings refuse. The combined private-copy runner now expects 460 controls; actual NFS, archive-only parent composition and live acceptance remain pending. No service restart or data change ran.

- Combined recovery verification (2026-10-09): all 460 integrated recovery and eight runner controls pass in Python 3.10.12 using the exact corrected candidate, with zero skips, preserved original public source and no live mounts. The independently reviewed neutral archive backup producer successor now retains every original source/backup/restore file tuple before callbacks and binds its exclusive output directory before the first write. Root repeats its 22 controls and integrates it; all 482 combined host controls pass without skips. Parent custody/scheduling, actual NFS and live library/DDL acceptance remain open.

- Final combined source checkpoint (2026-10-09): the exact corrected candidate passes all 482 recovery and eight runner controls with zero skips in Python 3.10.12, using only frozen public source and private disposable fixtures. Full staged local CI and history secret scanning pass; no secrets or skipped files are found in the publication-boundary scan. Public contract commands now name the actual combined runner. Actual installed archive parent, protected NFS, reader indexing and complete live acceptance remain unfinished. No live hold is released.

- Typed archive custody integration (2026-10-09): PR #279 is merged and local/GitHub/mirror main match. Independent review clears the same-custody binding, original metadata/directory transfer, provider insertion and distinct archive-only NFS readiness. Root integrates the four sources, coherent lifecycle/admission/factory pins and exact known-predecessor installer correction. Fourteen binding and 493 combined host controls pass without skips. A fresh candidate build and genuine installed-pipe harness are pending; connected parent scheduling, real NFS and live recovery remain open.

- Installed lifecycle batch (2026-10-09): the fresh candidate image passes 377 selected build controls without skips and fresh installed module/origin/type parity. Independent integration review passes 493 recovery, 18 installer and 14 binding controls without skips; all 157 recovery source pins and the canonical cohort match. The genuine installed binding harness remains pending after test-input corrections; synthetic parent declarations grant no live authority. The ordinary import audit reproduces single/pack completion diagnostics from preexisting files without a delivery acknowledgement and identifies issue-ID-only handoff retirement. Durable owning import acknowledgement and its queue/workflow consumers remain required; NZB handoff exclusion from download retry already passes. Task order and completion gates are unchanged. No live service, library, reader database or DDL mutation ran.

- Installed binding verification (2026-10-09): the corrected genuine selected-image harness passes all three scenarios at UID 1000 with no live mounts. Canonical installed birth, custody, scope, Controller/Writer and preparation factories retain the same original pipe through 24 frames. Late metadata and completed-stage changes both Hold and invalidate custody. The SDK map uses 91 canonical filenames and fresh actual installed hashes; workflow fixtures are created by the installed owning Store. The same candidate passes all 726 cohort controls, 493 recovery controls and eight runner controls without skips in Mylar Python 3.10.12. Full staged local CI passes, including repository validation and history/staged secret checks. Parent/runtime/backup observations remain synthetic; connected parent, actual NFS, import acknowledgement and live acceptance are still required. No live hold release or data mutation ran.

- Parent composition review (2026-10-09): the unintegrated proposal passes 149 isolated controls in place, relocated and in the actual selected Mylar Python runtime without skips. Independent literal checks nevertheless reproduce late request-ancestor capture and read-only interpreter/runtime overlays. The proposal is Held and its immutable correction is under implementation; no parent pin, lifecycle action or completion checkbox is enabled by those tests. The full parent SDK closure also needs fresh protected-daemon guard source pins beyond the smaller binding-harness closure.

- Parent correction checkpoint (2026-10-09): independent review clears the immutable correction after all original ancestor and interpreter/tool/loader overlay probes Hold. All 154 controls pass in place, relocated and in the actual selected Mylar Python runtime without skips. Integration still requires coherent active backup-helper, rows, producer, adapter and admission source pins; existing negative-five compatibility must remain intact. Operational parent, NFS, backup, import and live acceptance stay open.

- Coherent parent integration (2026-10-09): root integrates the independently cleared archive parent correction and the frozen active backup-helper dependency successor. The explicit recovery closure has 167 files and 539 distinct controls; all 729 cohort and 539 recovery controls pass with zero skips, and repository validation passes. Independent dependency review clears the exact source graph. All 539 recovery and eight runner controls also pass in the selected Mylar Python 3.10.12 image, without skips; frozen source hashes remain unchanged. The first isolated runner check caught its historical 493-count expectation; the corrected count-only test passes in a new immutable runtime bundle. Historical accepted admission bytes remain unchanged, with the exact current predecessor added to the installer. Parent pins remain disabled; installed-image, protected backup/NFS, import and live acceptance remain open. No live data or lifecycle change ran.

- Ordinary import review (2026-10-09): independent review holds the unintegrated acknowledgement batch after reproducing acceptance of an identical replacement destination inode and late history/catalog-companion changes. Its 207 passing host checks and 58 reported runtime/tool skips do not accept these gaps. A new immutable correction must retain actual exclusive-copy file-descriptor identity and original passive history/companion vectors through final closure. Archive terminal history remains separately required; no import or live acceptance is claimed.

- Reviewed recovery image checkpoint (2026-10-09): the 326-input frozen public candidate passes 380 selected build controls without skips. Fresh final-image verification at UID 1000 confirms canonical installed origins, exact cohort hashes and shared SDK types; admission remains disabled. Actual image identity is `sha256:6eeda350d4515e7c6b857e5e1d61489d421358791ab57f1844f3748e24d73be2`. Full staged local CI passes; the subsequent public-contract command correction passes focused hooks, with unrelated no-file hook skips reported separately. Protected parent, NFS, import and live acceptance remain open.

- Import acknowledgement correction (2026-10-09): independent review clears the immutable successor after the original destination-inode, history and catalog-companion regressions refuse. Root verifies all 163 source/preimage/evidence pins and integrates the 22-path batch, with the current SDK source closure updated coherently. The proposal passes 212 host controls and reports 58 native/tool skips; actual installed importer execution and combined native/worker image verification remain required. Archive terminal history and live recovery are still open.

- Pack sidecar preservation (2026-10-09): root integrates the independently cleared phase correction. Sidecars count toward completion and enter cleanup only after verified preservation; a review sidecar cannot complete a pack or lose its source. Both predecessor failures reproduce in disposable fixtures, and corrupted retention bytes Hold without deletion. The combined proposal passes 214 host controls with 58 explicit native/tool skips; actual image and importer gates remain required.

- Terminal-history implementation checkpoint (2026-10-09): isolated work exercises genuine owning preparation/capabilities and fresh forward/rollback vector verification in seven local controls, with host SDK/lifecycle fixtures explicitly identified. Passive consumers, installer integration, journal preflight and installed/runtime acceptance remain unfinished; archive observations grant no ordinary import or publication authority.

- Parallel immutable review checkpoint (2026-10-09): The immutable terminal-history proposal covers 13 paths and passes 236 controls in both original and relocated locations, with one explicit installed-image skip. Independent review is running. Its native/worker facts retain false publication/import/index/replay rights; intended installed production and the cross-container namespace seam remain unresolved acceptance gates. No live lifecycle or media change ran.

- Reproduced review corrections (2026-10-09): Independent review holds the terminal-history proposal after an early owning SDK callback changes an original prepared record and the append adopts that change, plus a late queue observer introduces a native database WAL companion without refusing the queued fact. The author is correcting both original-history capture order and final raw queue closure in a separate immutable successor. Root repeats all 17 owning history controls successfully, which does not override these failures. Live services and library remain unchanged.

- Combined source verification checkpoint (2026-10-09): Root integrates the independently cleared continuity V2 and repeats all three original inode/mode faults; each refuses, with original completion rows unchanged. Both frozen and integrated 74-control runs pass without skips. The independently cleared archive-history V2 carries original history before callbacks and closes every queue branch after its final observer; both original review faults refuse. Root integrates the source and installer successors with 68 SDK entries and 168 explicit recovery files. All 539 recovery controls pass without skips, and 25 archive history/installer host controls pass with one explicit installed-image skip. The affected batch also passes 20 rename, 32 maintenance, seven supplement, 35 combined-publication, 12 queue and 21 reader-proof installer controls. Legacy pack/tagging fixture module closure is being corrected; the NZB check rerun with the valid host context passes six controls and reports two installed-source skips. Current full-image, original namespace, protected backup, historical completed-download recovery and live acceptance remain open. No service, media, queue or database mutation ran.

- Combined candidate checkpoint (2026-10-09): Independent dependency review clears all 68 current SDK, 25 prospective module and 168 recovery source pins, with activation pins still unset. Root integrates the narrowly scoped two-fixture correction after verifying 291 frozen pins and exact preimages. Original and relocated full fixture runs each pass 134 controls with three existing image-only skips; root independently repeats all 22 pack and 13 backend controls with no skips. Corrected repository validation passes. A new 501-input native candidate and matching 56-input worker candidate are building in isolation; neither is accepted or deployed. A separately labelled diagnostic image will exercise the four independently reviewed genuine importer cases while the complete image gate runs. Annual/coordinated-pack execution and reviewed retained-delivery recovery are being developed in parallel. No live lifecycle, library, database or DDL mutation ran.

- Installed runtime checkpoint (2026-10-09): The new matching worker image passes all 567 controls without skips; final read-only UID1000 parity verifies all 30 production sources, including the archive factual-history consumer. In the separately labelled diagnostic native image, genuine ordinary import success, real lost postcommit response and actual import-to-owned-rename-to-preserved-metadata continuity pass against a fresh 97-file actual SDK map. The original acknowledgement and preservation pair remain unchanged. Complete discovery still fails a terminal-outcome assertion after its acquisition fixture was corrected; retain that failure and diagnose the actual queue result rather than relax the assertion. The installed literal nzblog schema is independently observed. The full native image gate continues; annual/coordinated-pack harness and retained historical-delivery acceptance are parallel private proposals. No live deployment or completion acceptance is claimed.

- Container-filesystem verification gap (2026-10-09): The complete native candidate gate fails the existing terminal-observation producer controls at `terminal-output-created-census`, after the owning source suites pass. A separate disposable overlay-filesystem probe reproduces stale results from reusing an enumerated directory FD after creating a file; rewinding the same original FD returns the correct census. The source correction must retain all original directory/file/ancestor and final raw closure checks, coherently update active dependency pins and pass the existing controls in the actual filesystem. The failed full candidate is not accepted or deployed. Discovery terminal diagnostics and annual/coordinated importer checks remain separate genuine-runtime work; no assertion or acceptance requirement is waived.

- Verified filesystem correction (2026-10-09): Root integrates the independently cleared same-directory-FD rewind with its coherent six-path active dependency successor. The existing 19 terminal-producer controls now pass without skips in the actual selected Python 3.10 overlay filesystem, retaining original source vectors. The original failed complete image and literal stale-directory probe remain retained evidence. A new 501-input complete native candidate is building with the correction. Genuine installed annual processing also passes with exact release identity; completed-discovery and coordinated-pack harness corrections remain under review. Independent review holds the disabled retained-delivery V2 proposal after its outer passive status fails to carry the target’s original vectors past the final helper; a new correction is required. That proposal is not installed or activated. Live services and data remain unchanged.

- Retained-delivery review checkpoint (2026-10-09): The disabled V4 proposal passes 40 source controls both in place and after relocation. It rejects all four retained original fault probes: changed private-parent mode, target mutation after passive verification, forged completion JSON without an owning catalog event, and pending Writer state introduced after the last helper. Its independent original event is currently process-local: an actual forked process refuses, while fresh genuine Controller/Writer objects in the producer process pass. Independent review is pending; the source is not integrated or installed. Durable cross-process provenance, authenticated API/pack consumers and installed acceptance remain unmet prerequisites. Complete native image verification continues in parallel. No live lifecycle, queue, library or database changes ran.

- Retained-delivery source correction integrated (2026-10-09): Independent V4 review clears the disabled same-process kernel after repeating all four original fault probes, fresh genuine Controller/Writer objects and an actual fork refusal. Root verifies all 534 frozen pins and exact preimages, integrates the four owning paths, and repeats all 40 controls with the public archive backend without skips. An initial root invocation used an incorrect tool path and skipped all 40; retain that log separately. The ongoing native image contains the prior source snapshot and does not accept this new kernel. Installer/cohort closure, genuine endpoint and worker/pack consumers, durable cross-process provenance and live recovery remain open; T028 stays unchecked and default-disabled. The existing full native snapshot passes its 539 recovery controls and continues remaining tests.

- Disabled retained-delivery packaging (2026-10-09): The owning installer now copies the new helper, the existing SDK closure has 69 exact tracked provenance entries, and image checks require canonical origin, exact helper bytes, disabled state and native/history callable seams. The complete image gate includes all 40 owning source controls; those host-style fixtures do not establish canonical installed semantic acceptance. All affected files parse as Python 3.10 and all 69 current source rows match. Parent activation pins and prospective cohort remain unchanged. Independent packaging review and a fresh matching image are pending; no endpoint or worker consumer is activated.

- Complete native snapshot accepted in isolation (2026-10-09): The 501-input native V2 build passes its complete reliability gate without reported skips, including all 539 recovery controls. Fresh final-image checks at UID1000 with a read-only filesystem and no live mounts verify exact bytes for all 93 production cohort sources and canonical SDK/type identities. The first parity harness compared the SDK list with a tuple and failed after the 93 byte checks; its corrected successor passes and both logs are retained. This accepts the prior source snapshot only: the newly integrated disabled T028 V4 and 69-entry SDK closure require their own matching image and genuine semantic checks. No live deployment, pack recovery or feature completion is claimed.

- Matching disabled-kernel candidate (2026-10-09): Independent packaging review passes 109 focused source controls without skips and confirms the new owning suite is submitted once and every result is checked. The actual installed cohort verifier now also checks exact helper bytes, disabled state and canonical module identity. Repository validation passes with the system Python. Root freezes 503 public inputs and starts the matching native V3 full image build. No live mounts or service changes are involved. Genuine retained-target installed semantics, ordinary seven-case handoff completion, durable cross-process provenance and protected live acceptance remain outstanding.

- Matching image and genuine-runtime checkpoint (2026-10-09): The 503-input native V3 candidate passes its complete image gate without reported failures or skips, including the disabled retained-target module and its 40 owning source controls. Root observes the actual finished image identity. Independently reviewed seven-case ordinary and five-case retained-target harnesses are queued for authenticated isolated execution; no genuine result is claimed while pkexec waits. Independent review holds the next finalizer proposal: its first source-reading callback can change a shared source parent or the not-yet-captured second module leaf and have those new facts adopted. Both exact fault probes are retained and a two-pass original-source correction is in progress privately. No finalizer source is integrated, no endpoint/consumer is enabled, and live state remains unchanged.

- Delivery audit and continuity follow-up (2026-10-09): The staged publication batch passes local CI, including staged secret scanning and 579-commit history scanning. The first CI run rejects trailing whitespace in the exact imported Mylar fixture; a file-specific Git attribute now preserves that fixture unchanged, following the existing imported-patch convention. The publication scan reports no secrets, no skipped files and no privacy findings in the staged paths. Independent delivery review identifies an outstanding worker integration gap: native import confirmation consumes owned rename/metadata continuity, but the worker still requires the original path/signature. A separate read-only worker continuity successor is being developed; original ACKs and control evidence must remain unchanged. The finalizer V2 correction is frozen privately for independent review and remains excluded from delivery. Genuine installed runtime tests still wait for authentication; no live state changes or feature completion are claimed.

- Retained finalizer integration and review follow-up (2026-10-09): Two independent reviews clear the corrected original-source capture for the disabled same-process retained-pack finalizer. Root verifies all 520 frozen file pins and exact preimages, integrates its five owning paths and installer checks, and repeats all 38 finalizer controls without skips. The SDK closure now has 70 exact source entries; the new helper remains disabled and requires a fresh matching image. The previously accepted 69-entry image and its pending isolated checks remain distinct evidence. Delivery review reproduces a separate late catalog-WAL gap after the archive preparation route’s last history callback; its full-original-vector correction is under parallel implementation and review. Root approves the bounded authenticated worker continuity contract for private implementation, with original ACK/attempt bytes, dispatch-return custody, unlocked transport and locked consumption; saved JSON and missing witnesses must hold. Cleanup and restart provenance remain unaccepted. Task checkboxes remain open; no live queue, database, media or service changes ran.

- Expanded source validation (2026-10-09): Root repeats 38 finalizer, 40 retained-target, 21 reader-proof installation and two cohort controls successfully without skips; repository validation passes for the expanded working tree. The separate installed archive probe has one expected host-only skip and does not prove installed acceptance. The two-path route correction is frozen with 129 portable and 129 relocated passing controls, pending independent review before integration. A genuine installed finalizer harness is being prepared against the next 101-source image map. The earlier staged CI result applies to its earlier snapshot; the final coalesced batch still needs fresh delivery checks and installed runtime verification. No live handling or completion checkbox changes are claimed.

- Archive route correction integrated (2026-10-09): Independent review clears the frozen two-path correction after the unchanged original late-WAL probe and seven additional late mutations all hold; 134 review controls pass without skips. Root verifies the frozen manifest and exact source preimage, integrates the route and 18-control owning suite, updates its canonical SDK source pin and adds the actual image-gate suite. All 18 integrated route controls pass without skips. The route preserves detached original preparation/history vectors and closes namespace, claim, absence, file/node and Writer facts after the last helper. Retained reader-recovery fixture pins remain unchanged; no old proof is relabeled. A matching final image and genuine runtime remain required. The worker continuity bridge is still under implementation and separate review; all live holds remain unchanged.

- Coalesced source checkpoint (2026-10-09): Repository validation passes after finalizer and route integration. Root has repeated 144 focused controls without skips; the distinct installed-only archive probe remains skipped on the host. The expanded publication scan has no secrets or changed-path privacy findings. Worker continuity implementation and its independent review, matching installed-image acceptance, protected live recovery and final delivery remain open.

- Genuine-runtime results and purpose correction (2026-10-09): The authenticated isolated runs complete. Ordinary success, lost response, owned continuity and annual cases pass; completed discovery and both coordinated-pack cases fail their full-Process queue predicates and remain under exact source/trace diagnosis. All five retained-target cases stop at held-ordinary-writer before acceptance. Source inspection identifies a real composition mismatch: native_writers.operation admits pending/recovery purpose flags, whereas the retained owning kernel requires all flags false. A bounded opt-in ordinary-purpose operation and corrected wrapper composition are being developed privately, preserving default operation/recovery behavior and the kernel checks. No fixture bypass is accepted as native-wrapper proof. The genuine finalizer harness is frozen privately but needs matching corrected sources and installed execution. User authentication is requested for read-only public API extraction from the accepted candidate image to verify the bridge against exact installed source. No live service, queue, database or media changes ran.

- Runtime diagnostic and harness review (2026-10-09): The private diagnostic-only importer successor preserves every original fixture and acceptance predicate while adding bounded row logs and actual duplicate-check/Process_next flow observations. Root audits its frozen delta and queues the three failed cases against the original accepted image with exact source-map cardinality. No duplicate success or historical ACK is invented. Independent finalizer harness review clears its exact 101-key/95-production-pin contract and 20 host plus 20 relocated controls; the known native-wrapper purpose mismatch still blocks positive runtime acceptance, so an explicit corrected source-pin successor and all eight installed cases remain required. GitHub currently reports no open PRs. Shared worker/native-purpose corrections continue privately; no source or operational acceptance is implied by the harness review.

- Ordinary-purpose wrapper correction integrated (2026-10-09): Independent review clears the opt-in strict native operation after 94 public source controls and 18 additional purpose/cleanup checks pass without skips. Root verifies frozen pins and exact preimages, integrates native_writers/publication_native plus the 16-control owning suite, repins both canonical source entries and submits the suite to the image gate. All 16 integrated controls pass without skips. Only the four disabled retained-target/finalizer wrappers opt in; the strict owning kernel and default legacy/recovery behavior remain unchanged. A new matching image and genuine five/eight-case runtime results are required. Exact actual importer/helper bytes are independently reproduced from retained public sources and frozen accepted patch functions, matching the previously captured runtime source-map hashes; these are reproduction evidence rather than privileged extraction. They identify duplicate preflight in the old existing-target fixture, so a genuine first-import fixture is being designed before admission. No historical ordinary ACK or live cleanup is manufactured.

- Worker continuity correction checkpoint (2026-10-09): Independent review holds the uninstalled V1 bridge because the actual normalizer marker blocks its lifecycle, mapped native missing-file claims are omitted, and its response witness retains reconstructed JSON instead of the original HTTP envelope. The frozen V2 correction contract is reviewed against the owning cycle: collect selectors without authority during the marked cycle, then obtain fresh strict admission after all existing dispatch, refresh, reader and naming work, retain the exact authenticated response bytes, and consume immediately under the writer with complete mapped claim closure. Implementation and independent review remain in progress; no marker exemption, old-proof rewrite, activation or live completion is claimed. The authenticated installed diagnostic confirms all three retained duplicate fixtures enter actual dont_dupe paths without Process_next; its strict terminal assertions remain unchanged. A separate first-import fixture is being constructed before registration with a genuine incomplete target and distinct registered seed.

- Combined delivery checks (2026-10-09): The explicit 74-path staged source passes full local CI and repository validation. Publication scanning covers 2,819 files with no secrets or skips and no privacy indicators in changed paths. The current 507-input isolated native image is building against the freshly verified parent; matching retained/finalizer harnesses keep all 13 semantic scenarios unchanged and exactly match the current 95 production-source pins. Independent review repeats 33 portable harness controls without skips. These checks do not establish installed runtime acceptance, live recovery or completion of any remaining rollout task.

- Independent bridge review (2026-10-09): The frozen V2 bridge remains uninstalled after a literal late-change probe reproduces an accepted mapped native journal mode change: the receiver compares the original hash/signature, then captures a fresh leaf vector. Its correction must map and retain all native original file vectors before replaceable receiver callbacks and conflict-join later captures rather than adopt refreshed evidence. The actual cycle, mapped claims and raw envelope corrections do not waive this additional finding. The current 507-input native image separately passes 2,624 printed tests across 126 suites plus 539 recovery controls, with no reported skips or failures; actual image identity and 13 installed semantic cases still require authentication/execution. No live success or task completion is claimed.

- Coalesced implementation checkpoint (2026-10-09): The retained-download endpoint is integrated locally after independent source review. It grants no archive publication, cleanup or reader acceptance. Worker bridge V3 retains mapped original signatures before receiver callbacks and refuses both previously accepted late-change probes; independent review and matching installed runtime remain pending. The preceding native image passes its complete isolated build gate and has a verified Docker identity; its 13 retained/finalizer cases are queued separately. No live recovery or completion checkbox changes are claimed.

- Shared source integration (2026-10-09): Independent review clears worker bridge V3 after 203 source controls pass without skips and both unchanged late-change probes refuse. Root verifies all frozen inputs and integrates the native/worker owning paths, coalescing the finite retained endpoint classifier with the separate read-only observation command. The retained endpoint also passes 120 repeated local controls without skips. Shared installers, canonical source pins and combined image gates are being reconciled; these source checks do not prove installed transport, durable pack completion, source cleanup or live recovery.

- Combined source verification (2026-10-09): Shared installers and image gates now match all 72 SDK and 25 prospective reader source pins. Root and independent review each pass 162 native plus 40 worker controls without skips; repository validation passes. Activation remains disabled. The publication audit covers 2,842 files with no secrets, no skips and no privacy findings in the changed paths. Local CI initially flags three public API source SHA256 digests as credential patterns; independent review verifies the exact file digests, and three line-specific fingerprint exceptions preserve the checked source bytes. The corrected full local CI run passes, including staged secret scanning. Matching installed images, authenticated transport, durable retained-pack recovery, reader acceptance and live rollout remain open.

- Reviewed delivery and installed diagnostics (2026-10-09): PR #282 merges the reviewed default-disabled source batch; GitHub, local main and the authorized Gitea mirror match `149550ebd18b73c23eb626d431bc60bc3319e25e`. Both non-empty commit-range secret scans and normal commit hooks pass. The user-authorized hosted CI waiver is limited to that merge; all seven original strict check requirements are restored and read back. Six of seven genuine first-import cases pass in the older accepted 99-source image. The pack lost-response fault does fire after its acknowledgement, but the harness retention check follows a staging path that the actual processor renamed; an original-attempt-path successor is under review. The preceding 101-source retained/finalizer runner stops before its cases at an upstream source-permission check; actual image attributes are pending inspection. Neither image proves the current 103-source cohort or live recovery. Retained-pack consumer completion and original-child archive terminal augmentation continue privately in separate units. No activation or live mutation ran, and remaining task checkboxes stay open.

- Next pack-consumer review (2026-10-09): The private V1 consumer passes 88 owning controls without skips but remains unintegrated after independent review reproduces two defects: directory enumeration can precede capture of known control-file originals, and hashing every library file imposes a 32 GiB collection limit. Its correction must capture known controls before enumeration, retain complete original file/node/namespace/claim evidence and hash only affected files. The frozen failure evidence is preserved. Separate original-child archive terminal augmentation is under implementation; it supplies no cross-container producer authority. No current-image or live acceptance is claimed.

- Original-child review checkpoint (2026-10-09): The unintegrated two-module archive terminal proposal passes 199 host and 199 relocated controls without skips, but independent literal probes still return stale evidence when the last directory enumeration changes the original writer purpose, removes the actual export registry entry or swaps the original pipe descriptors. Its successor must recheck the captured logical identities and pipe custody after all physical checks, preserving original vectors. The failed proposal and probes remain retained; no installed or live acceptance is claimed. The previous three isolated authentication requests remained waiting and were stopped. A fresh read-only retained/import test request is pending; no service or library changes ran.

- CI correction checkpoint (2026-10-09): Hosted main checks expose imported upstream snapshots selected by Source lint, excluded build-only worker fixtures and archive-dependent controls run against the pristine upstream image. The candidate preserves exact snapshot bytes with three narrow lint exclusions, includes the public fixtures only in the checked build stage and selects explicit upstream/custom API suite families. The pinned shared selector checks all 593 maintained Python files successfully. With the public archive backend, all 162 API/retained controls pass without skips; the upstream-only 42-case selection reports four passing controls and 38 backend-dependent skips. Corrected local CI and repository validation pass; the earlier missing-PyYAML invocation is retained. Independent review and hosted build verification are pending. No current image, library or live recovery is accepted by these checks.


- Pack and archive verification checkpoint (2026-10-09): The private pack-consumer correction passes 95 controls and independent review repeats its original control-capture and large-library faults successfully. A composed real-factory HTTP test now reaches native finalization and exposes a JSON list/tuple mismatch in worker consumption; the successor remains under implementation. The archive original-custody successor passes 208 controls in root's independent run, and all five unchanged late writer, registry, pipe and logical-core probes refuse stale evidence. Larger same-child forward/rollback history and an observer using existing read-only worker mounts remain private; no current-image or live acceptance is inferred. Activation stays disabled and task checkboxes remain unchanged.

- CI follow-on (2026-10-09): PR #283 is merged, and GitHub, local main and the authorized mirror match `9e42db7c669f9db7507395dbd3439dcc05c3d46a`. Source lint and the worker build pass. Hosted upstream verification exposes two additional owning suites requiring the archive backend. The candidate explicitly reports 38 finalizer skips and three native-producer skips in that compatibility lane, while retaining its 13 backend-independent native-purpose controls. With the actual public backend, all 54 owning controls pass without skips. The custom image retains its mandatory backend and full-family checks. The official Moby matcher reveals that the previous directory exceptions admitted arbitrary configuration descendants. Explicit subtree exclusions and public leaf exceptions now include all 470 required source/fixture entries and exclude all seven private-configuration sentinel paths. Root and independent review each pass the complete 162 copied-source API controls without skips. Full local CI, repository validation and the 2,843-file publication audit pass; the audit reports no secrets or skipped files and preserves 180 unrelated baseline privacy indicators. This is source acceptance; actual image verification remains pending. No service, library or queue recovery ran.

- Composed review findings (2026-10-09): The genuine pack workflow now completes HTTP finalization and worker receipt consumption in private controls, but a hostile escaped snapshot can exceed the actual response limit after commit. A successor checks that serializer before finalization SQL and preserves both original size limits; matching-image proof remains pending. Root independently runs all 26 worker-observer controls, then reproduces a late claim callback that changes an already-checked archive while a final reply still escapes. That uninstalled proposal is held for a complete final physical closure, with its original probe retained. These findings keep combined runtime, recovery and live acceptance tasks open.

- Larger batch integration checkpoint (2026-10-09): PR #284 is merged at `50f56738bae5decdbd348c68d72efd502894bb4a`; GitHub, local main and the authorized mirror match. The original seven strict required checks and all other protection settings were restored and independently read back after the approved hosted-CI waiver. Root integrates only the independently reviewed disabled pack V2 and archive-originals V3 bases, plus worker-observer V2. The observer passes 30 root and 30 relocated controls without skips, and the unchanged original late-claim fault now holds with no final release acknowledgement. Pack composed V3 passes 108 controls but independent real-HTTP review reproduces a final filesystem callback that changes the original mapping while receipt consumption still succeeds; that proposal remains held and excluded, with the literal failure preserved. Shared finite fixture-copy, build-context and runtime registrations are being coalesced; combined source and matching-image checks remain pending. Same-child parent/history composition continues privately. No live state changed, activation remains disabled and completion boxes remain open.

- Upstream image gate follow-up (2026-10-09): Hosted validation for PR #284 passes the retained backend eligibility and prospective reader suites, then fails the unchanged exact-origin check because its synthetic upstream build leaves `config.py` and `Mylar.py` group-writable. The production Dockerfile already closes those modes to 0644 and 0755. The next combined candidate applies those same two mode changes in the CI-only build instead of weakening the verifier; the existing custom-image workflow controls pass. Actual hosted rerun remains pending.

- Integrated archive source checks (2026-10-09): After root coalesces the accepted lifecycle source pins, 275 copied-source archive, lifecycle, preparation, admission and installer controls pass without skips. The first run rejects a stale source assertion; the second rejects a historical fixture used as the immediate predecessor. Their logs are retained. A new exact immediate-predecessor fixture preserves the prior admission bytes, while the historical fixtures and their upgrade coverage remain intact. These checks cover the integrated disabled base only; same-child parent composition and installed/live acceptance remain outstanding.

- Composed pack source acceptance (2026-10-09): Independent review clears the V4.1 correction after 111 host and 111 relocated controls, including the unchanged final-mapping fault. Root integrates its finite 35-file build-only fixture graph and exact source pins. Root and peer each pass all 184 copied-source API controls without skips; upstream eligibility explicitly skips the 22 new backend-dependent cases. The final-mapping fault now refuses acknowledgement, but its post-CAS receipt and intent remain retained in a consuming state. Recovery of that uncertainty, operational initialization and lost-reply status handling remain under implementation. The archive same-child batch is frozen for independent review after 493 host and 493 relocated controls; it is not yet integrated. No live changes ran and completion boxes remain open.

- Reviewed source delivery (2026-10-09): PR #285 merges the disabled pack/archive source batch at `9d0384e7dcd3db313ef802a343ee87fe02ac45ae`. Full local CI, normal hooks and both non-empty commit-range secret scans pass; the publication audit scans 2,887 files with zero secrets or skips. All seven strict hosted check requirements and every other branch-protection field are restored and read back exactly after the authorized waiting waiver. Independent review of the separate same-child proposal reproduces a final pipe-descriptor callback changing the original archive after its last file check while an acknowledgement still succeeds. That proposal remains excluded and its correction is under implementation. No deployment or live recovery is accepted; remaining task boxes stay open.

- Operational review findings (2026-10-09): The separate pack operation proposal passes 126 host and 126 relocated controls, including one finalize request followed by one same-live status request after a lost reply. Independent review reproduces an existing-journal capture defect: an admission callback can change its original attributes before initialization captures them. That proposal remains held for first-capture correction; it is not integrated or deployed. The same-child archive proposal also remains held for its final-descriptor callback correction. Original reproductions are retained and source acceptance does not complete T028/T029 or live recovery.

- Pack operation source integration (2026-10-09): Independent review clears the corrected explicit operation batch after 130 source and 130 relocated controls pass without skips and the unchanged existing-journal fault now refuses. Root verifies the complete 711-pin freeze and original V4.1 preimages, preserves the existing backend eligibility decorator, integrates ten owning paths and expands the finite build-only graph to 36 entries. One live finalize attempt may use one read-only status request after a lost reply; the original action and full consumption checks remain required. The local view reports zero imported members. Combined source checks, authenticated installed transport, outer scheduling, restart and post-CAS recovery remain open; no live changes ran.

- Combined operation and same-child source checks (2026-10-09): Independent review clears the corrected archive same-child batch after 503 source and 503 relocated controls, including the original final-descriptor fault. Root integrates twelve owning paths and updates the exact cohort, installer and finite control graphs; existing accepted installer predecessors remain intact. Independent packaging review confirms 337 API source entries and 36 build-only pack fixture entries. The combined copied reader run passes 1,288 tests without failures, and full local CI passes. The API run passes 199 tests but fails its final source-attribute closure because a concurrent root fault-test invocation changes and restores an original module mode. That run is not accepted; the unchanged sequential repeat passes all 199 controls and the final original-source closure. The additional same-child suite passes 83 controls in a private copy. Matching installed transport, worker observation, external operation routing and live recovery remain open. No live state changed and task boxes remain open.

- Reviewed combined source delivery (2026-10-09): PR #286 merges the 40-file operation and same-child batch at `faa5776b02203d16c99678483979c272aef77599`. GitHub main, local main and the authorized mirror match the reviewed tree; all seven strict check requirements and every other protection field are restored exactly. Staged local CI, normal hooks, 642-file Python correctness lint, publication audit and both non-empty commit-range secret scans pass. Runtime activation and live recovery remain open. The next parallel units implement archive worker observation and a separate retained-pack parent conversation that preserves one worker session across actual backup and isolated restore. A simple CLI cannot establish that ordering; historical standalone delivery needs a distinct retained-repeat producer. No live data changed and no acceptance box is completed by this source delivery.

- Combined worker observation checks (2026-10-10): Independent review clears the separate archive-worker observation composition and its finite build-only fixture packaging. Root passes 199 copied-source API controls with final original-source closure and 588 copied recovery controls across 31 suites without skips; additional copied native and worker checks pass 116 and 43 controls. All 174 recovery and 337 API source pins match. The first recovery run exposed a repository-relative test fixture path; the corrected run uses one exact adjacent production-source fixture and preserves the original assertions. Matching candidate images, installed transport, NFS evidence and live acceptance remain open. Activation stays disabled and remaining task boxes stay open.

- Retained operation and tooling checkpoint (2026-10-10): All 13 historical installed retained/finalizer cases pass after seven controller-fixture arguments use the production string-root type; production code and success assertions are unchanged. That historical image does not prove the current source cohort. Independent review holds the separate retained parent proposal for final source closure and premature worker exit; its successor remains private. Two reviewed development-tool dependency fixes are integrated locally, and the actual Node 26 image, post-create setup and smoke checks pass. No live service or library changes ran.

- Candidate build corrections (2026-10-10): The combined image gate refuses acceptance when all 28 composed pack tests lack the installed archive backend path. The checked Mylar stage now exports that existing fixed path. Two worker fault controls also require changing their original source attributes, so the checked worker stage runs the unchanged full suite in a private user-owned copy and keeps the installed source tree intact. The failed build is retained; the corrected two-image gate is pending. Full local CI, repository validation and 646-file Python correctness lint pass for the preceding source batch; its publication audit scans 2,897 files with zero secrets or skips. No installed or live acceptance is claimed.

- Reviewed worker source delivery (2026-10-10): PR #287 merges the 30-file default-disabled worker observation, build-fixture and development-tool correction batch at `3b084738f67e8d3cb42fb75ec7e472e9ebade9a4`. GitHub, local main and the authorized mirror match the independently reviewed tree. All seven strict hosted check requirements and every other branch-protection field are restored exactly. The corrected full local CI, normal hooks and both non-empty commit-range secret scans pass; local development dependencies are installed from the updated lockfile. The corrected isolated Mylar/worker image gates and the separate retained-parent successor review remain in progress. No live application update or recovery is accepted by this delivery.

- Retained-parent integration and runtime checks (2026-10-10): The corrected worker image passes all 679 controls and an isolated read-only parity check of 34 installed modules. Mylar passes the 199-test copied API family, then its image gate refuses two redundant direct API suites that lack their generated fixture; independent review clears routing those suites only through the mandatory copied API family. Independent review also clears the retained-pack parent after 178 source and 178 relocated controls without skips; all six original fault probes refuse. Root integrates its default-disabled parent, backup, worker control and exact handoff successor, expands the finite copied API graph to 346 entries and the build-only worker graph to 37 Python files plus its pin map. The combined API check is running; the unchanged 588-check recovery gate passes. Fresh read-only inspection confirms Mylar remains unhealthy, Komga healthy and the normal worker held. Standalone recovery is being implemented in parallel against the reviewed original-source, complete SQL and four-role backup contract. No live update, recovery, reader resume or task completion is accepted by these source checks.

- Merged source and capacity checkpoint (2026-10-10): PR #288 is merged at `adc6d17cc21c29cc7303bfea7db38fe0162fe146`; GitHub, both local checkouts and the authorized Gitea mirror match. Full local CI, normal commit hooks, the 2,907-file publication audit and both non-empty commit-range secret scans pass. All seven strict hosted check requirements and every other protection field were restored exactly. The immutable combined image build passes all 679 worker controls and exports its worker candidate, but native verification refuses an original archive readback while preparing a Boolean-sequence fault fixture; diagnosis remains open and no rollout acceptance is inferred. A read-only detached database sizing check verifies original application files unchanged and measures 34,180,534 bytes of complete typed SQL, exceeding the standalone draft's 4 MiB wire limit. Separate private agents are designing a bounded full-evidence transport; it is not accepted or installed. Root also integrates the independently reviewed two-file owning recovery-gate correction and its exact API pins: private source and relocated runs each pass 8 owning, 738 prospective and 588 recovery controls without skips. Root combined and matching-image checks remain pending. No live service or application data changed; activation and all operational completion boxes remain held.

- Hosted CI requirement resumed (2026-10-10): The user revokes the outage waiting waiver. All future merges require successful hosted CI; no branch-protection bypass is authorized. Hosted validation on merged `adc6d17` exposes read-only fixture mutation failures in the native-image and comic-maintenance jobs. The correction must preserve the original read-only mounts and every owning fault assertion while supplying private disposable fixture copies. Root's current combined source run passes all 738 prospective and 588 recovery controls without skips, and repository validation passes; these local checks do not replace hosted acceptance. Diagnosis and CI repair continue in parallel with standalone recovery implementation.

- Root combined and installed worker verification (2026-10-10): The integrated source passes 247 copied-source API controls, 738 prospective controls, 588 recovery controls and the separate 8 owning controls without skips. Full local CI and repository validation pass. A separate actual Python 3.10 diagnostic preserves all archive assertions and passes the unchanged 116-control suite plus ten Boolean-case repeats; it does not explain the prior full-build refusal or replace complete matching-image acceptance. The worker candidate passes all 679 build controls; root independently verifies all 35 installed module hashes and original file closure in an isolated read-only, network-disabled UID1000 container with zero effective capabilities and no-new-privileges. Its retained-pack activation remains disabled. The privately reviewed complete-body transport successor preserves full typed SQL and original file descriptors under fixed bounds; implementation and actual fit remain pending. Hosted CI fixture repair and full native candidate acceptance remain open, as do live recovery and operational task boxes.

- CI isolation verification (2026-10-10): The user’s restored hosted-CI requirement remains mandatory for every future merge. The reviewed launcher retains read-only source mounts and hardened container flags while running deliberate source-mutation fault tests on private copies. Root’s actual worker run passes all 679 tests without skips. The native owning gate now gives each of its unchanged 28 parallel suites a separate finite source closure; its exact API source pin is updated. Full local CI passes. Complete native-image verification, the existing 64 MiB offline tmpfs limit and final-head hosted CI remain pending; no live recovery or operational completion is claimed.

- Offline CI capacity correction (2026-10-10): The actual native gate refuses four startup fixtures because the existing 64 MiB temporary filesystem cannot satisfy the unchanged 128 MiB preservation reserve. Increase only its bounded test allocation to 256 MiB temporary storage and 512 MiB memory; retain network isolation, UID1000, read-only inputs, dropped capabilities and every preservation assertion. The full repeat and hosted successor checks remain pending.


## Reader continuity and backup prerequisites 2026-10-11

Status snapshot transferred from the task list. Current task status supersedes pending delivery statements here.

## Current remaining work (2026-10-10)

T014 is complete: independent review of both READMEs and 17 related Compose, environment, metadata, preparation, ingress and normalizer-example surfaces confirms that diagnostics reuse existing boundaries without a new runtime dependency. `make validate` passes; the generated PostHog bundle is intentionally skipped and the existing asking/harbor metadata warnings remain. Independent source and image review accepts T011 and T013 as implementation milestones: the dedicated repair adoption route, durable history and worker handoff are connected and their refusal/retention tests pass. T012 has implemented forward/rollback continuity, stopped-reader custody and same-child terminal checks. Its remaining prerequisite is the exact configured parent/provider binding and complete archive prepare→execute→terminal proof under feature 023 T022/T026, including affected reader references and unrelated-row preservation. T015 still needs complete matching-cohort delivery proof. The native recovery source passes its complete image gate and final installed source/origin/type parity. The corrected full production image also passes genuine discovery and all 16 import/recovery/rename/metadata scenarios; PR #296 merged normally after all 12 current-head hosted checks passed. These scenarios do not replace the configured archive terminal proof. The subsequent configuration-time cache-retention correction and complete dependent source-pin update pass 115 focused source controls, including nine retention/preflight regressions. Its complete successor image build and both unchanged runtime editions now pass against the actual installed image, with all 101 expected source pins verified. Configured archive/reader terminal proof remains required; fixture results do not accept live repair. Feature 023's [current acceptance work](../023-verified-publication-corrections/tasks.md#current-acceptance-work) tracks the Btrfs portability correction and fresh backup prerequisites. Inspection on 2026-10-11 found that the actual shared 12-scope backup had ended held with partial evidence retained and no final verified acceptance; diagnosis precedes retry or rollout. T016/T017 then require consistent backup and isolated restore, held matching-image rollout and real archive/owner/catalog/reader acceptance. T018 depends on feature 023's complete current-library acceptance before ordinary or bulk processing resumes. No live repair, hold release or cleanup is accepted by fixture checks.

The coherent compact reader correction passes all 389,249 rows of the actual 490 MiB Komga database within the existing limits. Original database and stopped-service checks remain unchanged. Both 77-test suites and independent source review pass. Feature 023 records the detailed [reader and backup evidence](../023-verified-publication-corrections/evidence-history.md#reader-and-backup-verification-2026-10-11). This resolves the observed mechanics blocker. T012 still requires configured continuity and genuine archive terminal proof. The fresh backup, matching-image delivery and live repair remain unaccepted.

## Installed recovery prerequisite 2026-10-11

The complete compact-reader candidate passes its build, installed cohort/source parity and all 17 isolated runtime cases. Feature 023 retains the [combined runtime and backup handoff evidence](../023-verified-publication-corrections/evidence-history.md#installed-candidate-and-backup-handoff-2026-10-11). The actual fresh backup stops before copying because the driver validates a deliberately disabled planning scope before current stopped-profile proof. T012 and T015–T018 remain open: isolated cases do not establish configured archive terminal production, consistent backup acceptance or live repair.

The shared reader source is now merged through PR #304 after all 12 hosted checks passed. The independently reviewed launcher correction and new pending backup invocation are recorded in feature 023’s [delivery and backup evidence](../023-verified-publication-corrections/evidence-history.md#reviewed-launcher-and-source-delivery-2026-10-11). Remaining live acceptance tasks stay open.

## Current archive source pins 2026-10-13

The current-cohort archive assembler and disabled bridge are rebound to the merged source through hash constants only. Independent review confirms the exact 32-source graph and unchanged algorithms, test bodies and custody guards. Eight assembler controls and 13 distinct bridge controls (31 discovery executions) pass from both source and relocated copies without skips. An initial direct frozen-fixture run stops during read-only setup; a writable public projection reaches the unchanged fault assertions and passes, with the failed setup retained. Historical nested receipts remain predecessor evidence.

Actual operation references and image selection remain unbound. This checkpoint neither reruns the 17 image cases nor proves configured installation, connected parent/provider/reader/worker originals, NFS acceptance or a live archive repair/ACK. Those T012/T015–T018 conditions remain open. The separate native-only update backup later fails with `source-changed`; the original native image restarts, with independent READY/catalog preservation verified and processing-worker health still unresolved. Feature 023 owns the [current operational evidence](../023-verified-publication-corrections/evidence-history.md#native-backup-refusal-and-original-image-restart-2026-10-13).

The future reflink helper passes 67 actual Python 3.10/Btrfs controls without skips but is not active in the failed operation. The UI successor is merged and published with hosted CI and source compatibility accepted; it is not deployed, and current configured cohort, parent/provider/reader/worker custody and live archive ACK requirements remain open. No whole-task marker changes.

## Installed integration scope 2026-10-13

The current source audit identifies the remaining T012/T015 installation proof: genuine installed reader lifecycle/provider custody and actual archive terminal production followed by factual native/worker consumption. Existing host tests replace SDK origins or project terminal/ACK facts and cannot substitute for those positives. Parallel disposable-fixture implementation now targets the genuine factories without changing their canonical origins or manufacturing authority. These isolated implementation milestones can finish before the separate live repair acceptance in T016/T017. PR #329 startup repair passes normal delivery checks; its publication and live rollout remain pending. See the shared [delivery and integration checkpoint](../023-verified-publication-corrections/evidence-history.md#startup-repair-delivery-and-remaining-installed-integration-2026-10-13). Whole-task markers remain unchanged.

## Installed archive preparation 2026-10-13

The published PR #329 image passes three genuine installed archive-preparation cases without skips. Disposable fixtures use the canonical SDK, real Controller/Writer, four-database backup and verified isolated restore. Supported malformed-ZIP preparation succeeds under the held Writer; unheld preparation and adoption refuse. Original test assertions remain intact. Earlier setup failures are retained: exact empty installed files, the bundled dependency path and the required forbidden-root configuration were corrected in the fixture/launcher, without weakening production guards.

This accepts preparation and refusal behavior only. Actual configured Parent/Birth/pipe installation, reader continuity, execute/terminal production and factual native/worker consumption remain unfinished. T012/T015 and live T016–T018 remain open. Feature 023 records the independently running [native-only rollout](../023-verified-publication-corrections/evidence-history.md#active-native-rollout-and-owning-integration-2026-10-13).


## Shared post-reboot recovery checkpoint 2026-10-14

Current Mylar availability is held by device-number drift in its immutable
binding. Komga is healthy. The reviewed native/passive-worker device-recovery
batch is integrated locally and passes owning controls, preserving historical
identity and admission rules. PR #338 and its matching main images are delivered,
but this newer batch still needs CI, installed-image and verified live recovery
acceptance. Earlier READY and backup observations remain historical. See the
[owning recovery checkpoint](../023-verified-publication-corrections/evidence-history.md#recovery-delivery-checkpoint-2026-10-14)
for details. These results do not complete bulk naming or archive repair tasks.

## Checkpointed reader WAL — 2026-10-16

A real SQLite checkpoint reproduces a valid main/WAL/SHM pair with a zero-byte WAL. Reader observation refuses it before detached SQL, and connected adoption later refuses the same retained original through its generic positive-size fact reader. The correction gives that exact WAL a checked descriptor/signature path and carries the original vector through adoption, install/reverse and terminal readbacks. Generic archive and main-database bounds, paired companions, detached SQL and publication authority remain unchanged.

Independent review passes. Seven new controls cover detached observation, unchanged original bytes and names, missing companions, aliases, changed modes/signatures, connected install/reverse and complete-to-fresh verification. All 164 related host controls pass without skips. Review also catches the new class following the direct-script exit guard; moving that sole guard to the end makes the actual image-runner invocation execute all 84 adoption tests. The original test bodies remain unchanged. Current source maps are refreshed from the integrated tree. The native Python 3.10 image subsequently passes the same 164 controls without skips: 84 through the real direct-script entry point and 80 terminal/rollback/verifier controls. The frozen public source is copied to disposable scratch for tests that alter their loaded files; input pins close before and after. This verifies runtime compatibility with explicit fixture SDK substitutions, not installed authority. Image delivery and configured/live acceptance remain open.


PR [#367](https://github.com/bolens/homelab/pull/367) merges normally as `b64ed5db` after all seven required checks pass. All 14 contexts are accepted, including the native image build; the conditional Spec Kit update job is correctly skipped. Both exact merge-ref CodeQL analyses report no errors, warnings or results, and review feedback is clear. Local main and the intended Gitea mirror match the merge. This completes reviewed source delivery. The running native image predates this correction, so published-image installation and configured archive/reader acceptance remain open.


## Connected archive execution — 2026-10-16

A genuine producer-to-Parent-to-worker test exposes a production refusal after archive execution: `execute_same_child` emits `terminal-report.json`, but its fixed-output guard rejects that name. The correction admits only that fixed filename with the exact preceding execution-originals census. Exclusive writes, source vectors, terminal rights and replay restrictions remain unchanged.

Five new host controls pass independently, covering actual reports and original-pipe acknowledgement, retained originals, lost response, terminal tampering and reproduction with the historical provider. The genuine owning source export also executes all five; 21 configured-installer controls and full local delivery checks pass. Current installer/source maps close without rewriting historical fixtures, authenticated anchors, launch maps or generated worker outputs. Initial admission and installed-origin boundaries remain explicit fixtures. Target-runtime CI, publication, configured Parent/Birth/NFS and reader continuity remain required before T012/T015 or live T016–T018 can close. See [the shared selected/catalog and source-delivery evidence](../023-verified-publication-corrections/evidence-history.md#connected-repair-and-selected-catalog-follow-up--2026-10-16).


The first PR #373 native build stops before exporting the test sources because the Docker allowlist excludes the two new supplier fixtures. The correction adds only that directory and its two exact public filenames. The official Moby matcher then includes all 654 owning source paths, compared with exactly two missing before the fix, while six foreign/configuration/cache cases remain excluded. The existing genuine image gate remains unchanged and must pass on the corrected head. The project guide now records that source-map closure alone does not prove build-context inclusion.

## Connected producer native-runtime result — 2026-10-16

The corrected PR #373 head `6f9d360b` includes the two pinned nested supplier fixtures in the actual Docker build context. The genuine native source-image gate explicitly executes all five connected producer/Parent/worker acknowledgement controls in Python 3.10: five pass, with no skips. The initial missing-context failure remains retained. This accepts native source-fixture compatibility; final build completion, published-image parity, configured Parent/Birth/NFS custody and live repair acceptance remain separate. The private runtime receipt is `3dced411cb7d92b07ed46f90e1bacd0a5be6590b2390f160e53b4acf11e2d87f`.

PR #373 completes its corrected native build and all seven required checks before normal squash merge `81a592097e9509ac5c8e7ee5a56108635a7e4d79`. Both exact current-merge CodeQL analyses report no findings, errors or warnings; all-page feedback and open merge alerts are clear. The earlier missing-context failure is retained, with no waiver. Merge-readiness receipt: `fde01f268304b807c1717a8d40b060cbc878d5184d968ccecbf901eb63d28d3a`. Matching main publication and installed/configured acceptance remain separate.


## Prospective NFS publication protocol — 2026-10-20

Source integration identifies two platform constraints: NFS does not supply the legacy exchange operation, and independent bind-mount instances can prevent publication even when their device numbers match. A prospective plan13/action-v3 purpose therefore binds source and retained candidate to one actual NFS4 mount instance. Its transient private common root contains exactly two original directories, library and outside-library retention; original descriptors, full root metadata and exact namespace remain sealed. Extra siblings, aliases, overlaps and shadow mounts refuse. Permanent service mounts, privileges, ports and configuration settings remain unchanged.

The explicit protocol records each intent and completion for six link/unlink transitions, preserves original descriptors and streaming hashes, and checks finite link counts and namespaces before every syscall. It never falls back from an exchange error. Unknown syscall, fsync, receipt or SQL outcomes retain both revisions and pending evidence without automatic replay, restoration, cleanup or reader restart. Explicit reversal consumes the original installed capability. The stopped reader, inactive worker and cooperative Writer exclusion are prerequisites; the contract states that an independent actor replacing a name after the final check cannot be excluded by a userspace NFS unlink. A regression demonstrates that limit rather than claiming impossible preservation.

The 33 new component controls cover publication/reversal, independent v2 verification, common-root and mount identity, request schemas and deterministic archive inputs; the NFS suite includes 60 interruption subcases. Existing adoption and lifecycle controls also pass. Independent source review accepts the finite protocol, legacy schema separation, original pipe-fact binding and complete terminal projections. Current source pins, cohort, copied dependencies and image-gate inventory are integrated. The first full collection correctly refuses an old direct-factory body change; the historical factory body is preserved exactly and the prospective purpose has a separate explicit entry point. The complete private-copy collection then passes all 994 controls across 63 suites with zero skips and unchanged original sources. Focused combined integration passes 122 controls, and `make validate` passes. Installed factories remain explicitly unverified; full local delivery, hosted CI and selected-image verification are still pending. The genuine application bootstrap/plan producer remains unbuilt, so no Parent/Birth/NFS execution, native/worker terminal consumption, repair ACK or aggregate task completion is claimed.


## Configured path handoff integration — 2026-10-20

The next coherent source batch forwards the original configured/NFS arguments through `run_operation`. Plan13 now uses an explicit canonical NFS observer view while ordinary action/Birth paths retain Mylar’s declared native mount mapping. Original scope references, source bytes, parent descriptors, protected roots and output-pair custody remain required; historical factory bodies and version12 behavior stay unchanged. Ten new mapping/forwarding controls join the inventory, bringing it to 1,004 cases. Independent review and 237 affected source controls pass. These tests use declared synthetic custody and do not establish genuine installed execution.

The first PR #405 native gate catches an embedded lifecycle pin missed during source integration. The correction refreshes admission and archive-preparation dependencies, their Parent/import-test consumers and the coherent current maps/installer. The owning native reader suite then catches a wrapper budget still sized for 60 children; its fixed cap now encloses the actual 63 existing child deadlines plus the same overhead, preserving every child timeout and the enclosing-budget assertion. Original failures remain retained. The corrected owning reader path passes all 769 controls in 27 suites, followed by all 1,004 recovery controls across 63 suites with zero skips and unchanged original sources. The full local delivery gate also passes on the merged PR #404 base, including the 606-commit history secret scan. Hosted and selected-image acceptance remain pending. Genuine application/bootstrap, reader continuity and configured NFS/native-worker terminal acceptance remain open.

## Disposable application bootstrap source — 2026-10-20

The explicit `genuine_application_bootstrap.py` producer binds original nonce/purpose-labelled private container profiles, exact image IDs, installed source hashes, configuration identities and the shared actual NFS4 mount instance. Its finite steps verify a virgin-state backup and isolated restore, request real Mylar fresh initialization and one original restart, check the full native schema, then request a Komga library scan, verify six ordered page hashes, set target progress and check the unrelated book. The separate stdin-only HTTP helper limits routes and response sizes. Unknown results retain evidence and refuse replay. The original-role library selector preserves its legacy branch.

All 140 focused host controls pass, including 23 new producer controls independently repeated with zero skips. Independent source review clears the frozen producer, HTTP helper and role-forwarding changes against Komga 1.28.1 API contracts. These tests use explicit engine/HTTP doubles and grant no actual application, NFS or connected-factory acceptance. Container/account creation, native catalog seeding and actual processing, task quiescence, original effective-scope/cohort/NFS admission and complete plan13 production remain required. Full owning integration and delivery results are recorded separately when complete. No live operation ran for this source batch.

The complete owning native reader runner passes 769 controls across 27 suites. Its direct recovery collection passes 1,027 controls across 64 suites with zero skips and unchanged original sources. All 237 declared source files and both 427-entry read-only copy maps match. Seven copy-map controls and the generated-source check pass. The fixed aggregate deadline covers all 64 original 120-second child deadlines plus 60 seconds of fixture overhead. The installed SDK cohort and base remain byte-identical because this batch changes host-side producer/Parent tooling only. These source results retain false installed-factory, publication and reader-resume acceptance flags.

## Disposable native catalog and queued processing source — 2026-10-20

The opt-in `genuine_native_catalog.py` stage joins the original bootstrap process, configuration, accepted source map and private container profiles. Its installed helper takes the existing raw Writer, current publication/media snapshots and existing catalog descriptor before constructing the native DB connection. One transaction seeds only finite distinct Wanted fixture identities into the actual empty startup-created schema, preserving other tables and authority. The original source archives have coherent distinct metadata. The stage submits the real native `forceProcess` operation and requires observed Downloaded ownership, exact output file/page checks, source consumption and a second admitted catalog read before Komga scans those actual outputs. A queue response alone does not accept completion or fabricate an ordinary ACK. Unknown or partly completed attempts retain their evidence and refuse automatic replay.

Independent review found and corrected two native-connection defects before source freeze: real `sqlite3.Row` integrity results differ from tuple fixtures, and constructing a DB connection before Writer/existing-file checks could create or recover state outside custody. Regressions cover both, late output changes, a completed first item followed by a lost second submission, and the actual reader-state output seam. All 50 focused host controls pass with zero skips, including 21 new native-data controls, 23 bootstrap controls and six archive-fixture controls. Python 3.10 syntax and independent source review pass. These tests use explicit transport doubles. Actual target-image, daemon processing and Komga execution, full plan13/Parent/Birth/NFS admission and ordinary ACK acceptance remain unproved.

The complete owning reader runner passes 769 native controls across 27 suites and 1,048 recovery controls across 65 suites, with zero recovery skips and unchanged original source files. All 240 recovery-manifest members and both 427-entry copy maps close. The aggregate deadline is exactly 65 original 120-second child deadlines plus 60 seconds of fixture overhead. Historical fixtures and the installed SDK cohort/base remain unchanged. The full local CI gate passes; hosted delivery and actual application/image acceptance remain pending.


## Disposable creator and runtime fixture compatibility 2026-10-20

The explicit `genuine_bootstrap_creator.py` UID1000 actor adds a finite original-purpose Docker adapter using the existing Polkit prefix. It binds accepted image metadata, original source references, a dedicated private NFS scratch parent and a reviewed image/service/DATA contract. It creates only three nonce-labelled disposable roles and one internal network, starts native and reader, creates the pinned Komga 1.28.1 first administrator and API key, then invokes the original bootstrap and native-catalog implementations. The worker stays Created. Source/config copies are fixed and hash-verified; mutation budgets, bounded read-only readiness waits and retained unknown outcomes prevent automatic adoption, replay or cleanup. The original root bootstrap entry point is unchanged.

Two independent security and behavior reviews find no actionable issue. All 21 new controls pass independently and on Python 3.10. The focused tests use explicit transport doubles. Host UID1000 access does not establish root-daemon bindability through root-squashed mode0700 NFS ancestors. Actual startup/enrollment, queued processing, reader completion, complete plan13 and installed Parent/Birth/NFS execution remain open. No live operation, import or ACK ran in this source batch.

The prior native CI run catches a fixture regression that compared Python 3.10 ZIP bytes with host-only hashes. The correction retains the exact pre-identity builder from Git revision `dea6810` with SHA-256 `f11083d2c43fb3b6e38d757ba57c410bdc1eaa0e9bf2505e04f160870c775fbd`. Default outputs for all four malformed/unrelated combinations must equal that unchanged builder byte-for-byte within the same runtime. Explicit identity and invalid-input checks remain intact; the production generator is unchanged. All 50 affected fixture controls pass on both host and Python 3.10, and independent review accepts the stronger runtime-local preservation test. Original CI failures remain retained. The integrated owning runner passes all 769 native controls across 27 suites and 1,069 recovery controls across 66 suites, with zero recovery skips and unchanged originals. All 71 focused genuine-fixture controls pass in Python 3.10. All 243 declared reader sources, both 427-entry copy maps, the fixed 7,980-second aggregate budget and all 18 image-context tests close. The exact Ruff E9/F selection passes for all 852 maintained Python files; full local CI also passes. Hosted verification on the resulting commit and actual image/application acceptance remain pending.


## Source-bound disposable plan13 mapping — 2026-10-20

The creator's native and reader roles mount their canonical L directly. The old active observer instead required production `/data`, `/data/comics` and `/data/manga`, and lifecycle selection independently assumed `/data/comics`. The exact plan13 successor now selects the actual creator geometry from original plan/source references, IDs, labels, profiles, epochs and mounts. It checks the private shared network, finite role mounts, common-root bind without shadows, original G full9, L/R identity and final namespace/source closure. All three owning observation sites use this dispatch. Earlier plans retain six exact original function source bodies; the actual library path is never relabelled as a production alias.

Independent behavior/security review finds no remaining issue. All 25 new controls and 70 related controls pass on both host and Python 3.10. Root catches a host-specific AST hash in the initial parity test before delivery; the corrected test pins exact original Git function source text, independently compared with revision `435d5f2`, and passes on both runtimes. The complete owning runner passes 769 native controls across 27 suites and 1,094 recovery controls across 67 suites, zero recovery skips and unchanged originals. The current manifest has 244 members; both 427-entry copy maps and the fixed 8,100-second child-budget envelope close. All 18 image-context checks pass. Historical fixtures, canonical SDK cohort and configured base map remain unchanged. Hosted delivery and installed-image execution are separate pending gates.

This checkpoint includes the earlier [bootstrap](#disposable-application-bootstrap-source--2026-10-20), [native-data](#disposable-native-catalog-and-queued-processing-source--2026-10-20) and [creator](#disposable-creator-and-runtime-fixture-compatibility-2026-10-20) source milestones. It does not establish actual daemon NFS bindability, startup/enrollment, complete plan production, configured Parent/Birth custody, terminal acceptance, import or ACK.

The next reader-queue observer must use Komga 1.28.1's admin-authenticated SSE `TaskQueueStatus`; there is no read-only tasks-list GET. The pinned [task processor](https://raw.githubusercontent.com/gotson/komga/1.28.1/komga/src/main/kotlin/org/gotson/komga/application/tasks/TaskProcessor.kt) deletes a task after its handler and downstream submissions; the [DAO count](https://raw.githubusercontent.com/gotson/komga/1.28.1/komga/src/main/kotlin/org/gotson/komga/infrastructure/jooq/tasks/TasksDao.kt) includes owned rows. A bounded original-session empty observation can describe that queue at observation time, but cannot exclude future scheduling or grant quiescence, stop or resume authority. That observer and the remaining genuine plan producer are not implemented by this mapping batch.


## Original reader task observation source — 2026-10-20

The optional observer connects the original Bootstrap session to Komga 1.28.1's administrator SSE stream. Creator input version2 binds its exact helper source and permits one finite read-only request plus two original-reader JAR checks; version1 preserves its source contract. Role/profile/epoch, credential, source and library checks bracket two complete empty `TaskQueueStatus` events at least eight seconds apart. A real 30-second alarm bounds DNS, connection and streaming together. Positive counts and mutation events reset the interval; heartbeats, malformed/partial/oversized input, redirects, timeout and disconnect cannot establish success. No tasks DELETE or reconnect is permitted.

Independent review checks the [pinned SSE controller](https://raw.githubusercontent.com/gotson/komga/1.28.1/komga/src/main/kotlin/org/gotson/komga/interfaces/sse/SseController.kt), task DTO, DAO and processor. All 101 focused host and Python 3.10 controls pass with zero skips: 18 stream, 29 Bootstrap, 27 Creator, 21 native-catalog and six fixture controls. The batch adds 30 controls. The complete owning run subsequently passes 769 native controls across 27 suites and 1,124 recovery controls across 68 suites in managed Python 3.10.22, with zero recovery skips and unchanged original sources. The reader manifest closes all 246 members; the two finite outer copy maps retain 427 entries each. The fixed 8,220-second envelope encloses the existing child deadlines. Canonical copy/readback and Docker-context checks pass. Hosted delivery and installed-image execution remain separate pending gates.

These are source and fixture results. `queue_empty_observed` grants no future-work exclusion, quiescence, stop/resume, publication, import or ACK authority. Final stopped-reader, original Writer and task-database checks remain separate prerequisites. Actual daemon NFS bindability, complete genuine startup/plan generation, installed Parent/Birth and native/worker terminal acceptance remain open. Existing histories and formal task checkboxes are unchanged.


## Checked plan13 original-reference composition — 2026-10-20

The host-only `genuine_plan13_producer.py` rederives the checked installation artifacts and maps before consuming their original output references. It joins the original bootstrap, native catalog, two reader books/page hashes, queue-observation bracket and role/process/image identities. It closes the seven effective-scope references, original SourceCohort graph, private base admission and the exact eight NFS engine/session sources. The active Parent and adapter keep their separate plan roles. No reinstallation changes facts after SourceCohort capture.

The explicit Root-only entry writes one intent and invokes the genuine configured `run_operation` with its original Docker engine and inputs. Missing, changed or expired originals refuse; uncertain results retain intent and held evidence and forbid replay. The target's pre-operation file reference leaves the outer closure only at the owning Parent boundary; unrelated original facts remain checked. No SourceCohort, ACK, backup, stop or mutation authority is synthesized.

Independent source review finds no actionable defect. All 21 controls pass on host Python and managed Python 3.10, with zero skips. A negative control reaches the actual configured Parent constructor and refuses before engine inspection or operation because a genuine media-writer prerequisite is absent. These fixtures establish composition and refusal behavior, not installed factory or NFS acceptance. Fresh genuine fact capture, configured Parent/Birth custody, terminal execution and factual native/worker consumption remain open under feature 023 T026/T029 and feature 024 T012/T015–T018.

The integrated recovery runner also passes all 1,145 controls across 69 suites in Python 3.10, with zero skips and unchanged original inputs. The explicit source manifest grows to 248 members; both finite copy maps retain 427 entries and the aggregate timeout becomes 8,340 seconds. These host-only tools stay outside the installed SDK and final images.


## Current role capture after bootstrap — 2026-10-20

The bounded observer reuses the owning bootstrap role and installed-source checks around one original native probe. It preserves the original session’s profiles, epochs, network and directory identities, and returns the composer’s existing current-role shape. The current INI comes from the catalog’s post-startup process observation; the earlier plan supplies its fixed path mapping. It neither restarts applications nor produces SourceCohort, Writer, backup, stop or ACK authority.

Independent review reproduces and resolves two initial defects: adoption of a replaced output parent or same-byte leaf, and refusal of a legitimate INI save between bootstrap and catalog capture. The corrected output uses retained parent/file descriptors, exclusive relative creation, original identity checks and readback through final closure, preserving the primary refusal. All 22 focused controls pass on host and managed Python 3.10, with zero skips. The integrated runner passes 1,167 controls across 70 suites, zero skips and unchanged original sources. Nine runner/map controls and three build-stage preservation controls also pass. The recovery manifest has 250 members, both copy maps retain 427 entries, and the aggregate timeout is 8,460 seconds.

These are source and disposable-fixture results. Actual daemon startup and NFS bindability, fresh SourceCohort inputs, installed Parent/Birth execution and terminal/native/worker acceptance remain open. Formal aggregate task checkboxes remain unchanged.


## Causal source cohort producer — 2026-10-20

The new host-only producer consumes original image, executable, fixture and source references. It runs the genuine installed cohort and complete owning recovery runner between two full current-native module probes, retaining raw command outcomes, source identities and independent profile closure. Alternate test transports cannot mint operational readiness. Partial or uncertain outcomes remain retained without replay.

Review found and corrected two real image-compatibility defects before execution: the selected image declares `/config`, which requires private bounded tmpfs and explicit idle startup with health checks disabled; the historical native map supplies an exact name census, not current hashes for later corrected non-SDK modules. The original current 180-module map and separate 25-module SDK join remain checked before and after execution. Historical bytes are unchanged.

Independent review and all 32 focused host/Python 3.10 controls pass with zero skips. The finite fixture-copy union contains 677 sources, about 11.1 MB within the existing 16 MiB limit. Thirteen owning copy/runner controls preserve collection and source closure. The full managed Python 3.10 recovery inventory passes 1,199 controls across 71 suites with zero skips and unchanged originals. The recovery manifest has 252 members, both outer maps retain 427 rows, and the timeout remains 8,580 seconds. This source proof does not establish actual selected-image execution, installed Parent/Birth or NFS/terminal acceptance; T012/T015–T018 remain open.


## Active input and exact host intent integration — 2026-10-20

The maintained host-only assembler joins existing reviewed inputs into the checked composer without producing scope approval, SourceCohort readiness, NFS facts or mutation authority. It holds original references and exclusive output descriptors through final closure. Public configuration references preserve their owning mode contract; private facts remain private. Fifteen controls cover original substitution, late drift, output custody and configuration permissions.

The host-engine intent builder derives bounded exact inspect, native readiness, parity and mount queries from original roles and sources. Eleven controls preserve fixed users, exact arguments/stdin, finite consumption and denial of generic create/start. The existing registered birth/probe/lease/session route remains the only lifecycle route. Integration refreshes the reviewed engine pin in its lifecycle Parent and installer, the installer's Parent pin and the current-role producer's Parent pin.

Independent source reviews pass. The combined recovery runner passes 1,219 controls across 72 suites under managed Python 3.10, with zero skips and unchanged original inputs. The fixture manifest has 254 members and the aggregate deadline is 8,700 seconds. Separate runner controls verify the changed collection and timeout contract. Repository validation passes. These establish source integration; installed factories, actual NFS, reader continuity and native/worker terminal consumption remain open under T012/T015.


## Original disposable reader mount observation — 2026-10-20

The effective-scope parent can now consume an optional original bootstrap plan and exact pinned bootstrap source. It derives only the private reader configuration bind and original library bound read-only at its unchanged absolute spelling. Original profile, epoch, image, process, nonce, role geometry and retained evidence descriptors close before output and through final release. Arbitrary, writable, duplicate or foreign mounts refuse, including self-consistent altered profiles. The production `original_service()` remains unchanged.

Independent review passes. All 38 parent controls pass on managed Python 3.10 without skips. The complete source/compile gate passes with JDK 21 after refreshing the three reviewed source pins, including generated class inventory and negative missing-class checks. This is source compatibility evidence; packaged Spring cases, a fresh configured observation, actual NFS and connected application acceptance remain unverified.


## Hosted fixture ownership correction — 2026-10-20

The first current-head hosted gate fails because its user ID differs from the required operational owner. The new bootstrap tests created genuine files with the runner's ownership, causing the strict production reader to refuse before reaching the intended assertions. A test-only projection now models UID/GID 1000 for exactly the two declared bootstrap fixtures; all real byte, descriptor, mode, inode, link and timestamp checks remain intact. Production source is unchanged.

Independent review passes. The added regression explicitly models foreign UID 1001 and requires genuine owner refusal, then verifies the finite operational-owner projection and wrong-hash refusal. All 39 parent controls pass on Python 3.10 and the host; the complete JDK 21 source/compile gate passes after the test pin is refreshed. Current-head hosted CI must pass before merge; no production ownership allowance or test assertion is removed.


## Directory-relative hosted fixture check — 2026-10-20

The next hosted run passes the earlier ownership cases but exposes one further fixture mismatch: a directory-relative `stat` resolves against a retained descriptor, while the ownership model incorrectly resolves the name against the current directory. The fixture now resolves relative names through their actual `dir_fd` before applying its existing two-file projection. Production source remains unchanged.

A strengthened model presents hosted UID 1001 across real directory, leaf and descriptor metadata and reproduces the exact complete-main failure before the fix. The corrected model reaches the original injected pre-output failure and verifies both descriptor groups close. All 40 controls pass on Python 3.10 and the host, with zero skips; strict foreign-owner and wrong-hash refusals remain. Current-head hosted CI remains required.


## Exited canary with pending attach output — 2026-10-24

AO uses the published #515 native image and a matching checked installation. Its
NFS canary completes all five hardlink transitions and exits zero with an
8,707-byte response. The host refuses `probe-original-inner-exit-unknown` before
reader stop at its pre-read client-exit check. The original attach client's exit
status and pipe capacity were not retained. AO and its original helpers remain
preserved without replay. Both archives retain their
full identities, bytes and ZIP members; both reader records/progress and six page
hashes are unchanged. Native process/config observations retain their originals,
and the permanent worker remains Created.

A real-process regression forces the inner process to exit while the original
attach client blocks forwarding a response through its 4,096-byte stdout pipe.
The previous observer reproduces the same refusal. The correction admits draining
only after authorized execution, with the original client incarnation and FIFO
descriptors. Zero final exit, original-inner disappearance and postrelease terminal
profile validation remain mandatory. Foreign client ticks, changed stdout pipes,
pre-execution disappearance and nonzero exits still refuse. This transport proof
supplies no configured recovery acceptance. Fresh forward and distinct rollback
execution remain required for T012/T015 and feature 023 T026/T029.


## Retained-root probe cleanup — 2026-10-24

AQ passes the corrected output drain and physically releases its NFS writer.
The Parent then refuses `nfs-probe-cleanup-exact-owned-absence`: its cleanup
predicate still expects a direct fixture bind, while searchable geometry binds
the retained `R` directory. This happens before reader stop. Both archives, reader
records/progress and six page hashes retain their baselines. All 24 independently
observed native tables are unchanged. AQ remains preserved without replay.

The correction keeps the legacy direct bind and checks searchable cleanup against
the original common-root row, retained descriptors, sealed binding and exact two
mounts. It rechecks custody after absence callbacks. Cleanup still requires the
successful original kernel, physical release and exact fixture/private-parent
absence. The retained root is never a cleanup target. Sixteen component checks
include actual descriptors, expired operational deadlines, binding drift, reused
retention descriptors and late registry replacement. These component checks supply
no configured recovery acceptance. Fresh forward and distinct rollback remain
required.


## Owning lease-reply absence observation — 2026-10-24

AS passes the retained-root cleanup correction, then holds before reader stop
when the final host lease reply checks a removed private NFS path with Root's
`os.lstat`. The original trace records `PermissionError`. The existing owning
release observer checks the same exact paths through the retained UID1000
geometry. The final reply now uses that observer. No target, permission or
absence requirement changes.

The existing real Writer/helper/FIFO regression now exercises the host reply
boundary with an explicit credential model. It reproduces the original refusal
and passes with the corrected observer. All 18 host-lease controls pass. Session
construction remains projected, so this supplies no configured NFS acceptance.
AS remains preserved without replay. Independent comparisons find unchanged
archive identities/bytes/members, reader records/progress, six page hashes and all
24 native tables. The separate AT fixture has not entered recovery.

## Superseded execution notes — 2026-10-23

These notes describe earlier holds and corrections, not the current execution
queue or permission to repeat them. Current work is owned by `tasks.md`.

The current held forward run reaches prewrite with a 137-second-old scope.
Correct only the duplicated Parent guard in the retained NFS session: the
original module checker already executes the full Parent guard. Retain that
checker’s function/code/defaults in the existing session seal and verify its
binding before and after direct invocation. Preserve all transport checks,
4096-byte writes, independent observations and the 120-second freshness limit.
Measure the resulting connected run; a reduced call count alone is not runtime
acceptance.

AH passed the previous deadline boundary, then held at the child mount
comparison before reader stop. The correction normalizes expected mount rows
after JSON transport. AJ held at current-role readiness before Producer entry.
Its rejected probe reply was not retained, so the exact cause is unproved.
AL passed current roles and the mount comparison, then its nested probe could
not read source paths beneath protected host ancestry. AM exercised the child
Tree source fix, then held before Writer/reader stop at the NFS namespace join.
Actual findmnt and raw mountinfo encode the exact subtree in source with root
`/`. The correction supports that exact representation in both probe validators
and native adoption. Native adoption belongs to SDK102, so matching image proof
and a fresh installation must precede another connected run. Both archives,
reader records/progress and six page hashes remain unchanged after each hold.
Terminal acceptance remains unproved.

## Copied-control holds and bootstrap readiness — 2026-10-25

The subsequent CC attempt passed NFS and backup/restore, then held while the host
producer confused the copied manifest view with the backup directory. PR
[#523](https://github.com/bolens/homelab/pull/523) corrects that host-only geometry
binding. Its fresh checked installation passed; the next isolated attempt held
before reader stop when a later native readiness projection refused its reply.
The reader remained running, both archive originals and the full native database
were unchanged, and no terminal was accepted. Retain the failed reply’s finite
state/reason and census shape for diagnosis; an earlier ready observation does
not establish later Writer availability. Preserve both attempts without replay.
The next fresh attempt passed NFS, stopped its disposable reader and completed
backup/restore, then held because a Parent closure treated a logical report key
as the copied report’s physical path. The reader remains stopped without resume
authority. Both archive originals and the complete native database are unchanged.
Correct the five affected physical-vector consumers together, retaining logical
protocol lookups, physical identities and conflict refusal. The later terminal
and resume consumers already use physical references. This remains T012 work,
not a new task or a reason to relax acceptance.
The next isolated attempt passed those copied-report checks and held before
archive execution because the custody producer compared a copied provider's
physical host path directly with its original source path. Both archive
originals and the complete native database remain unchanged; its reader stays
stopped without resume authority. Join that roundtrip through the original
source lookup and exercise provider, input, SDK and control projection through
the real child-copy mapping before another attempt. This remains T012 work.

The corrected original-provider roundtrip passes the real Tree/Paths custody
regression, including provider, input, SDK and control projection. Its fresh
installation and receipt export verified all 27 originals. The subsequent
disposable bootstrap initialized native state and restarted its native container,
then held before archive recovery. Native and reader remain running, worker
remains created, and later native health reports ready. The original successful
health reply was not retained, so its rejection cause is unknown. Preserve the
fixture without replay. A finite startup state/reason/census-shape record now
precedes that same refusal; it adds no retry, admission or resume authority.

The next bootstrap passed. Its forward attempt then passed SourceCohort and
removed its own SourceCohort helper, but held in read-only projection before
Parent entry or Writer acquisition. The rebuilt maintained effective observer
returned copied producer/parent paths, whereas the cohort declared their
original paths. Its older private operator copy had adapted those references.
The maintained observer now returns both original code identities and the five
proof-output references, preserving all copied-code and original-source closures.
The fresh packet must bind the actual compiled producer's path as well as the
executed parent. Independent post-hold comparison verifies both archive full9
and byte/member identities, reader books/pages/progress and the entire native
24-table model are unchanged. The held attempt is retained without replay.

The next fresh operation reused that unchanged fixture and installation, passed
SourceCohort and the effective-original join, then reached the owning Producer.
It stopped only its disposable reader and held during the execute child's native
observation. Both original created and first-started profiles contain 73 unique
mount destinations. The adapter passed the complete list to the native scope
parser, which refuses more than 64 rows. The configured Parent adds copied
controls, private scopes and the admission overlay beyond its original mount
vector. The child-only correction validates every row, then passes matching
ancestors to the unchanged parser, preserving duplicate and shadow checks.
Native/worker mount limits remain unchanged. Read-only diagnosis found native
running, reader exited, worker created and the original native process/config
unchanged. Independent post-hold checks also confirm both archive full9 and
exact bytes, all six page hashes and the entire native 24-table model are
unchanged. No accepted terminal or resume authority was produced. Preserve the
held operation and its exact helper; a changed adapter requires fresh checked
host controls and a separate unused fixture.


## Installed child geometry hold — 2026-10-26

After PR #524 passed hosted CI and merged, the fresh CX packet used the unchanged
checked installation and an unused disposable fixture. SourceCohort and the host
selected-child geometry check passed. The owning Parent stopped the disposable
reader, then held without an accepted terminal. Read-only diagnosis found native
running, reader exited and worker created; the original native process and
configuration still match. The exact execute helper's retained traceback ends in
`publication_native_scope_birth.from_checked_parent` calling
`publication_native_configured_scope.projection` with 73 mounts and refusing
`scope-mount-bound`. The earlier host-only correction missed this installed
consumer and the later Scope constructor's identical limit.

The corrective source uses one SDK child projection across Birth, Scope and both
host adapters. The existing complete Birth/lifecycle/Scope test was first shown
to fail with 73 mounts, then pass with the same full vector retained. Refusal
controls cover an oversized child, malformed irrelevant mount, duplicate relevant
mount, foreign source mapping and unchanged native/worker 64-row limits. Full
vector revalidation still rejects drift in an irrelevant copied-control mount.
Historical fixtures remain unchanged. A new installed SDK image and its actual
module proof are required before a fresh operation. This source work supplies no
accepted archive terminal, rollback or reader-resume authority for CX.


## Fixture publication version hold — 2026-10-26

PR #525 merged with local and hosted checks passing. Its published native image
was captured in a restricted offline helper: all 180 native modules and the
required 103-module SDK match, including corrected Scope and Birth sources. The
helper was removed. The fresh CY checked installation verified all 27 outputs,
and CZ's disposable native/reader/worker bootstrap passed.

CY stopped during SourceCohort preparation before Parent entry because its
private readiness input retained the previous Scope bytes and Probe source hash.
The separately prepared DB packet derives every readiness source field from its
exact current cohort. The actual owning predicate rejects CY and each stale
field independently, and accepts DB. DB's 58 packet, six original-Parent and 16
independent observer controls passed. DB reuses the unchanged checked installation
and untouched CZ fixture; no second installation or bootstrap was required.

DB passed SourceCohort and reached the owning Parent. The Parent stopped only the
disposable reader, then held without an accepted terminal. The exact execute
helper's retained traceback reaches `StoppedReaderCustody.archive_publication`:
the genuine fixture request is emitted as version 4, but the native lifecycle's
explicit publication policy still requires version 3. The action already routes
both versions to the same NFS publication selection. The previous SDK geometry
failure is passed; the current refusal occurs before archive publication.
Read-only diagnosis finds native running, reader exited and worker created.
Independent post-hold comparisons prove both archive full9 and hashes and the
entire 24-table native model unchanged; the original native process/config also
match. Preserve DB, CZ and their helpers without replay or inferred resume.

The focused correction admits only integer invocation versions 3 and 4 with the
unchanged `rename-link-v1` policy. Its regression executes the Parent's real
version branch through real Birth, the same OS pipe, custody, Scope and adoption;
only fixture-document admission, installed origins and parent observations are
doubled. The old code fails version 4 and incorrectly accepts float `3.0`.
Corrected controls retain version 3, reject floats, booleans, unsupported versions
and missing/foreign protocols, preserve one-use selection and enter no Writer.
This component proof grants no configured acceptance. A matching new image,
actual SDK capture, checked installation and unused fixture are still required.


## Prebirth live DATA custody hold — 2026-10-26

PR #526 merged with every local and hosted gate passing. Main publication and
registry/platform/SLSA joins pass; actual capture verifies all 180 native modules
and SDK103, and removes its restricted offline helper. Fresh DC installation
verifies all 27 original outputs. DD's disposable bootstrap passes. Its forward
packet passes 58 controls, six actual Parent-original guards and 16 independent
SQL observer controls, with fresh two-archive/two-book/six-page/24-table baselines
and independent review of the armed graph.

DC passes SourceCohort and enters the owning Parent. The Parent stops only DD's
disposable reader, then holds during execute prebirth custody in
`comic_archive_proof_producer.close`: `archive-producer-final-file`. No execute
child or accepted terminal is produced. Native is running with original
process/config, reader is exited, and worker remains Created. Independent
post-hold comparison proves both archives' original full9/hashes and all 24
native tables unchanged. The original failing in-memory vector was not retained;
metadata measured afterward cannot identify its exact offending path. DC and DD
remain held without replay, inferred resume or production authority.

A separate read-only 30-second sample observes a timestamp-only change in native
DATA. A bounded metadata-only directory watch sees creation/deletion of
`workflow.sqlite-journal` and SQLite close-write events. This identifies namespace
activity, not the responsible process or DC's prior failing vector. Source
inspection shows the worker mounts native DATA read-only at `/mylar`, while
prebirth custody records every bind Source directory as immutable full9 before
the future archive Writer window.

The local owning phase-custody reproduction uses a real SQLite transaction that
creates a journal, then rolls back. Database bytes/full9 and native config remain
unchanged; only native DATA directory timestamps differ, and the old guard
refuses `archive-producer-final-file`. Parent/runtime profiles are explicit test
doubles; this is not Root/NFS or configured acceptance. The finite correction
requires the checked native DATA projection and the unique read-only worker bind
to agree, retains the originally captured identity5, and forbids aliasing with
reader/restore/library/private scopes or immutable trees. Other full9, source,
census and absence checks remain. Refusals retain bounded path-digest/vector
metadata in private stderr without changing their authority or retry behavior.
Changed host controls need fresh checked installation and an unused fixture;
unchanged native SDK bytes alone do not close the forward/rollback tasks.

## Missing disposable history preflight — 2026-10-26

PR #527 merged with every required check passing and the reviewed tree unchanged.
The first unused proposal refuses before privileged execution because one local
source has mode 0600 instead of its Git-recorded 0644. Preserve that proposal;
a clean exact-commit checkout supplies all 692 canonical files with the required
690 regular 0644 and two executable 0755 modes. Fresh DG installation/export and
DH bootstrap pass, followed by 58 packet, six Parent and 16 observer controls,
independent armed review and fresh archive/reader/native baselines.

DG passes SourceCohort, verified backup/restore, reader stop, prebirth custody,
actual Birth and the original execute pipe. The execute child enters and leaves
its Writer, then exits 1 without ACK. Its original traceback identifies
`execute_same_child` calling `publication_archive_history.directory`, which
refuses the absent `/config/mylar/archive-history-v1`. No accepted terminal or
resume follows. Original native process/config remain unchanged, worker remains
Created, and the reader remains exited. Independent post-hold observation proves
both archives' full9/hashes and all 24 native SQL tables unchanged.

The ordinary `request-archive-repair-adoption` route initializes that history
under the native Writer before queue admission. Disposable catalog setup never
called it; host repair-flow tests manually initialized history before custody.
The correction belongs in disposable catalog setup after both actual processing
completions and before reader scan and protected backup/custody, through that
same authenticated API. Its setup queue row grants no selected operation, ACK,
preservation, mutation or publication authority. Execute remains existing-only;
worker request journals and selected repair stages are not precreated. Retain
DG/DH and all predecessors without replay or inferred resume. Forward and
distinct-fixture rollback acceptance remain open.

## Allocating pair reentry — 2026-10-26

Fresh DJ bootstrap from PR #528's frozen source completes the actual ordinary
archive preflight, records only queued-review/no-grant setup evidence and verifies
the original 0700 history directory. DI reuses DG's unchanged original installation
with the new cohort and passes all 58 packet, six Parent and 16 independent
observer controls, original joins, armed review and fresh preservation baselines.
Its owning execution passes the history precondition, then the execute helper
exits 1 at `fixture-same-owning-pair`, without terminal acceptance or resume.
The reader remains exited 143, native process/config remain original and the
worker remains Created. Independent comparison proves both archives' full9/hashes
and all 24 native SQL tables unchanged.

The transition's second `exact_pair` calls the actual Scope factory inside the
already-held Writer session. That factory allocates fresh objects and replaces
its pair registry, so comparing them with the original pair always fails. The
separate verifier has the same ordering error: preparation binding allocates a
new pair after the verifier captured the pair it later tries to hold. Existing
flow doubles always returned the same objects and hid both boundaries.

Real Scope/factory/Writer/pipe controls reproduce the first refusal, and a
separate-verifier test with actual allocated SDK objects reproduces the second.
The host correction reads the original process-local session record, compares
Controller/Writer identities without invoking the factory, retains record
identity across callbacks, and selects the verifier's final pair after binding.
Native factory semantics remain unchanged. These controls establish source
behavior only. Preserve DI/DJ and every earlier hold; a fresh matching checked
installation, unused fixture, accepted forward and distinct rollback are still
required.


## Disjoint fixture ancestry and unchanged catalog — 2026-10-26

DM's fresh installation verifies all 27 outputs, and DN bootstraps with the
original queued-review/no-grant preflight. The forward run passes original Writer
pair admission, then stops at `action-admitted-output-parent` while writing the
fixture intent. The receipt writer receives both library and DATA ancestors but
admits only ancestors of its output. Tests placed both paths under one parent,
hiding the mismatch. Independent post-hold checks prove both archives' full9/hashes
and all 24 native SQL tables unchanged. Native process/config remain original,
reader is exited and worker remains Created; no terminal result or resume exists.

Separate-branch tests reproduce the exact refusal. Receipt writes now select
original retained stage ancestors while successor seals retain both branches.
The connected current-source fixture/preparation/adoption test then catches a
second failure before another operational attempt: the repaired genesis size can
already equal the native catalog's recorded size. SQLite's no-op UPDATE creates
no journal; unconditional journal admission raises after exchange. Complete typed
snapshot equality now skips that UPDATE, retains original DB bytes/full9 and all
companion absences, and supports both forward and reverse. Changed snapshots still
require the connection's original live journal. Source tests exercise foreign
companions and the actual rename/link algorithm on local files with explicit
origin/transport substitutions; they supply no installed NFS or acceptance proof.
Historical fixtures and held attempts remain unchanged. The native SDK correction
requires a matching publication and actual capture before the next fresh fixture.


## Superseded delivery queue through PR #529 — 2026-10-26

PR [#515](https://github.com/bolens/homelab/pull/515) supplies the retained
180-module native baseline and DATA precondition; the required SDK has 103
entries after PR [#521](https://github.com/bolens/homelab/pull/521).
PR [#522](https://github.com/bolens/homelab/pull/522) changes five installed native
modules for the shared phase deadline. Require its matching published image and
fresh module capture before the next isolated pair. That capture is now verified.
PR [#524](https://github.com/bolens/homelab/pull/524) delivered copied-control
roundtrips, original-provider references and the host-side selected-child mount
check. Its fresh CX operation passed that host check, stopped only its disposable
reader, then held in the installed Birth consumer: the SDK still applied its
64-row native/worker parser to the complete 73-mount child vector. The retained
child traceback identifies that exact boundary.

PR [#525](https://github.com/bolens/homelab/pull/525) delivered the shared
selected-child projection in SDK Scope, Birth and both host adapters. Its matching
image capture verifies all 180 modules and the required 103-module SDK. Fresh
checked controls and disposable bootstrap passed. A stale private readiness
input was corrected from its exact Scope and Probe sources before DB passed
SourceCohort and reached the owning Parent.

PR [#526](https://github.com/bolens/homelab/pull/526) delivered strict integer
versions 3/4 for the unchanged publication protocol. Local and hosted checks,
main publication, actual 180-module capture and the required SDK103 joins pass.
Fresh DC host controls verified all 27 outputs, and DD's disposable bootstrap
passed. DC then reached the owning Parent and stopped only its disposable reader,
but held in prebirth custody with `archive-producer-final-file`, before archive
execution. The original transient vector was not retained, so the exact changed
path in that attempt is unknown. Both archives' full9/hashes, all 24 native tables
and the original native process/config remain unchanged. Preserve DC/DD and all
prior holds without replay or inferred resume.

PR [#527](https://github.com/bolens/homelab/pull/527) delivered the finite original
DATA identity correction and bounded refusal metadata. Its real SQLite rollback
regression, 1,767 recovery controls, local CI, independent review and all hosted
checks pass. Fresh DG controls verified all 27 outputs and DH bootstrap passed.
DG passed prebirth custody, real Birth and the execute child's Writer session,
then held because archive history had not been initialized. Both archives'
full9/hashes and all 24 native tables remain unchanged; its reader stays stopped.

PR [#528](https://github.com/bolens/homelab/pull/528) adds the ordinary authenticated
repair request before reader scan and backup/custody. Fresh DJ bootstrap records
its actual queued-review/no-grant result and the original 0700 history directory.
DI then passes history admission but holds at `fixture-same-owning-pair`: the
transition calls the allocating Controller/Writer factory inside the original
Writer session. Both archives' full9/hashes and all 24 native SQL tables remain
unchanged; the reader stays stopped, native process/config are unchanged and
worker remains inactive. Preserve DI/DJ without replay or inferred resume.

PR [#529](https://github.com/bolens/homelab/pull/529) corrects original Writer
pair reuse and the separate verifier's binding order. DM passes those boundaries
but stops before the fixture write: its receipt writer receives the union of
library and DATA ancestors instead of the receipt's own ancestry. Keep that union
in retained custody and admit only the original DATA ancestry for receipt writes.
The separate-branch regression now exposes this geometry directly.

The connected current-source regression also exposes an unchanged-size SQL case:
repair can restore the catalog's already recorded size, so SQLite has no journal.
Skip the SQL UPDATE only for identical complete typed snapshots, retain original
DB bytes/full9 and all companion absences, and require the owned journal for
actual catalog changes. Forward/reverse and foreign-companion controls cover
this boundary. This installed native correction requires a matching new image
capture and checked host installation before another unused fixture. Preserve
DM/DN and every earlier hold without replay; forward and distinct-fixture rollback
remain unaccepted within T012/T015. [Retained failure history](evidence-history.md#disjoint-fixture-ancestry-and-unchanged-catalog--2026-10-26)
owns the diagnosis.


## NFS ACL on private local custody — 2026-10-26

PR [#529](https://github.com/bolens/homelab/pull/529) passed local and hosted checks, main publication, exact 180-module capture and required SDK103 joins. DP installed all 27 matching controls; DQ bootstrap and preflight passed. The forward run reached fixture transition and owning preparation, then held while copying `system.nfs4_acl` from NFS to a private local preservation file with `EOPNOTSUPP`. No terminal or resume was accepted. The selected fixture archive differs from genesis; its unrelated archive retains its full9/hash and all 24 native tables are unchanged. Native remains running, reader exited and worker Created. Preserve DP/DQ without replay.

Local regressions retain the complete source ACL in existing sealed metadata, distinguish portable private-copy attributes and keep canonical ACL equality strict. An independent synthetic NFS-to-local benchmark reproduces the old refusal and verifies two corrected private copies, complete unchanged source evidence and the user attribute. A separate same-NFS copy verifies actual full ACL application/readback. These checks do not establish configured repair or reader acceptance. A new matching image/control installation and unused fixture remain required.

The adjacent creation audit reproduced a separate identity gap before another
fixture was consumed: corruption or same-byte inode replacement after private
preservation could become a newly sampled baseline. The same pattern affected
private derivative/receipt creation and the derivative's final attribute readback.
PR [#531](https://github.com/bolens/homelab/pull/531) carries the original exclusive
file-descriptor fact through these boundaries and rejects replacements. This
source correction remains part of T012/T015; it supplies no runtime acceptance.

## Canonical reader mount projection — 2026-10-26

PR [#531](https://github.com/bolens/homelab/pull/531) passed local and hosted
checks, main publication and actual 180-module capture. DT verified 27 installed
outputs and SDK103; DU bootstrap and fresh preservation baselines passed. The
forward attempt reached causal fixture replacement and owning preparation,
then held in `StoppedReaderCustody.native_url` with
`lifecycle-native-reader-mapping`. Its reader binds the library at its original
canonical path, while that method considered only destinations under `/data/`.
The execute helper exited1. No terminal or resume was accepted. The reader
remains exited143, native running and worker Created. The unrelated archive
retains its full9/hash and all 24 native tables are unchanged. The target differs
from genesis. Preserve DT/DU without replay.

The correction removes the destination-prefix assumption while retaining the
unique deepest source bind, inverse destination/shadow checks, exact observed
BOOK URL and final custody closure. Regression coverage joins the actual
lifecycle mapping to the actual archive reader lease, including BOOK, MEDIA and
MEDIA_PAGE observations. Source tests and this diagnosis do not establish
configured repair acceptance. Matching image/control delivery and a fresh
fixture remain part of the existing shared T012/T015 execution order.

## NFS open-file unlink — 2026-10-27

PR [#533](https://github.com/bolens/homelab/pull/533) passed local and hosted
checks, main publication and actual 180-module capture. DW verified all 27
installed outputs and SDK103; DX bootstrap and independent archive, reader and
24-table native baselines passed. The forward attempt passed the corrected
reader URL mapping and reached the owning NFS archive transition. It held after
detach-source without an accepted terminal. The reader remains exited143,
native running and worker Created. Preserve DW/DX without replay or resume.

The original journal ends at detach-source intent. The original archive remains
at the declared displaced name and the repaired candidate remains at swap;
their hashes match the original preparation and baseline. Independent checks
verify member payloads, compressed bytes, CRCs and pages, unchanged unrelated
archive full9/hash, and unchanged complete native SQL state. The target's original
pathname is absent. A later Writer-leave status refusal is secondary to the
uncertain transition, not evidence to relax native admission.

A separate synthetic check on the same NFS transport reproduces open-file
silly-renaming: unlink leaves a hidden alias and elevated link count until the
descriptor closes. The correction closes only the affected inode's owned FD
before final pathname CAS and unlink, then reopens its predetermined surviving
hardlink and checks original identity/bytes before callbacks. Six durable steps,
no-clobber publication, strict namespace and no uncertain retry remain intact.
The corrected synthetic NFS algorithm passes forward/reverse, preservation and
independent terminal verification with explicit component admission substitution.
This does not establish installed factories or connected forward/rollback
acceptance. T012/T015 and the shared feature 023 criteria remain open.

## Terminal directory fact comparison — 2026-10-27

PR [#537](https://github.com/bolens/homelab/pull/537) delivered the descriptor
correction. Actual-image verification covers all 180 modules and SDK103; only
the intended adoption module differs from the preceding capture. Startup sources
are unchanged. Four new installed-image cases pass without skips: discovery,
ordinary import, lost-reply reconciliation and rename/metadata continuity.
These component results do not grant configured archive acceptance.

DY verifies all 27 fresh installation outputs. DZ bootstrap, 58 packet checks,
six original-Parent checks and independent archive/reader/native baselines pass.
The one-shot forward run reaches an `observed-forward` child report, then holds
at the host Parent's `archive-terminal-original-node-conflict`. The reader is
stopped, native running and permanent worker unstarted. Do not replay or resume.
Independent post-hold observations confirm byte-exact genesis reconstruction,
unchanged unrelated archive full9/hash and all 24 native SQL tables unchanged.

The Parent captures directory facts as lists. Terminal partitioning returns
tuples, and their direct equality test refuses identical five scalar values.
A regression through the actual terminal-acceptance method reproduces that
same refusal. Compare canonical scalar tuples without replacing the original
ledgers or weakening identity, late-change, namespace or final closure checks.
The corrected focused suite covers matching list/tuple facts, changed values
and late directory drift. Checked source delivery and fresh configured execution
remain within T012/T015; no additional task or acceptance layer is introduced.

The unused historical rollback comparison also assumed the valid genesis archive.
Explicit rollback instead restores the retained malformed pre-repair successor,
while native state must match its full preoperation baseline. Its independent
comparison must bind the original causal receipt, candidate, preparation and
terminal witnesses, preserving payload/compressed bytes/pages/XML and complete
access attributes. Pure controls now verify the finite ZIP reconstruction and
reject hidden header/envelope drift. Original-chain integration and actual
distinct-fixture rollback remain outstanding.

## Terminal projection capacity — 2026-10-27

PR [#540](https://github.com/bolens/homelab/pull/540) delivered the directory-fact
comparison correction with all 13 PR checks passing. EB installs all 27 controls;
EC bootstrap, 58 packet checks, six original-Parent checks and fresh independent
baselines pass. Its single forward attempt reconstructs genesis bytes, then the
Parent holds at `child-control-bound` while copying the first baseline view.
The reader remains stopped, native running and worker unstarted. No owning
terminal return was accepted. Preserve the attempt without replay or resume.
Independent observations confirm target bytes, unrelated archive full9/hash and
all 24 native SQL tables match their baselines; original native process and
configuration bindings remain unchanged.

The projection counts ordinary inputs and factual output views together under
32, so 26 ordinary inputs and six views leave no room for the remaining proof
records. Tracing the entire forward/rollback acceptance path establishes 26
ordinary inputs, 40 declared NFS inputs and 11 output views: 77 total. ACK/report
rereads reuse existing views, and resume adds no projection. Keep ordinary
inputs limited to 32, NFS reservations to 48 and all records together to 80;
give factual outputs their own limit of 16. Retain exact paths, original proof,
private copies, seals and final closure. Regressions reproduce the refusal
through the actual Parent proof-copy method, exercise all 11 views and free
rereads, and refuse the first excess input, output, NFS reservation and shared
entry. This correction remains within T012/T015; it adds no task or runtime gate.


## Terminal record path and owner routing — 2026-10-27

EE/EF passes the separate projection budgets and the child reports observed
forward reconstruction. Parent terminal consumption then refuses
`child-tree-path`: its baseline is a canonical NFS retention original, while
preparation, histories and the causal receipt use the mapped DATA directory.
The actual 11-record layout was missing from the earlier capacity regression.
The adjacent direct Root read would also refuse private UID1000 NFS records.
These are inconsistent callers of the established ownership contract, not new
filesystem requirements. The original attempt remains held without replay or
resume. Independent post-hold comparison verifies genesis bytes, unrelated
archive full9/hash and all 24 native SQL tables; native remains running, reader
stopped and worker unstarted.

The correction keeps general child-tree path admission confined. Only the
owning proof-copy method supplies an exact mapped physical origin after checking
its original proof9. NFS originals use the existing sealed owner reader as
UID1000, including ancestor and final checks. Local UID1000 originals remain
Root-readable and copied into separate private Root views. Mapping checks follow
the last mapping callback; owner-method bindings precede dispatch. Both inverse
routes reject conflicting input/output origins. The complete 77-record regression
now uses canonical NFS and DATA layouts and exercises all 11 copies and free
rereads. Source checks alone do not prove actual NFS or connected acceptance.


The isolated synthetic Root/NFS check now passes against these actual Parent
and projection sources. It exercises 66 projected inputs and all 11 terminal
outputs on the real mount, proves direct Root access refuses while the existing
UID1000 reader succeeds, rejects a mode0640 original, preserves all original
bytes/identities and geometry, and restores Root identity after each read. The
private Root views remain distinct mode0600 files. This is component evidence;
no Docker, application workflow or connected recovery acceptance was exercised.


## Worker file guard diagnosis — 2026-10-27

EH/EI passed the corrected terminal-copy path, including all 11 factual views,
then held at `worker-parent-final-file` before creating the observation worker.
The original terminal result and resume were not accepted. The reader remains
stopped; the native fixture is running and the fixture worker remains Created.
Independent target-byte, unrelated archive full9/hash and 24-table native
comparisons pass. All 19 protected operation-file facts match at the later
read-only comparison.

Later samples show changed timestamps for the native workflow database and DATA
directory, but those samples postdate the failure. They cannot identify its
original offending row. The Parent captures terminal facts under Writer and
consumes them after release; ordinary native work can then invalidate them.
The same facts are checked again through worker completion, terminal closure
and resume. Neither weakening the first guard nor adopting later facts resolves
that lifetime boundary.

The worker guard now retains bounded failure-time path SHA-256 and original and
current metadata, without paths or contents. Nested-pipe controls cover an
unchanged-byte timestamp change before worker creation and failure of diagnostic
output without replacing the original refusal. This is diagnostic coverage, not
a correction of the Writer-release exposure or connected acceptance. Preserve
EH/EI and use its original records; never replay or infer reader resume.


## Failure-time native drift — 2026-10-27

EJ/EK passes source preparation, then holds at `worker-parent-final-file` before
worker creation. The bounded failure-time path hash matches the fixture's native
`workflow.sqlite`; mtime/ctime changed while device, inode, size, mode, ownership
and link count remained original. This establishes the offending file for EJ,
not EH. The protected diagnosis confirms the observation worker was not created,
the reader is stopped, the native fixture is running and the fixture worker
remains Created. Independent target bytes, unrelated full9/hash and all 24
native tables match their baselines. No owning return or resume was accepted.

The source correction retains host exclusion on the original native Writer lock
after both post-release native observations through worker validation, ACK, child
exit and permitted resume. It neither refreshes terminal facts nor grants typed
Writer authority. A competing write before acquisition still refuses. Real flock,
owning leave-handler and resume/failure-cleanup controls exercise this boundary;
configured forward and distinct rollback acceptance remain required. Preserve
EJ/EK and prior held generations without replay.


## Btrfs completion-lock device identity — 2026-10-27

EL/EM held immediately after completion-lock acquisition. The retained trace
identifies the kernel-custody predicate; the original native/reader/worker states
are running/stopped/Created, and there is no owning return. Independent target
bytes, unrelated full9/hash and all 24 native tables match their baselines.

A private control reproduces the difference on the actual Btrfs filesystem:
fstat reports the subvolume device while fdinfo reports the superblock device.
The same check passes on tmpfs. The correction validates device syntax while
retaining exact original descriptor/path facts, inode, process, FLOCK/WRITE,
whole-file range and duplicate descriptor custody. Actual Btrfs contention and
release pass. Synthetic mismatched-device acceptance and malformed/foreign-lock
refusals join the existing descriptor reuse, unlock and cleanup controls.
This remains T012/T015 implementation work; no held attempt has replay or reader
resume authority, and configured forward/rollback acceptance remains pending.

## Unchanged intake persistence — 2026-10-27

EO/EP passed completion-lock acquisition, then held at the original workflow
file guard before worker creation. Only mtime/ctime changed. Native remained
running, reader stopped and worker Created; no owning return was accepted.
Independent target bytes, unrelated full9/hash and all 24 native tables remain
preserved. The exact historical writer is not proven by timing alone.

Source audit identifies a periodic no-op writer: expired intake samples rewrite
SQLite even when pause/reason are unchanged. The correction retains initial
records and durable admission transitions, including queue/storage hysteresis,
while returning fresh telemetry without rewriting unchanged decisions. Real
Store regressions exercise eligible ticks, exact database/namespace preservation,
changing free-space samples, reopen-based hysteresis and invalid pause refusal.
`make ci-local` now includes the workflow suite directly. Strict original facts
and refusal rules remain unchanged; legitimate writes in the handoff gap still
hold. New native workflow bytes require matching image/SDK proof before another
fixture. This is existing T012/T015 work, with no new task or runtime gate.

## Bootstrap startup contention — 2026-10-27

PR #541 merged with local and hosted checks, mirrored main, successful
publication, actual 180-module capture and all four installed-image cases.
ER installation verified all 27 outputs. ES completed native prepare-fresh and
initialize-bootstrap, then retained restart intent and a readiness refusal:
publication held, reason writer-busy, null census. The retained trace reaches
Creator.execute and Bootstrap.native; it does not identify the Writer or prove
that contention persisted. No recovery terminal or replay is accepted.

Bootstrap previously waited for unavailable HTTP but rejected the first
returned busy payload. The correction polls only unavailable HTTP and explicit
held/writer-busy/null-census responses within the original deadline and existing
64-call health budget. A fresh ready response is still required before schema,
source, role and catalog checks. Other holds remain immediate refusals. Owning
regressions cover eventual readiness, persistent contention, other holds,
unexpected census and deadline exhaustion with one restart. Native180/SDK103
bytes remain unchanged. This is existing T012/T015 work.

## Worker ingress deadline — 2026-10-28

ET Bootstrap completed against PR #542's frozen source, reusing ER's unchanged
27 installed outputs and the verified #541 native180/SDK103 proof. EU completed
SourceCohort and reached the owning archive call. Its retained failure trace
ends at `worker-original-ingress-deadline` after a worker protocol response was
validated. This proves accumulated deadline exhaustion, not which individual
stage consumed it. The read-only diagnosis confirms reader stopped, native
running, permanent worker Created and no owning return. Preserve the attempt;
there is no terminal acceptance, replay or resume grant.

The worker's 30-second clock starts before terminal-document preparation.
Each subsequent guard repeats physical closure, including scalar owner reads
that each recheck geometry, source and ancestry. Compare the complete synthetic
four-round exchange with actual Root/NFS metadata access before another fixture.
The correction reuses the existing owner metadata batch, retains scalar fallback
and repeats the same frozen batch after callbacks. Keep source bindings, exact
facts, protocol state, ACK and the original deadline strict. Benchmark and source
tests remain separate from configured forward/rollback acceptance.


## Complete ordering audit — 2026-10-28

The first synthetic Root/NFS comparison reproduced the original worker deadline:
the scalar baseline held after 30.14 seconds with 27.95 seconds in guards. The
batched candidate used 6.66 seconds in guards but held after 7.03 seconds because
the worker exited with its final response buffered while the Parent was still at
step three. Both cases preserved every source and synthetic NFS original. This
is measured refusal evidence, not a successful benchmark or configured recovery.
The worker now validates that bounded final frame before sealing the terminal
exit profile. All other pending-frame guards remain active, including the
original 30-second intent deadline.

The user requested an audit of the complete ordering, beyond the immediate hold.
The source review traces these boundaries and their owning controls:

| Boundary | Required order and evidence |
| --- | --- |
| 022 rename and metadata | Original preservation, unchanged-hash rename, verified reader move, then metadata and final reader/payload proof. `test_combined_publication` covers missing moves and lost rename replies. |
| 023 ordinary and retained delivery | Durable typed completion precedes cleanup; unknown replies reconcile original receipts without replay. `test_ordinary_import_continuity` and `test_publication_retained_finalize` cover lost replies, post-commit drift and unclosed terminals. |
| NFS and reader stop | Preflight and original active canary precede owning stop; exact stopped epoch precedes handoff. `test_nfs_factual_successor` covers changed roles, unknown stop ACK and late source/cleanup changes. |
| Backup and repair | Stopped reader, complete copy and isolated restore with database comparisons precede repair. `test_archive_backup_action` and `test_archive_parent_composition` cover late backup mutations and refusal before resume. |
| Producer and worker pipes | Challenge/birth/terminal/ACK and the four worker rounds retain original sequence, FD custody and absolute deadlines. New real-pipe controls cover partial, zero-progress, blocked, substituted and naturally exited peers. |
| Writer and terminal custody | The original Writer exclusion continues through terminal release, ACK, child exit and reader resume; failure releases only owned resources. Existing completion-lock controls retain this boundary. |
| Final reader resume | Claims and absence precede frozen metadata closure; a final raw absolute-deadline check precedes start. New late-claim/absence and consumed-deadline controls prohibit resume. |

The audit found and corrected post-callback FD/deadline write gaps, unbounded
native writes, NFS release waits that reset the deadline, the NFS pump's missing
post-guard deadline check, and the two resume ordering gaps. It does not grant
runtime acceptance. A fresh complete Root/NFS benchmark, matching native image
capture, accepted isolated forward and distinct rollback remain required under
existing T012/T015. Preserve EU and the first benchmark without replay.


## Superseded current-queue notes through FA2 — 2026-10-28

PR [#537](https://github.com/bolens/homelab/pull/537) delivered the NFS descriptor
correction with matching 180-module capture, SDK103 proof and 27 installed
controls. The four installed-image discovery/import/lost-reply/rename cases pass.
PR [#540](https://github.com/bolens/homelab/pull/540) delivered the directory-fact
comparison correction. PR [#541](https://github.com/bolens/homelab/pull/541)
separates input/output budgets and corrects terminal-copy path and owner routing.
EH/EI passes all 11 terminal copies, then holds at the worker's exact file guard.
The read-only diagnosis and all 19 protected operation-file comparisons pass.
EJ/EK's failure-time diagnostic identifies native workflow-database mtime/ctime
changes before worker creation. The correction retains host exclusion on the
original native Writer lock after the existing fresh observations through worker,
ACK, child exit and resume; all original facts and refusal rules remain strict.
Local real-lock and owning-handler checks cover ordering, contention, lost
custody and cleanup. Verify the corrected configured forward and a distinct
rollback before marking acceptance. EH's independent target/unrelated/native
comparisons passed. EJ's protected diagnosis confirms the same pre-worker hold:
native running, reader stopped, worker Created. Independent target bytes,
unrelated full9/hash and all 24 native tables match their baselines.
EL/EM then held at completion-lock acquisition because fdinfo's superblock
device differs from Btrfs fstat's subvolume device. The correction retains exact
FD/path facts, inode, process, exclusive whole-file lock and duplicate custody.
Actual-host contention/release, device-alias and foreign-lock controls pass. EL/EM
is preserved with reader stopped; target bytes, unrelated full9/hash and native24
remain original. Forward and distinct rollback acceptance still remain open.
EO/EP passed the Btrfs lock check, then held on workflow-database mtime/ctime
changes. Periodic intake checks currently rewrite unchanged decisions. The
correction persists initialization and admission transitions while returning
fresh telemetry without no-op writes. Real-store tick and reload/hysteresis
regressions cover this path. It changes native workflow bytes, so the next
fixture requires a matching published image and SDK capture. Preserve EO/EP;
its reader is stopped and no terminal result was accepted.
PR [#541](https://github.com/bolens/homelab/pull/541) is merged and mirrored;
main CI, publication, actual 180-module capture and four installed-image cases
pass. ER verified all 27 new controls. ES then initialized and restarted its
native fixture, but Bootstrap refused the first returned writer-busy health
payload. Preserve ES. Bounded startup health polling stays within the existing
deadline and call budget and still requires fresh ready evidence before catalog
checks. This host-only correction reuses the exact unchanged native/SDK proof.
PR [#542](https://github.com/bolens/homelab/pull/542) is merged and mirrored
with all PR checks passing. ET Bootstrap completed with exit 0. EU passed
SourceCohort, then held during the nested worker dialogue when the original
30-second ingress deadline expired. Its reader is stopped, native running and
permanent worker Created. No owning return or resume is accepted. Preserve ET/EU.
PR [#543](https://github.com/bolens/homelab/pull/543) delivers the ordering
corrections with passing hosted checks, publication, actual 180-module capture
and four installed-image cases. EX/EY still held at the original worker deadline;
preserve its stopped reader and all original evidence without replay. The earlier
pipe benchmark replaced continuous Docker checks and did not prove configured
timing. A read-only comparison measures the three future-second event queries
at 2.93 seconds versus 0.047 seconds with exact current-nanosecond cutoffs.
Correct that wait while retaining full original history, predicates and the
30-second deadline. Measure actual guard costs, including directory9 fallbacks;
keep omitted configured admission/closure work explicit. The next fresh checked
installation can reuse unchanged image/SDK proof. Forward and distinct rollback
acceptance remain existing T012/T015 work; no acceptance criterion is relaxed.
PR [#544](https://github.com/bolens/homelab/pull/544) is merged and mirrored with
all required checks passing. EZ/FA2 passes SourceCohort, then holds at the same
worker ingress deadline; preserve its stopped reader and retained helpers.
Read-only observer logs show birth and hello, followed by lost parent before
the observation request arrives. The transport repeats the complete guard for
each 4 KiB write, so the earlier fixed-count component benchmark omits work
that scales with encoded response size. The corrective host transport uses
bounded nonblocking writes, retaining every per-write guard and the original
deadline. Wide actual Round, short-write, readiness-race and mutation controls
are source evidence only. Configured forward and distinct rollback remain open.
See the [terminal-copy diagnosis](evidence-history.md#terminal-record-path-and-owner-routing--2026-10-27).

## Complete owner-read and worker timing proof — 2026-10-28

The complete Root/NFS component benchmark first refused four Tree ancestor
walks outside the bound owner reader. The shared correction routes all four
through that reader. The next benchmark then refused four synthetic child
factual records created by Root. Its constructor now assigns UID1000 ownership
to baseline, preparation and execute/terminal-history records and their stage
directory before capturing references or enclosing vectors. Root input controls
retain their owners. Frozen failed attempts remain unchanged.

With those setup boundaries corrected, the complete nested benchmark still
expired at the original 30-second intent cap. Consecutive-sibling initial
ancestor descriptors can be reused within one metadata call while retaining
every leaf's fresh no-follow walk, both closure passes and Root restoration.
That change alone did not establish sufficient timing margin. The prospective
policy aligns the ingress cap with the existing worker channel's 90 seconds,
while retaining the earlier original Parent/producer deadlines. The clock is
minted once before preparation and never refreshed.

A fresh benchmark under that policy completed in 40.61 seconds with 17 worker
guards, 66 projected inputs and 11 terminal views. It used actual owner reads,
read-only exact-role Docker observations, conditional source/retention/common-root
closures and private original pipes. Final source, input and geometry
preservation passed without secondary errors. Its genuine constructor/handoff
admission, plan13 fixture transition and actual container UID/process/mount
namespace remain omitted. This proves the measured component path, not an
accepted configured forward or rollback. Existing held readers and helpers
remain preserved without replay.

## Shared isolated forward and rollback — 2026-10-29

FH completes the genuine owning forward path against its fresh FI fixture.
The controller calls the Parent once, preserves its original completion reference
and returns `parent-complete`. The owning archive execute and independent terminal
both report `observed-forward`. The Parent verifies the selected worker observer
before terminal release and permitted reader resume. The permanent worker remains
inactive. Original custody, backup/isolated restore and NFS evidence are retained.

PR [#558](https://github.com/bolens/homelab/pull/558) corrects the shared reader
resume comparator for an unchanged empty gateway on an internal bridge. Both
consumers retain the original network, address, configuration and runtime checks.
All 1,911 recovery controls, local delivery checks, required hosted checks and
main publication pass. The frozen tested source is `a9ed4dcc`; merged
`ec16f636` has the same tree and is mirrored. The checked installation verifies
27 outputs and SDK103. Unchanged native #543 and worker #555 proofs bind all
180 native modules and 42 worker modules. The native image also passes genuine
discovery, first-import, lost-reply and rename-metadata cases.

Independent verification preserves both archive payloads, ZIP metadata and
compressed members, both reader records including references and progress,
six page hashes and the unrelated archive's full physical identity. The repaired
target matches the accepted terminal's exact signature and hash, including its
declared replacement timestamp. Repair intentionally changes that timestamp.
The original Writer-held preimage equals all 24 tables in the early independent
baseline. Applying only the selected size assignment reproduces the exact native
after-model digest verified by the genuine terminal and retained histories.

A delayed native sample differs in `jobhistory`. Its recorded scheduler runs
occur nearly twelve hours after owning completion, during the later authentication
gap. Retain that mismatch and its causal receipt. No table is exempted and no
claim of delayed database equality is made. The completion-boundary native proof
and archive/reader comparisons pass independent review.

The separate FJ fixture reuses the unchanged FH installation. Its explicit owning
rollback completes with `parent-complete` and `observed-rollback`, followed
immediately by protected original-record export. Strict native comparison proves
all 24 tables equal the original baseline. Independent causal verification proves
the exact 908-byte malformed pre-repair successor is restored, with its original
inode, access attributes and complete NFS ACL. Its pure inverse reconstructs the
complete 910-byte genesis and preserves member/compressed/page/XML inventories.
The unrelated archive's full signature/hash and both reader records, progress,
references and six pages remain unchanged. Independent review accepts the pair.

The first read-only rollback verifier stopped on a child `/config` reference.
The corrected verifier maps preparation, transition, genesis and candidate refs
through the exact original native bind, preserving every declared signature/hash.
The failed verifier and log remain retained; recovery was not replayed.

This closes feature 024 T012/T015 and feature 023 T026/T029, plus only the isolated
portion of T027. Live repair, retained-delivery ACK, whole-library/bulk and cleanup
acceptance remain open. Joined private acceptance receipt SHA256:
`4299406be2182f952170b58d847cdcb84378284fb9e276d4cec8019dd6a477fb`.
FH completion-boundary receipt SHA256:
`65e92d1403d6010b2667ae266da4d427b58083fff93f021866f76ba8f34cabb4`.


## Verified live rollout and data preservation — 2026-10-31

At T016 acceptance, the production native instance ran the reviewed #543 image at
`sha256:73b97153418f534850135eeaf1175e29a570c244d69bc0fa0a721441a53c37ea`.
A fresh coordinated affected-state backup and independent isolated restore
verify 12,343 files and all four databases before recreation. The operation
keeps Mylar stopped between that baseline and recreation, avoiding the prior
old-image restart and intervening data changes. Komga remains available, and
the permanent normalizer remains inactive.

The first created-container check held before startup because Compose's version
label changed from 5.6.0 to the installed 5.6.1. Its original failure and custody
records remain retained. A separately reviewed continuation binds that label to
the independently queried CLI version, rechecks the backup, source inventories,
all database models and the exact created container, then starts that same
container. It repeats neither backup nor recreation. All other configuration,
mount, command and runtime checks remain strict. The external deployment Writer
is released before ordinary native startup.

Docker health, publication readiness, workflow validity and all four enabled
queues pass. The installed UID1000 process uses Python 3.10.12. All 180 actual
native source modules match the published source map. The actual scheduler
source matches the reviewed job-management implementation.

Independent preservation accounts for all 27 affected scopes and all four
databases. Every business catalog table is exact, including 2,747 series,
16,473 issues and 145 annuals. Legacy tagger and maintenance database models
are exact. Native differences are limited to coherently paired scheduler-time
fields, with job names, multiplicity and stable fields preserved. Workflow
keysets and protected payloads are preserved. Its classified changes are 65
queued handoff/exhaustion timestamp refreshes, one advancing library-scan cursor
and the bounded 5,000-event log's 65-row oldest-prefix rollover. This is not raw
workflow-row or whole-database equality. Original rows remain in the verified
backup, and all differences are retained in the private comparison.

INI bytes are exact, with a startup timestamp change. The image selector differs
only at the intended assignment. Health telemetry changes only its check time
and two empty-queue observation times. All retained archive, target, import,
receipt, worker configuration and other affected non-log scopes preserve their
recorded content and access attributes. Original logs remain in the verified
backup. Every captured database and companion closes against its recorded full
physical signature and SHA256 before and after detached-copy SQL comparison.
Independent review accepts the native preservation conclusions.

The matching #555 worker image is bound at
`sha256:2f29b7ca0318d7d4098115546689b1f65d1c0c00180aed72cce7b8660ff6aa43`.
Its unchanged publication and actual 42-module proof remain valid. The worker
selector has a durable verified backup and independent restore. Exactly one
no-start, no-dependency recreation leaves the worker Created, PID0 and never
started. Mylar and Komga retain their exact runtime and network identities.
No worker process accesses or changes its bind-mounted application state.

The initial worker profile comparison held on Compose bookkeeping. Read-only
verification binds the unchanged replacement label to the original exact
project/service/instance labels, compares complete mount entries independent of
list order, and treats empty/null DNS arrays as equivalent only when the
corresponding Compose setting is absent. All other configuration and access
checks remain exact. The original held records remain retained. Neither worker
recreation nor startup is repeated. Fifteen private helper controls pass,
including complete-flow backup failure, peer restart and primary-error
preservation checks. Additional negative metadata controls reject foreign
service/instance/project identities, custom DNS, duplicate mount targets and
changed mount access. Independent review accepts the scoped result.

This closes T016. Configured repair, import ACK, current-library and bulk
acceptance remain under the existing T017/T018 gates. The permanent worker
stays inactive. No new archive fixture is needed to repeat the accepted isolated
pair.

Private native source/health receipt SHA256:
`756c50827d44a05153d36b5d7834c97d9b527dcfc89de5f951d8eaa91c445ca3`.
Independent postrollout observation SHA256:
`d2a7244c78d2d58093e58deff27610a66d8cea5b6d6f4c460f3d254701e18c05`.
Closed four-database reconciliation SHA256:
`89b3d79a86602342d2e24eb2eb8935665cea83a8235a7d639422b560dd4e18ef`.

Read-only worker binding verification SHA256:
`109b983a9bf03b33d19488382dfff52f82aab30842eb730408b8c11193694618`.
Joined T016 acceptance receipt SHA256:
`c5c07067c2f360ee33a349da0f5294c3f6f65bc7bae70c7d4b9b09d6dcf6a001`.

## Configured-admission rollout — 2026-10-31

[PR #562](https://github.com/bolens/homelab/pull/562) delivers configured-original
admission and the catalog-to-selected-original join. The actual published image
`sha256:50d0492ba2abe9947cf24fc3955dd08da1c2a7655bd9c4368d92ef1b693e502b`
passes all four installed-image cases without skips. Its temporary checker was
removed and absence verified.

The first stopped backup refused the newly selected archive's unproven exact
NFS metadata variant before creating a backup or changing the image. Mylar
recovered on its original container and image. The correction proves that
variant through synthetic backup and restore on the actual destination
filesystem. The complete backup scope, including both configuration selectors,
now passes metadata coverage before service stop. Strict stopped checks remain.

A fresh backup and isolated restore verify 12,344 files and all four databases
before the Mylar-only update. Independent checks verify health, publication
readiness and all 180 installed source modules. Komga remains unchanged and the
permanent worker remains inactive. The selected repair archive and all protected
retained payloads are unchanged.

Business catalog data remains exact: 2,747 series, 16,473 issues and 145 annuals.
Scheduler changes match the existing classifier. Protected workflow keys and
payloads remain intact. The comparison applies the existing advisory policy
before protected-key equality: 20 removed polling observations are advisory.
The retained evidence also classifies 65 handoff/exhaustion timestamp refreshes,
one advancing library cursor and a 65-row oldest-prefix event rollover. These
facts do not establish raw workflow-row equality. Configuration bytes and access
attributes are preserved; the selector changes only its intended image value.

Joined private rollout acceptance SHA256:
`183fd6b20f4db57425a675413863f5a8457465f9c3b0faeb6b8fdf218628088c`.

This refreshes T017's rollout prerequisite. T017 selected repair/import/ACK and
T018 current-library acceptance remain open. No production repair or bulk start
is accepted by this record.