CE2 whole repair after independent review01
Status: ACTIVE WHOLE REPAIR; NOT ARCHITECTURE GO. This document is the owning repair worksheet for all six findings, not a partial replacement verdict. The immutable reviewed packet01 and review01 remain historical inputs. Product source remains five defined effects/eighteen missing owning definitions. No positive hook, native effect, import, build or test is authorized by this worksheet.
Reviewed report: D:/projects/service-lasso/_audit/core1643-ce2-review-entire-architecture01-oct05-01/REPORT.md, SHA256 dfb780e28c0ce8dceb71e9bfdf66e8b4e88e175fb109d20a31c20cde4e9702e4. Review ROOT 498988f28452db9d3ece823ffb6c3678aeca36d561be64b94d106c695a2fd0fa. Custody PASS113406/0 does not admit the architecture. All six findings belong one new whole candidate.
Independent terminal options, neither selected
T1 retains ALL independently archived final native results crash-durable. Its positive constructor requires an independently admitted atomic effect-and-observation persistence facility, including actual native effect/result commit semantics, power-loss boundary, retained failure and source-qualified geometry. Existing file flush, rename, journal MAC, clock samples and observer archives are not that facility. No current source facility can instantiate T1. Source interfaces must leave T1 unavailable rather than manufacture a terminal ordinal. A compatible facility proposal would be a separate explicit authority and source-contract decision; T1 currently has no implementation path under supplied actors/resources.
T2 is a coverage amendment candidate. The durable prefix closes at the last original archive transaction whose bytes, flush, same-object readback, identity/exclusion and independent comparison are already observed. Those observations are prefix members only when their own results were retained before that transaction; the transaction's later readback/close and witness publication belong the LIVE suffix. The cut is an exact ordered set of original attempt/result ordinals, not a tick threshold or an omitted final-error rule. Prefix consumers check the original archive generation and exact committed interval; suffix consumers must use the original still-held source-native witness, not an unsigned restart file.
A T2 finite witness would require pre-enrolled read-only observer views, distinct producer-owned output slots and a source-fixed maximum suffix programme. Every suffix result carries its original task/object/IO/clock/source/attempt and output-definedness associations. A slot is never reused while any consumer retains a borrower. Publication does not claim crash durability. Loss of the original witness task/view on restart makes every uncommitted LIVE suffix outcome unavailable, including successful close or flush; restart may recover only the independently validated durable prefix. Failed, pending and unknown native effects remain individually represented. No restart reconstructs success from absence or a prior successful return. Exhaustion is checked before the next uncovered effect. The exact slot count and rounded occupancy must be derived from the complete suffix programme before this option is review-ready. T2 changes original ALL-final-results coverage and needs explicit selection; nothing here selects it.
Independent secrecy options, neither selected
S1 retains both original111 exclusions and original217 independently archived whole secret-bearing ledger equality. No currently supplied source mechanism satisfies that conjunction. Redaction, encryption, secret digests, null successful-byte fields, or a new HMAC domain do not instantiate it. S1 remains unavailable, with the incompatible Journal field inventory retained.
S2 is an independent confidence amendment candidate. Original product-native Journal validation remains full-frame and under the existing provider/Journal lineage. The existing aggregate artifact remains the exact artifact originally required, with no changed preimage or invented direct digest of an excluded field. Independent evidence covers actual nonsecret returned-byte partitions plus original object/task/IO/clock/source/native-status custody; it expressly does not establish independently archived full secret-frame equality.
Classification is source-fixed at the actual writer/reader codec before capture. Raw ResolveKey/idempotency key inputs, keyMappings.keyHMAC, authentication credentials and confirmationId are noncapturable, including a digest or reference that imports their bytes. Existing required capsule/artifact signatures are not automatically secrets merely because they look like MACs. Journal syntax, field boundaries and nonsecret fields remain observed individually; adjacent equal classes are merged only after exact boundaries are known. Unknown codec/boundary/definedness denies capture and retains the attempt without inventing initialized output. The full native validator must associate the same actual held Journal frame, current slot, provider version and byte-count with its validation result. Independent partition evidence cannot stand in for that product validator. Recovery revalidates actual held slot bytes and lineage; a past aggregate or partition manifest cannot authorize a new slot. The changed confidence and affected111/217 clauses must be explicitly selected before any mixed-secret positive proof producer. T and S are independent; either selection cannot grant the other.
Finite native programme repair selected for the next proposal
The current source retry loops are counterevidence, not finite programmes: platform.hpp getrandom79, pread161, pwrite164 and StorageLock231; channel.hpp transfer146–147 and EOF293/319 retry EINTR/EAGAIN/timeouts; Windows message read and transfer repeatedly wait/query incomplete IO. The next candidate will replace indefinite polling with one source-owned readiness/completion wait per entered IO attempt using the SAME original remaining end, followed by one actual completion query. A ready notification followed by EAGAIN, EINTR, zero-progress non-EOF, or IO_INCOMPLETE ends that attempt as failed/unresolved; it does not renew a wait or the end. This is an explicit interruption/completion chronology change requiring whole review, not an already implemented compatible path.
Positive byte-progress loops are bounded by their actual initial byte total B: each successful native call consumes at least one previously unconsumed byte. Therefore at most B successful progress calls, plus one terminal failure or the separately required original EOF read. This bound does not use ceil(B/65536). Each call additionally counts its exact original task/peer/deadline/SDK observations. For Windows, one pending operation permits one wait, one completion query and, on failure/expiry, one cancellation attempt plus one completion query; an operation still pending after that query retains its original IO/backing/event/cell/root and unknown outcome. It cannot be logically closed or freed. This finite path bounds entered calls, not elapsed kernel completion or positive resource retirement. Retained unresolved objects prevent further use until an independently specified owning recovery or process lifetime ends them.
No zero-byte readiness timeout is silently retried. Lock acquisition likewise has one native acquisition attempt under the applicable original end; contention ends admission rather than an unbounded retry. Close is once-only, including EINTR/unknown-close; no second close targets a potentially reused descriptor. Cancellation never supplies new transaction/audit authority after original acceptance expiry. These private failure-order changes and their complete original-route negatives must be assessed together with all23 effects; no loop edit is permitted ahead of the whole decision.
Remaining closure ledger for this same repair
F3: bind the above recipe to every exact native callsite, including capture/worker/peer lifecycle, source importer/build, provider, storage, materializer, audit/index, observer and error retirement. Derive per-operation entered-call maxima and simultaneous rounded ownership; UNKNOWN sampler/kernel/SDK terms are not zero.
F4: specify an original Node-compatible inflate adapter preserving actual16384 chunks/spare/concat/native-close-before-concat/error and reserve-before-inflate chronology, or one explicit material chronology amendment. The selected full validation then replay remains prospective; replay-only allocation/read/cancel/expiry failures need exact mapping. Native replay byte equality cannot waive them.
F5: complete actual source-private producer/importer, TLS and immutable CA, UTC, image/source/qualification, preentry allocator and same-Core runtime borrower contracts. SourceBuild629291219 bank plus642914483 minimum bank/arrays is not a complete peak, grant or geometry. All archive/output/history/kernel/stack/failed owners need actual source-defined simultaneous occupancy.
F6: complete eighteen owning definitions and their transaction/recovery/outbox/selector/materializer routes after the architecture gate. Audit17 and current frame/outbox contain no UTC timestamp. A signed durable UTC index must obtain actual timestamp authority and preserve all existing Audit preimages; eventId, monotonic ticks and unsigned metadata cannot replace it. No temporary all-denial constructor or declaration counts as full delivery.
SDK homogeneous classifier/carrier arithmetic was resolved by review01. Current measurement9-to-geometry8 dispatch, NOACK bootstrap, SDK section/envelope, special OW trustee and U64 history coordinates stay unchanged. Historical failed formats remain immutable. This worksheet is incomplete until every closure item has a concrete whole source interface and programme; it is not a new review freeze or completion claim.
R4 concrete adapter proposed for the whole repair
The next candidate uses the SAME source-built Core isolate/context and original source-carried node:zlib inflateRawSync, with exactly {maxOutputLength:Math.max(1,expandedBytes),info:true}, on a source-owned immutable original compressed member window. It does not replace processChunkSync with a direct-zlib cursor or guessed native status adapter. Original zip.ts73 reserves cumulative expandedBytes before original member allocation. Stored entries still perform original Buffer.from copy. Deflated entries retain the original engine and decoded.buffer; engine.bytesWritten must equal original compressedBytes before exact size/CRC/hash validation. Original AdmissionArchiveError is rethrown; other original zlib exceptions map to archive_unsafe. Fatal process allocation termination cannot become a recoverable exception.
Exact retained Node source processChunkSync performs writeSync, original error/kError checks, input/output accounting, original output slice publication, maxOutputLength check and native close on exceeded limit. A full output creates another actual16384-byte bank even when it becomes the final spare. With multiple outputs, original native _close occurs before Buffer.concat; empty output returns original FastBuffer; one output returns its original slice. No early custom concatenation, zero-copy output substitution, omitted spare, altered native-close chronology or earlier CRC is allowed. Every chunk/slice/engine/state/spare/concat/native failure owner remains charged until its actual physical lifetime ends; JavaScript return or clearing references is not retirement. Source-carried input/output/engine allocation hooks must therefore exist before invocation.
The representation repair is explicitly MATERIAL: after complete original central-order ZIP validation, CRC/count/hash and final local-contiguity pass, the original expanded member outputs may end only through producer-owned physical retirement with zero actual borrowers and complete native error/observer handoff. The immutable compressed snapshot and validated member metadata remain held. Later policy/hash/authoring/emission replays the same original member through the same original inflateRawSync adapter and verifies original identity/source bytes/member/count/CRC/hash again. It repeats cumulative algorithm observations but must not reserve another persistent expanded-inventory entitlement or fabricate a second quota grant; actual replay allocations are newly charged physical extents. Before/after full source re-read and true EOF are additional original IO when needed, not an assumed digest receipt.
Replay-only IO, allocation, expiry, cancellation or native close failures deny the pending owning use and retain its actual state. They are not recast as a previously successful first-pass outcome, successful emission or accepted materialization. Existing decoder zlib errors remain archive_unsafe; a failed original held-stage/source association retains its existing stage/native failure class; original deadline failures preserve the applicable deadline outcome. This adds possible failures and work absent the eager reference and changes persistent expanded-output allocation lifetime. The whole review must explicitly assess that chronology amendment together with all23 public outcome mappings and protected regressions. No public cap/language change is proposed, but success-byte equivalence is insufficient to call the eager and replay journeys identical.
Required prospective cases cover zero/single/multiple chunks; exact-full final spare; output-limit exceed before concat; close failure; trailing compressed bytes; invalid CRC after successful inflate; central/local order mismatch before first policy; replay-only native read, allocation, cancellation and deadline failures; retained prior successful RegExp subject and caches; original chunk/concat old-new overlap; zero borrowers with actual backing still live; and capsule append/readback followed by failed byte-bank retirement. Actual source phase equations include previous context subjects/cache and every retained chunk or failed replay owner. This adapter proposal closes the intended source API choice, not its early hooks, physical peak, amendment approval or implementation.
A1 source-contract investigation and exact authority constraint
Actual Blueprint97 already requires an independently held fixedID-to-frame offset/digest index updated with the frame using a journal-style selected generation transaction. It does not define a new timestamp-bearing Audit17 body or authorize arbitrary index bytes under SLCORE-AUDIT-1. Actual Journal outbox and nativeReceipt are closed8 and5 fields; nativeReceiptDigest is an existing opaque original native receipt association, not a timestamp supplied by the caller. Current native source has no digest preimage/schema/producer for that receipt, nor an index transaction constructor. This is a missing source contract, not proof that unsigned metadata is sufficient.
A concrete candidate to assess is an original product-native index receipt carrying the original UTC observation, fixed event/frame offset/digest, source-native append/flush/readback/index selection evidence and its actual index artifact association; the existing acknowledged Journal receipt digest would commit that ORIGINAL complete native receipt. This would leave Audit17 and all five HMAC preimages unchanged, provided the exact existing Journal validator accepts only its already-selected native receipt field and the actual original receipt constructor proves the index/UTC lineage before acknowledging it. It cannot sign arbitrary index bytes by invoking the Audit provider on another body. A supplied hash or unsigned sidecar cannot instantiate the constructor.
This candidate still requires exact complete original private receipt grammar, its digest derivation and native object association, UTC source/SDK definedness and conversion, index generation publication/recovery and all23 acknowledgement chronology. In particular premutation/attempt events have null operationId and cannot be forced into AUDIT_ACK's mandatory operationId request; their genuine ENSURE/index publication must itself finish the required original durable association. An already acknowledged operation event must replay the same original UTC/index/frame association, never recapture another wall-clock time for the same event. Native UTC uses original GetSystemTimePreciseAsFileTime/CLOCK_REALTIME observed task/clock raw bodies, with actual reversal and unavailable state retained; it asserts observed system UTC, not NTP accuracy or monotonic order. Index event order remains original frame generation/offset, never sorting by mutable wall-clock values.
Until the full original receipt/index/Journal acknowledgement contract is concrete and independently reviewed, this route is an investigation rather than a selected A1 producer. The owning repair must either complete this compatible existing-authority route or retain precise source counterevidence and a complete explicit amendment alternative; it cannot fabricate UTC/index authority from nativeReceiptDigest's syntax.
Original storage primitive programme decomposition
The new proposal must distinguish source-visible SDK calls from kernel/vDSO entries and helper-local pure work. The following is a concrete prospective replacement spine, not a claimed bound for current helpers or an SDK occupancy measurement. Linux held regular identity has one entered fstat. The repaired Windows identity spine has GetFileType, three GetFileInformationByHandleEx calls (attribute tag, full FILE_ID_INFO, standard information), and one source-qualified caller-buffer NtQuerySecurityObject OWNER query; it uses actual source-pure SID formatting rather than ConvertSidToStringSid/LocalFree. The NtQuery exported function lease is acquired during preentry and retained, not repeatedly resolved from a mutable module. Its security/query result stays subject to actual NTSTATUS-specific definedness and private SDK80 recording. Every original identity check therefore has five source-visible Windows SDK attempts on its positive path, plus actual deadline/peer checks where required; this does not count hidden SDK/kernel work as zero.
A Linux regular child acquisition uses one parent fstat, one openat and one child fstat; directory creation additionally uses one mkdirat before openat. No EINTR retry is permitted in the proposed spine. Windows leaf conversion uses two original MultiByteToWideChar calls and one retained NtCreateFile export invocation followed by the five-call identity spine. Desired rights/share/options remain the exact original actor-specific tuple. Source-pure UTF8/NUL/path checks and fixed OBJECT_ATTRIBUTES setup are distinct from entered native acquisition. A failed child validation keeps its acquired handle in an original pre-enrolled cell, and once-close/error history is additional, never hidden in destructor cleanup.
An original positioned Linux read attempt is one pread; positioned Windows read is one SetFilePointerEx followed by one ReadFile only when seek succeeds. Windows positioned write is the same seek plus WriteFile and denies actual partial output per the current helper contract. Linux pwrite positive partial progress consumes original bytes and may continue under the B-bound above; first error/zero ends. Flush is one fsync or FlushFileBuffers, with directory identity separately counted before directory flush. True EOF is a distinct nonzero-capacity positioned read, not a zero-size request or end offset arithmetic. Once-close is one close/CloseHandle; failure retains the exact cell disposition and may not retry.
Publication's fixed spine is original root check; original deadline; exclusive scratch acquisition; scratch identity; actual original chunk writes; original deadline+file flush; complete same-handle readback including true EOF; scratch identity; original deadline+root check; actual rename; original deadline+directory identity+flush; root check; retained original scratch identity; original published-name acquisition; reopened identity and original scratch identity; complete reopened readback including true EOF; final original deadline. Linux rename additionally reopens the old name and compares its original object before one renameat/renameat2. Every temporary bound/reopened object has its own once-close or retained-borrower path, including failure before rename and uncertainty after rename. Replacement publication and no-replace materialization stay distinct. This enumerates actual storage.hpp phases without pretending shared_ptr/vector retention has physical ownership.
Directory traversal needs a separate source-owned finite record programme. Current Linux fcntl/fdopendir/rewinddir/readdir/closedir and Windows FileIdBothDirectory* APIs are not a complete source/kernel count proof. The new candidate must keep exact original native returned lengths and full128 object identifiers, source-fixed dot/dotdot uniqueness, maximum admitted child count and duplicate/case-alias rejection before each further traversal. A repeated ignored dot record cannot form an unbounded successful loop. Native directory cursor state and every partial/EOF/failed result remain original objects; a separate regular held StorageLock owns exclusion. A finite name count must not be relabelled a finite number of hidden libc native calls.
These source recipes supply the primitive terms for the all23 programme, including source-fixed pure SID/DACL and raw security variants. They do not yet close sampling/lifecycle, mode AccessCheck, provider/TLS, observer archive suffix, index or complete effect composition. Current source retains its older implementations until the new entire decision is reviewed; no count here is offered as current native fit or executed evidence.
Actual Journal/provider transaction multiplicity
Current NativeJournalCommandState::selected constructs TWO distinct one-use provider connections, one selector verifier and one Journal verifier, then NativeJournalStore::readSelected performs the held lock/census/slot/selector/Journal validation. Those two original verifier transactions cannot be folded into one or mistaken for output signing. Current NativeJournalStore::publishNext then constructs SIX further distinct provider transactions: old selector verification; old selected Journal verification; new Journal signing; new selector signing; published selector verification; published Journal verification. Thus a command doing selected followed by one publishNext has EIGHT actual provider transactions before any operation-specific key/capsule/Audit work. The earlier wording of two signing transactions names only signing roles, not the whole entered transaction count.
Each publication retains old selected slot/selector, original canonical next payload, original prefix/frame, scratch publication, actual inactive/published reopen, original published verifier IO and their independent error/closure history. Two random scratch identities are generated before the two publications; their actual entropy attempts and failures are counted, not given unbounded getrandom EINTR retries. Slot/selector original handles and both write/readback handles close once; replacing a pathname or resetting a provider unique_ptr does not prove those original IO/backings retired. Exactly one publication invocation has no internal retry after uncertainty; recovery uses a new independently admitted original owning operation and reselects actual state.
The all23 matrix must compose these actual shared programmes, rather than counting a single generic 'journal transaction': OPEN/READ_OPERATION/LOOKUP_PREFLIGHT/RESOLVE_KEY current read helpers use selected; mutating rows may require selected plus the six-transaction publish programme; read-only stage/assets/discovery do not gain phantom publications. RECOVER counts each actually eligible transition separately and cannot iterate until success or reattempt an uncertain native mutation. Its row traversal bound starts from actual closed arrays:64 versions;4096 each reservations/stages/preflights/capsules/keyMappings/operations/writeIntents;8192 outbox;128 resource/evidence references per applicable row. These schema caps bound traversal records, not native calls or successful physical retirement. Every per-row provider/read/identity/closure recipe still requires explicit composition and source-qualified rounded history occupancy.
S2 source-fixed classification contract to assess, still unselected
The complete candidate classifier dispatches on a source-owned codec role, never an arbitrary caller path/key name or a general 'MAC-looking' rule. The Journal role is exact service-lasso.source-admission-journal.v1 validated canonical bytes under the original held slot/provider lineage. Its excluded values are every keyMappings[i].keyHMAC and preflights[i].confirmationId. Current schema caps each array4096, so this role has at most8192 disjoint excluded value spans. Each value span covers its actual encoded JSON string token (including quote/escape bytes); the original grammar constrains keyHMAC to64 lowercasehex and confirmation to original sac_ identity. The classifier records offsets during the SAME complete original parse/encode and checks them against the actual returned window, not by searching matching substrings. A secret appearing elsewhere in unknown/duplicate/malformed fields cannot be treated as a valid Journal or safe partition.
For the raw original request/provider codecs, exclusions are source-owned exact value extents: original idempotency raw-key request/derivation bytes, original idempotency MAC response, private confirmation value, and actual authentication credential value. Length/framing/version/status may be separately defined nonsecret fields only where the original codec gives their real offsets and the privacy clause permits them; they are never concatenated into a fabricated whole original body. RESOLVE_KEY's originalRawKeyOffset is an actual retained request-window coordinate, not a persisted key reference. Credential-bearing HTTP original capture uses the authenticated original Request's codec/field boundaries; unknown or aliased original fields prohibit capture rather than trusting a caller's redaction map. Native keyset/ProtectedKeySet/key material is never a byte-evidence source. Provider responses for the other four existing artifact domains retain their normative artifact proof status; an idempotency MAC is not declassified by sharing the provider endpoint.
For a validated Journal, source-fixed complementary nonsecret extents preserve order, exact returned offsets/counts and independently observed bytes. At most8192 excluded spans yield at most16385 merged alternating classes. Adjacent same-class ranges merge; ByteView uses explicit U32segmentCount and exact offset/length/class fields. The resulting maximum framing is4+16385*9=147469 before actual safe payloads. This is distinct from the ONE-entry homogeneous security descriptor maximum. The observer compares only actually defined nonsecret ranges of the SAME original returned backing, retains full native requested/returned counts and actual status, and never substitutes retained file mapping bytes for the syscall destination. Secret backing remains product-native and charged, including aliases, pending IO and failed buffers; the classifier does not erase or retire it.
Under S2 only, the existing mandatory successful LEDGER whole-count/aggregate artifact is produced by the original product-native full-frame validator. Its source/private result must bind exactly the original frame object/window, full actual bytes, current slot/generation, provider key version, selected Journal identity, full schema/MAC validation and original attempt. No hash is recomputed from redacted or concatenated extents. Independent archive declares nonsecret partitions as its actual coverage and does not claim it verified the full secret-bearing aggregate itself. A native validator failure, provider/version mismatch, unresolved read/EOF or source-image/custody failure leaves the aggregate assertion unavailable. Returned known partial bytes on a failed call are represented by their original partition-definedness and status, not a successful ledger projection. Unknown/unentered/pending attempts do not receive fabricated aggregate SHA or zero-byte data.
Recovery repeats native full-frame validation on the actual original currently selected slot. It may reuse only a genuine retained exact original event/receipt with the SAME complete native object/frame/index/UTC lineage; prior secret partition offsets or a digest cannot approve different current bytes. Consumer dispatch must distinguish full independently archived nonsecret artifact equality from S2's product-native full Journal aggregate plus independently archived partitions. This changes original217's whole raw confidence for those precise Journal frames; original111 direct secret exclusion remains. No S choice, declassification, new primitive field/nullability/domain or blanket encryption exemption is implemented or inferred.
Auxiliary UTC carrier for the next whole candidate
The reviewed kind3 clock association remains the exact D1request/CE2admin authority record. It is NOT a UTC body, and no REALTIME/FILETIME bytes are projected as the public clock operation MONOTONIC/QPC. The next whole candidate therefore proposes exclusive private SDK03 recording (SLOSDK03/version3, SAME90-byte enclosing shape and typed nine original references), preserving exact SDK80 security body and adding the following two SOURCE-owned variants. SDK02 remains immutable review01 history, not a permissive fallback in this proposed new dispatcher. Public primitive11/operations1..23/profile/Audit17/five MAC domains are unchanged. SLOENV02 still has exactly two contiguous sections; SDK03 lives in its existing SDK section, not a third section or tenth association kind. This is a private source codec proposal requiring whole review, not an implemented reader or positive UTC factory.
SDK03's state byte is0notEntered/1pending/2returnedKnown/3retainedUnknown. The enclosing knownness byte describes actual completion disposition, not a fictitious native scalar:1 exactly for state2, otherwise0. Unknown/unentered/pending bodies are only the selected variant octet. Tag80 retains its actual NTSTATUS scalar in the known body. A VOID UTC call has NO encoded return scalar and NO invented BOOL/error. Header objectCell resolves the original sampler task/process object; IOcell is0 for this synchronous non-IO call. Original API/source/task/clock references resolve genuine enrolled native leases, never a name or supplied UTC claim.
Known SDK81 (Windows GetSystemTimePreciseAsFileTime) body is U8tag81; U64originalNativeSystemApiLease; U64originalTask; U64originalClock; U64originalBeforeMonotonicAttempt; U64originalAfterMonotonicAttempt; U8outputDefined; if outputDefined1, U32outputExtentBytes then exact ByteView. All five U64 references are mandatory actual original lease/attempt ordinals, with task/clock equal the enclosing fields. outputExtentBytes is the actual allocated destination extent sizeof(FILETIME) from the qualified SDK/build, not a returned byte-count claim. ByteView covers exactly the source-defined dwLowDateTime/dwHighDateTime extents, with any genuinely undefined ABI padding class0/no bytes; no blanket initialized-memory capture. Returned supported API output is retained in the SAME originally supplied native destination. The callable source/API lease and SDK contract establish returned output-definedness; a missing/mismatched original API/build cannot create this known record. No GetLastError value is attached to this VOID API.
Known SDK82 (Linux clock_gettime(CLOCK_REALTIME)) body is U8tag82; the same five mandatory U64 references; I32actualReturnBits; U8errnoDefined with U32actualErrno only if1; U8outputDefined with U32outputExtentBytes and exact ByteView only if1. The qualified original int representation must be4 bytes for this source codec. Actual return0 has errnoDefined0/outputDefined1; actual return-1 has errnoDefined1/outputDefined0; any unsupported return disposition is retained unknown, not coerced success. outputExtentBytes equals the original destination sizeof(timespec) under the genuine source-carried libc/kernel/ABI. ByteView captures actual source-defined tv_sec/tv_nsec field extents, not guessed16 bytes or unwritten padding. errno is captured immediately from the original calling task's TLS before a further SDK operation can replace it. No retry or fallback clock is selected.
Before/after ordinals name genuine pre-enrolled original sampling attempts, not wall-clock-derived monotonic values or on-disk forward ORefs. They resolve native held attempt cells and are serialized only after that complete original relation exists; an unresolved after sample may retain the genuine UTC SDK output but cannot construct usable index/TLS time authority. Both auxiliary records borrow original raw output/frame owners through exact independent observation/archive handoff. Conversion reads only original defined fields, checks actual source ABI/endian/epoch/range, emits the existing24-byte UTC RFC3339 projection and checks Gregorian/offset arithmetic without a locale/environment default. It does not mutate time, derive eventId from time, certify external synchronization, or grant a clock-domain/end. Native timestamp order may reverse; original frame generation/offset determines event order.
Primary source bodies retained outside immutable packet01: D:/projects/service-lasso/_audit/core1643-ce2-source-author-working-oct05-01/original-utc-api-source/SOURCE-BINDINGS.json. Microsoft API HTML52358 SHA256c7415f73fd557038e6ebbfb811268045891845cea1fdaffda7cacea26b96d8a4; Linux man-pages HTML30379 SHA2567d7948bcf8400a786c2795b24e8da979d6e01610f7b8ea6bf1ab97f06205fb69. Microsoft precise system UTC API documents the output and VOID return. Linux clock_gettime API documents REALTIME, discontinuous changes, native return/error and possible vDSO implementation. These read-only API bodies establish source choice, not actual observed UTC, an imported/qualified SDK, native API image authority or native execution. Two attempted OpenGroup documentation GETs returned403 and were not treated as qualified sources.
Whole repair must reconcile SDK03 dispatch, before/after/source/native cell lifetime and all UTC/index/TLS consumers coherently in its full candidate. Existing entrypoint's reviewed SDK02 describes historical packet01; SDK03 proposal is pending the NEW whole review, with no compatibility reader or execution granted from this worksheet.
Independent original signed stage metadata selection
The existing approved read-selected Journal path can implement scoped stage metadata selection independently of the unapproved positive native owner/observer/importer joins. Add an engine-only move-owned OriginalStageJournalSelection, retaining the complete originally selected Journal and an exact bounded stage-row index. NativeJournalCommandState::selectOriginalStage(command,deadline) accepts only existing LOOKUP_STAGE, requires OPEN and resolved state, checks original provider/workspace, reads the complete original selector+Journal through the existing two provider transactions, finds exactly one id, checks the original actor/provider/workspace, and performs the original end check before returning. Unknown scope/id uses existing Denied11; malformed duplicate/source-state uses existing failure semantics. Client identity remains the originating stored client, not an additional current-client idempotency partition.
This concrete source helper is not a LOOKUP_STAGE response implementation, a native read capability, admission wrapper, archived receipt, recovered writer grant or new resource. Its selected row accessor borrows its own retained full Journal value, never a pointer into a destroyed local selection. Written/sealed response production still requires genuine live NativeStageRead ownership and final EOF/receipt/release joins. Retained rows cannot be squeezed into the five-state wire without an exact reviewed disposition. The actual helper's existing Json/default allocation remains the known physical-owner integration gap; it does not claim native physical ownership or release from C++ lifetime. No positive constructor, source authority, new operation or proof fields are selected by this helper.
Complete command ownership and transaction join inventory
This is the complete 23-command source inventory for the repaired whole candidate, not a claim that 23 owning implementations exist. Exact request/result grammar remains native-channel.ts and command.hpp. The constructor must retain ONE original Journal store/key-provider association, qualified catalog/four original asset leases, held stage/capsule/services/Audit/index roots, original native observer/archive, original current Core runtime, source clock/task/domain/end leases and complete same-owner physical arena. Those are typed original native resources, not caller booleans/digests/callbacks. Missing authentic runtime admission leaves activation unavailable; missing source constructors/types remains engineering work.
| Op | Actual source producer/effect and required owning joins | Native success publication |
|---|---|---|
| 1 OPEN | Existing selected selector+Journal, exact profile/workspace/current version; no initialization | Existing generation/version, then opened state |
| 2 READ_ASSETS | Originally admitted catalog identity resolves four retained original objects; exact full read/EOF/hash/readback and observer relation for each; input strings remain original IO views | Four ordered bounded original byte bodies and genuine receipt; never catalog row hash as receipt |
| 3 RESERVE_STAGE | Scope/catalog/declaration, all reservation aggregates, original UTC expiry, retained new exclusive stage file and exact creation/observer relation; publish complete next Journal | Original stage id/expiry/quotas/declaration digest and actually selected generation |
| 4 WRITE_STAGE | Original stage writer owns exact offset/body, same-handle byte readback; final original HTTP EOF digest, complete native reread/EOF/flush and observer receipt; stage row transition after actual results | Empty success only after corresponding original storage and Journal publication |
| 5 PREFLIGHT_SEAL | Original stage read session receipt and complete binding join, qualified catalog/namespace, genuine expiry source; no JS digest authority; retain actual confirmation privately | Original preflight/binding digest and durable selected generation |
| 6 PREACCEPT_INTENT | Existing exact preflight/stage/sealed capsule and full Audit17 binding; idempotent exact original pending premutation outbox | Existing empty result after selected or actual next Journal publication |
| 7 AUDIT_ENSURE | Original event/body identity, Audit chain/index transaction, native UTC association and genuine original observer/product receipt; no operationId fabrication for premutation | Original generation/payload SHA/actual byte count/native receipt digest; no unsigned index time |
| 8 ACCEPT | Consume original one-use key-resolution ledger slot and exact confirmation/preflight/sealed capsule/premutation receipt; immutable original operation lineage; native UTC projection | Actual replay disposition, selected generation/digest and full operation projection |
| 9 WRITE_INTENT | Original accepted operation/capsule, held services root and independently observed target absence under genuine writer exclusion; durable original intent before any candidate mutation | Original selected generation plus genuine absence receipt |
| 10 MATERIALIZE | Original intent/capsule namespace/held capsule/services root; complete NativeMaterializationTree creates, writes, native mode/readback/discovery/no-replace rename/final reopen and observer chain | Actual state/evidence scoped to original attempt; no rename-status-as-identity |
| 11 DISCOVER | Original materializer/final directory and reopened file object joins; bounded complete names, mode/bytes/EOF/hashes and native observer identities, no requested inventory projection | Strict sorted original inventory rows and genuine full discovery digest |
| 12 OUTCOME_PENDING | Actual original materialization/discovery outcome/evidence; exact bound Audit17 body and operation projection; native UTC for completedAt; pending outbox transition | Original projection remains pending original Audit acknowledgement |
| 13 AUDIT_ACK | Actual ENSURE frame/index/UTC/receipt generation joins matching original outbox and operation; durable next Journal acknowledgement | Selected generation and original finalized projection; no caller receipt shape acceptance |
| 14 READ_OPERATION | Existing selected Journal exact actor/id/full projection validation | Existing canonical original projection |
| 15 RECOVER | Original selected Journal and every live pending intent/outbox/stage/capsule object reattached under original native writer exclusion; real discovered namespace/capsule/Audit/index before transition; never retry uncertain rename | Actual records/pending/unknown counts and selected generation, preserving unknown resources |
| 16 CLOSE | Original command resource association, all stage/capsule/materializer/Journal/Audit/channel IO/borrower/native attempts; selected terminal alternative determines archive scope; no destructor retry or GC charge retirement | Actual state/digest; unresolved close stays unavailable, transport close cannot replace resource receipt |
| 17 CAPSULE_CHUNK | Original preflight and qualified namespace/capsule builder; exact ordered native bytes from existing frame, same-handle original append/readback and observer join | Empty result only after original chunk effect; no offset advancement before actual readback |
| 18 CAPSULE_SEAL | Full original namespace/capsule read/EOF/schema/canonical preimage/signature append/flush/readback/provider closure; byte-phase retirement after actual op17/archive joins, metadata/source leases stay held | Actual capsule id/digest and durable sealed row; signature alone cannot grant namespace |
| 19 RESOLVE_KEY | Existing original actor/provider/workspace/raw key codec/current+retained versions, one actual provider transaction per version, full mapping lineage; original raw bytes wiped without pretending physical retirement | Existing miss native one-use ledger slot or actual mapped operation |
| 20 LOOKUP_STAGE | Implemented original signed metadata selection plus required live original NativeStageRead session reattachment/borrower producer for written or sealed state; recovery must prove original writer exclusion | Exact metadata and genuine session handle/native object digest; never reconstructed capability from Journal digest |
| 21 READ_STAGE | Original session/native reader object/ordered offset/end, exact actual response window retained before NAPI exposure; actual zero-byte EOF plus final complete original read receipt | Inline original bytes and final receipt only after real EOF; no companion HANDLE transferred to Core |
| 22 RELEASE_STAGE_READ | Consume exact live session once; zero pending IO/response/raw byte borrowers plus actual archive/effect handoff and once-close outcome; retain failed last borrower | Actual closure state/digest, no logical map erase or function return as retirement |
| 23 LOOKUP_PREFLIGHT | Existing selected Journal exact actor/provider/workspace/preflight/binding/consumed operation joins | Existing original private confirmation/binding/receipt reference and selected generation |
For every row, Journal selection is the actual TWO provider transactions already mapped above. A real transition uses SIX further publishNext provider transactions; their roles must not be collapsed into a single generic provider step or counted twice when the same selected value is moved through one handler. Zero-transition idempotent/replay paths retain their actual selected-read programme. Recover has a source-bounded traversal over the exact capped arrays, but each row's reattachment/discovery/Audit/index programme must be instantiated before a finite entered-call maximum can be asserted.
Stage metadata states are not a new public enum: existing wire0/1/2/3/4 describe reserved/uploading/written/sealed/expired. Current Journal additionally carries retained. Retained must preserve its genuine unresolved custody and yield existing reconciliation/unavailable denial; it cannot become expired, written, missing or a successful read-capability response. This is an exact response disposition to include in the whole source candidate, not a sixth wire state or deletion of retained data.
WRITE_STAGE EOF is distinct from READ_STAGE native EOF and provider/channel EOF. The final upload command carries the original HTTP collector digest but does not itself prove the original HTTP EOF; owning ingress producer supplies that association. READ_STAGE response metadata and inline body remain retained under the actual response window/NAPI borrower until the consuming Core snapshot has copied and observed the exact original bytes. RELEASE cannot be made positive merely because a JS finally block invoked it. Current controller parseStage always executes release in finally, so failure precedence and retained earlier parse/native failure must be explicitly preserved in the future coherent implementation, not hidden by a manufactured release success.
These contracts expose the remaining concrete production definitions rather than hiding them behind a universal denial. No missing effect is counted implemented, and no new positive trust/owner hooks are authorized by this inventory ahead of the entire six-finding architecture repair review.
Source-exact read/readback programme expansion
The following expansion is obtained from current platform.hpp/protocol.hpp source, not a measured SDK/kernel count or a new runtime grant. Let C be one actual Deadline.check programme (current Windows four named sampling calls, Linux three), R one entered readAt (Windows SetFilePointerEx then ReadFile, Linux pread), I the complete actual identity programme, F one actual file flush, and W one entered writeAt programme. C does not secretly include a peer/domain/lifecycle check: current Deadline.check only samples/checks its recorded clock tuple. Those owning sampler/domain/peer programmes remain separate repaired interfaces and cannot be charged as zero merely because current code omits them.
NativeReadBuffer successful construction is reserve/resize, C, R, actual-count validation/resize, C. Its exact direct-call word is C R C. The destructor's wipe/vector swap/Budget.closed is NOT a native IO/control/borrower retirement proof; failure after the first sample or actual read must retain the entered output/attempt relation under the proposed native owner before memory can physically end. Maximum destination is nonzero and at most65536 even for true zero-byte EOF.
For readback(file,expected=B), let n be the actual count of successful positive native reads. For B>0, 1<=n<=B, not ceil(B/65536). The source success word is I (C R)^n R I I C: first full object identity, each positive read with its precheck, then a separate one-byte EOF read, then TWO separate post identities due to the two source identity(file) expressions, then final end check. The success helper therefore has n+1 C, n+1 R and three I programmes. For B=0, it has I R I I C with a real one-byte EOF destination. On mismatch/early EOF/first read error/first post identity mismatch the actual executed prefix ends; a later identity/sample cannot be fabricated to fill a success trace. Sha256/memcmp/source arrays are source effects with real stack/working memory and no synthetic native-return capture.
For readBounded(file,max), actual success word is I (C R)^n R I C. It has two I programmes, n+1 R and n+1 C; zero-length original files still execute the real EOF read and final identity/check. Its returned whole Bytes allocation and stack tail byte are distinct physical resources, not freed because an outer parser consumed a digest. Current Budget.reserve(before.bytes) is logical and lacks a complete original native allocation/retirement join.
For writeComplete(file,B), let q=ceil(B/65536) source outer chunks and n be actual positive readback count. Success word is (C W)^q C F followed by the readback word above. On Windows current W is SetFilePointerEx/WriteFile and requires the full requested result. On Linux current W may perform many positive pwrite calls, with at most the original requested byte count positive progress calls; EINTR currently retries without a source finite bound. The proposed first-entered-error-ends repair eliminates only the retry tail for the NEW candidate; it changes interruption/failure chronology and is not a fact about this current implementation. Every actual short positive pwrite remains a separately enrolled attempt before the next effect.
Likewise current Linux R repeats EINTR within readAt, so the finite n+1 R invocation bound is not a finite native syscall bound today. The repaired candidate must replace that exact callsite recipe coherently and include actual first error/result/errno/failed-output ownership, rather than append an outer timeout. Original IO observation/archive/independent comparison adds its own source-exact read/flush/readback/cut programme to each actually entered call and is not included in these product helper words. Stack65536 readback chunk remains a real original task-stack overlay; sizeof locals does not certify full ABI/spill/SDK stack geometry.
A1 concrete existing-authority receipt/index proposal
The next whole candidate proposes one exclusive private receipt codec service-lasso.core-audit-index-receipt.v1 with EXACT20 keys: schema,eventId,keyVersion,profileDigest,workspaceIdentityDigest,providerId,keySetId,auditGeneration,indexGeneration,payloadSha256,payloadByteCount,signedFrameSha256,frameOffset,frameBytes,utcIso,utcObservationRef,auditObjectRef,indexObjectRef,transactionRef,observationRef. No permissive union, extra timestamp in Audit17 or changed provider preimage is proposed. Original eventId remains sae_ plus32 random hex. Profile/workspace/artifact hashes remain exact lowercase64; source-owned identifiers and frame key version use their existing bounds. Generations and offsets are canonical checked U64 decimal strings; actual byte counts are JSON integers under their existing frame/payload bounds. utcIso is the existing exact24-byte UTC projection produced from actual qualified SDK81/82 defined fields, not a caller claim. The five reference fields are exact2-key ownerOrdinal/memberOrdinal canonical U64 native ordinal associations. They resolve actual held original owners/members and exact source-coded object/UTC/transaction/observation kinds; parsing these numbers does not manufacture an original lease.
The product receipt constructor is private to the original Audit/index transaction owner. It requires the real original Audit frame readback/body/MAC/chain/EOF, fixed event and payload identity, actual frame offset/count/SHA, original index generation/object/entry publication and the native UTC observation acquired for THIS event. Its observationRef scopes the independently observed results according to the explicitly selected terminal/secrecy alternative; it cannot claim unselected ALL-final crash durability or independent mixed-secret equality. The receipt's canonical original bytes are hashed with ordinary SHA256 to supply the EXISTING nativeReceiptDigest field. This is a new explicit private artifact codec proposal, not a sixth HMAC domain or signing arbitrary receipt bytes under an existing domain. The full canonical receipt backing and actual native associations stay held through Journal commit/response/archive handoff; a supplied digest is never accepted as the constructor.
Index creation is staged under the original held index root using the existing journal-style inactive-slot/selector transaction model already required by Blueprint97. Its source-defined entry names the same exact event, original frame offset/length/SHA, original UTC and full receipt artifact association. A new index artifact's independent integrity authority at rest is the existing selected signed Journal outbox.nativeReceipt.nativeReceiptDigest, committed by the original native ENSURE producer after actual index/frame publication and verification. Neither an unsigned index selector nor a decoded receipt supplies that authority. The selected Journal receipt must match the original canonical receipt bytes and exact current held index/frame associations; a mismatch, lost receipt object, missing original index generation or unresolved original append remains unavailable/reconciliation, never reconstructed success.
AUDIT_ENSURE may therefore perform the existing outbox pending-to-acknowledged Journal transition for premutation/attempt events with operationId null, without forcing a fictitious operation through AUDIT_ACK. Existing journal-schema.hpp permits acknowledged outbox rows with null operationId for those phases. For operation events ENSURE may likewise commit the genuine receipt; AUDIT_ACK separately joins that existing exact original receipt/outbox/operation and performs only the permitted operation-projection transition. A completed projection cannot be produced until original writePhase verified and the corresponding completed outcome acknowledgement exist. A decoded five-field ACK must not override a differing native receipt or repeat UTC capture.
Idempotent ENSURE rereads the original selected signed Journal receipt, original held receipt/index artifact, complete original Audit chain and the exact event's frame. It returns the SAME original UTC/receipt identity only after all real associations still validate. It neither appends another equal event nor samples a replacement UTC for the old event. An interrupted append before index/Journal commit preserves actual pending native state and native writer exclusion. Recovery may rediscover the exact original frame and finish a pending original transaction only while genuine original object/receipt/time/custody survives; it cannot invent a missing timestamp from frame offset/eventId/now. Lost original UTC/index receipt requires truthful unknown/reconciliation and prevents a positive ENSURE/ACK.
No new universal Audit-history quota is guessed from outbox8192 or frame size. A selected invocation traverses the originally held finite file extent L under its independently qualified original source/native storage owner. The existing outer outbox bound is a simultaneous Journal-row bound, not proof of lifetime frame count. Exact frame minimum from NativeAuditBody encoding is114 bytes (key version1 and payload1 are conservative grammar lower bounds); therefore a valid retained chain has at most floor(L/114) frames, with each full validation's exact read/provider/EOF/identity programme added. An invalid chain stops at the actual failed prefix and retains its entered attempts. L, actual index/receipt backing capacity, resident index pages, SDK/kernel/history/failed owners and append-growth reservation must be genuine pre-enrolled owner facts with checked actual-source programmes; an arbitrary supplied L or remaining memory does not become a grant. This is source/interface engineering still needing full geometry and different entire review, not a measured bound or implemented producer.
Original NAPI and stage response failure/lifetime joins
Current native-binding.cpp has three distinct events: native worker completion, main-thread response publication, and eventual external-buffer finalization. complete() currently ends original work BEFORE constructing or resolving the response. napi_create_external_buffer then transfers the NativeOwnedBuffer pointer to finalizeBytes, whose delete is not an observer-qualified physical retirement. NativeAdmissionChannel.request decodes a BinaryReader over that external buffer; BinaryReader.raw returns an aliasing subarray. For READ_STAGE the result.chunk therefore retains the original native result backing beyond the request decoder. Hash.update and chunk.copy returning cannot establish that V8, the external backing or every original borrower has physically ended. Job input/result destruction, napi_delete_async_work, abandoned(), zero outstanding count and a finally block remain separate source events with distinct failure and lifetime obligations.
The next whole candidate must retain an original response owner across native dispatch, NAPI exposure, exact response grammar/end validation, Core consumption and actual observer handoff. The original queue token may end concurrency bookkeeping at worker completion, but it cannot authorize RELEASE_STAGE_READ or CLOSE while response owners remain. Each real entered NAPI call has its own result/status and source allocation/exception effects: promise creation, resource-name string, async-work creation, queue, callback completion, object/string/property/freeze or external-buffer publication, deferred resolution/rejection, work deletion and finalization. A queue failure must retain any genuinely created work/reference/backing whose destruction outcome is unknown. No count of operations1..23 bounds V8/libuv's original internal allocation or worker/task lifecycle; those programmes and rounded controls still require source-qualified producers.
Existing request sequence remains exclusively NativeAdmissionChannel's sequence. A response owner does not acquire a new sequence authority, operation or public receipt field. READ_STAGE's final response must preserve actual inline bytes, real native EOF and genuine final receipt while the original response backing survives. Every subsequent owning command, including RELEASE_STAGE_READ, must be refused or retained unresolved when original response/IO/observer borrowers are still outstanding. A copy into the complete compressed snapshot adds a distinct simultaneously charged allocation; it is neither lossless ownership transfer by itself nor evidence that the source backing ended.
Current controller.ts parseStage catches archive/policy failures and maps their original public AdmissionError, then unconditionally awaits releaseStageRead in finally. A thrown release or returned state1 replaces an earlier exception under JavaScript finally semantics. The corrective contract preserves TWO independently ordered outcomes: the original parse/read/policy/allocation/deadline result, followed by the actual release attempt/result or its unresolved failure. Earlier failure remains the primary cause and retains its existing public classification; secondary release failure must remain privately available with the same original session/resource association. If parsing succeeded but release failed, no ParsedStage may escape as usable and the existing reconciliation/unavailable disposition applies. Neither an aggregate exception that erases the original class nor a fabricated state0 is compatible with that contract.
The private retention owner must exist before entering this path, retain thrown values without enumerating/serializing their potentially secret properties, and independently retain the actual native session/response/observer disposition. An Error.cause, WeakMap, dropped local error or logging callback is not that original owner or durable proof. Undefined/null thrown values are genuine possible failures and require an explicit failure-presence state rather than a truthiness sentinel. Release is entered once only under its original remaining authority; an expired/poisoned channel may reject before native entry, which must remain UNENTERED rather than a native close failure. Release failure cannot renew the deadline, reopen the session or erase the first result.
Required source vectors are parse success/release success; parse failure/release success; parse success/release state1; parse failure/release state1; parse failure/release throws; thrown undefined/null; malformed release response; response decoding failure before release; original channel poisoned before release; EOF receipt failure after complete copied bytes; NAPI queue/create/exposure/resolve/delete failure; delayed finalizer with live subarray; and abandoned callback with actual pending native IO. All remain UNEXECUTED. This completes the concrete ordering and borrower obligation for the whole repair; authentic retention constructors, actual source hooks and handler definitions remain unfinished, and no T/S alternative or positive retirement producer is selected.
Actual production preentry counterevidence and replacement boundary
Current core-image.cpp enters main and constructs vector/string argv before InitializeOncePerProcess, MultiIsolatePlatform::Create(4), V8 initialization, CommonEnvironmentSetup, linked binding, production program string, LoadEnvironment and SpinEventLoop. There is no original native physical-owner acquisition before those allocations. Current captureDeadline calls sampleOriginalClock BEFORE originalAdmissionOwner; originalAdmissionOwner itself remains undefined. Therefore neither this first sample nor the existing embedding entry is a qualified CE2 preentry owner. Moving a Budget accessor earlier inside main would still omit loader/CRT and earlier native-library state and cannot repair the original preentry boundary.
The proposed replacement must join the independently qualified original launch/image/loader/CRT/native-owner facility before the first attributable allocation and sample, retain the exact failure state through startup, and use that SAME owner for argv, Node/V8/platform/libuv/OpenSSL/runtime and ordinary production API lifetimes. Authentic B owner/qualification/PACKET acquisition remains independently before A; input decoding cannot approve its own owner. Exactly four platform workers in current source is only a requested constructor argument: actual helper/worker births, stack/TLS, failure partial-startup, event/control allocations and native termination remain separate source programmes. InitializeOncePerProcess early_return/errors, failed setup, empty LoadEnvironment result, Stop, Dispose and TearDown each retain their actually entered prefix and original failure/retirement outcomes, never inferred successful cleanup from process return.
Current build-core-image.mjs is source counterevidence for complete producer custody: it imports filesystem/crypto/module APIs and resolves/reads esbuild metadata before any original source-build owner, imports esbuild, performs path-based source reads through onLoad, builds, then separately lstats/rereads metafile inputs and writes generated files. A post-build pathname SHA cannot establish the exact originally compiled source window or its before/after object/borrower custody. Version equality, builtins-only import checks and required entry membership remain useful source predicates; none supplies early tool/dependency/native/allocator ownership, same-original input equality or producer qualification. The actual source-built importer must consume the already independently held and ALL-byte-compared original archive bank, carry complete genuine compiler/tool/source/qualification associations through every entered action, and preserve original failed/partial output. SourceBuild642914483 remains a lower bound BEFORE those original producer/output/kernel/stack/history/SDK owners; no existing stage/capsule quota or arbitrary remaining memory grants them.
These are concrete unresolved F3/F5/F6 source callsite joins within the same all-six-finding repair. No substitute entry, new launcher privilege, allocator fallback, TLS authority, compiler execution or positive source constructor is introduced here. Whole02 is not freeze-ready while these source producers and independent T/S consequences remain unresolved.
Exact endpoint and peer programme continuation
native-connect.hpp currently has additional unbounded loops outside channel.hpp: Windows CreateFileW/ERROR_PIPE_BUSY/WaitNamedPipeW5 retries forever under end checks; Linux connect pending/error branches poll5 repeatedly and retry EINTR. The next whole candidate uses at most TWO original Windows acquisition calls: first CreateFileW, and only on actual ERROR_PIPE_BUSY one original WaitNamedPipeW under the SAME remaining end followed by one second CreateFileW. A failed wait, second busy result or other error ends this connection attempt. Linux performs one socket, one connect, and only actual EINPROGRESS one poll plus one getsockopt(SO_ERROR); initial EINTR/EAGAIN and readiness timeout/error end the attempt rather than authorizing another wait. These are explicit chronology amendments, not current-compatible runtime facts. Each result retains original error/TLS/defined output and its real acquisition cell before any peer authentication or once-close. No renewed end or logical destructor retirement follows.
authenticateUnixPeer's direct positive spine is getsockopt(SO_PEERCRED), pidfd_open, first processBirth, open exe, verifyImageObject, procText maps, each actual map-file acquisition/identity/selected image validation, second processBirth, and OriginalPeer.alive poll0. Each processBirth separately executes procText stat; the two invocations are not cached as one proof. procText currently opens a pathname and performs read4096 until true EOF with unbounded EINTR retries; it must join the first-error-ends programme and retain actual proc/task/image associations and EOF before any text consumer. For source maximum M, positive reads are at most M, plus one EOF or failing read, since each positive read consumes at least one byte and size overflow ends immediately. This invocation bound does not prove stable proc contents, native syscall/helper internals, or custody of a prior image after task change. stat uses existing65536 and maps1048576 bounds; no new cap is proposed.
Every maps row is parsed, including nonexecuting mappings; rows with nonzero inode cause a real map_files open and identity even when duplicate or executable-image equality later avoids hashing. Number of actual rows is bounded by retained text bytes, never merely mappedLibraries.size(). The anonymous executable vdso/vsyscall exceptions remain the exact current source predicate and require their own original native-image/ABI qualification; their labels cannot grant source trust. Source offsets for maps/stat text, parser streams/strings/set nodes and each duplicate acquired object are real simultaneous owners. A map-file or proc read failure retains the actual acquired prefix; no invented successful completed enumeration is emitted.
authenticateNamedPipePeer's fixed positive prefix includes selected client/server PID query, OpenProcess, GetProcessTimes, OpenProcessToken, TWO GetTokenInformation calls, actual SID conversion, QueryFullProcessImageNameW, original image open/identity/hash/EOF, EnumProcessModulesEx, and GetNativeSystemInfo. The first token-size query's expected failure and required count must be observed as its own native status/defined output, not a successful empty query. Current sidText's SDK allocation/conversion/free programme remains distinct from the prospective source-pure security-owner formatting selected for identity; one replacement cannot silently remove another caller's original SID work. Each actual module row performs GetModuleFileNameExW and original open/identity before duplicate/executable skipping; selected unique libraries add their full image validation. Current1024 HMODULE capacity bounds returned module cells, not hidden enumeration/kernel work or complete mapping authority.
The subsequent VirtualQueryEx scan needs its OWN actual qualified address-range/ABI programme. Current code enforces positive RegionSize, nonoverflow and next>address, so source-visible successful queries consume at least one address unit; their maximum is the checked inclusive originally observed maximum-minus-minimum-plus1, with one terminal failure on a failed scan prefix. This is a finite but potentially enormous source bound, not a capacity grant, page-count assumption or claim that every region belongs to a source-qualified image. Actual map churn, SDK/kernel observations, retained query output/clock/peer attempts and task lifetime must still be independently resolved. OriginalPeer.alive then adds WaitForSingleObject0 and GetProcessTimes on Windows; Linux adds poll0. Every channel pre/post alive invocation counts again under its exact callsite, never one cached peer check for the whole transaction.
verifyImageObject has success word I (C [NativeReadBuffer C R C] C)^n C [NativeReadBuffer C R C for EOF] I. Thus its direct deadline-check invocation count is4n+3, its original reads n+1 and identities2, with 1<=n<=the actual nonzero original image extent. C remains an actual sample programme and does not include absent sampler-domain/peer/archive work. The native-read constructor's resize/allocate and EOF destination, Sha256 state, source strings and full image-body attempt history remain real resources. Hash equality plus current before/after identity does not instantiate mapped-library source custody or the complete native archive producer. Failed prefixes stop at their actual first failure and retain genuine output-definedness.
All endpoint/authentication success and failure words additionally include the real original clock, independent observer/capture/archive/compare programmes and once-close of acquired token/process/image/module/proc/channel objects. Current automatic local Handle destruction and admitted RetainedStream enrollment do not establish that every partially authenticated local object is retained before loss. Unknown close or birth/image/owner mismatch remains unavailable with exact original custody. Full all23 finite eligibility stays NO_GO until this spine, provider/bootstrap/TLS/importer programmes, original peer/worker births and complete rounded stack/TLS/kernel/SDK/history/native borrower occupancy are coherently instantiated. No code loop is edited or native call entered by this worksheet.
Exact original provider and transferred-input source programmes
This continuation binds CURRENT provider-session.hpp, provider-protocol.hpp, key-provider.hpp, channel.hpp and original-input-lease.hpp. It is counterevidence and a concrete composition prerequisite for the SAME six-finding unit; it does not implement the proposed per-frame Windows transport, authenticate an importer, select T/S or give geometry values. The unchanged domains, original provider64/companion80, SDK03/81/82 proposal, SLOENV02/header136 and Audit17/ACK/nativeReceiptDigest contracts remain separate.
For requestProviderSignature, let B be the actual original body length, v the actual retained version byte count (1..64), and q=ceil(B/65536), with q=0 when B=0. The source emits one BEGIN body of14+v bytes, q CHUNK bodies of13+p_i bytes, then one END body9. Each independently authenticated frame adds36 bytes. Total source wire payload is B+49q+95+v; the maximum capsule B67145545 has q1025 and v64, giving67195929. There are q+2 sendProviderBody invocations, one readProviderResponse, one originalProviderResponseBoundary, one final Deadline.check and one channel.close on the successful client path. Each chunk additionally has its own pre-send Deadline.check. Connection acquisition/authentication/greeting is outside this helper and counts for EACH of the existing separate Journal verifier/signer transactions.
CURRENT Windows sendProviderBody reserves67195929 on FIRST BEGIN, appends every framed body to providerMessage_, and only on END moves that allocation into NativeIo for one message write. No earlier per-frame WriteFile occurs. readProviderMessagePiece then consumes the same original message across4-byte headers and bounded frame destinations, requiring MORE_DATA until the final END boundary. The proposed reviewed per-existing-frame replacement must change BOTH sender and receiver boundary predicates coherently: each frame's real message end is required, while parser END remains the sole application request end. Merely removing providerMessage_ would make the current receiver reject BEGIN at providerBoundary_. Response stays one original message. Linux currently transfers each header/frame on the stream, then performs shutdown(SHUT_WR) after END and separately observes real request EOF on the server; it cannot inherit Windows message-end semantics.
The actual per-frame CHUNK construction has simultaneous logical capacities65549 (caller Writer),65585 (transport Writer) and65629 (providerFrameMac Writer, body+80), subtotal196763, BEFORE rounding, stack/crypto/string/control/native ownership. In requestProviderFileSignature, the filled original65536-byte NativeOwnedBuffer also survives the send, giving262299 before those terms. Its NativeReadBuffer fill window has already left its source scope before CHUNK construction, but that scope exit is not qualified physical retirement; unresolved/window/history owners still add their genuine occupancy. CURRENT Windows additionally retains the67195929 request assembly throughout the maximum CHUNK construction. Current Linux additionally copies the completed transport frame into a separate Bytes before transfer, after the MAC Writer's scope has ended; its exact phase differs. These are phase-specific capacity expressions, not interchangeable sums or a native fit assertion.
On the current server receiveProviderBody MAC phase, header4, frame65581, returned body65549 and providerFrameMac capacity65629 coexist:196763 before rounding/controls. After this helper returns, ProviderRequestReader.consume independently validates the SAME frame MAC again; its MAC Writer ends before Reader.raw allocates the signing chunk. Body65549 and parsed chunk65536 then coexist until the caller wipes/swaps body. This duplicate original verification is real source work, not one cached signature. For one successful request with q chunks, server receive+parser perform2(q+2) transport MACs; client send performsq+2; response producer and client verifier add2, for3q+8 across BOTH distinct original tasks, in addition to the original artifact-domain streaming HMAC. This pure call count is not a native SDK/kernel or crypto stack bound.
serveProviderSignature first receives/parses BEGIN, retains the selected version/parser, then signStream enters receive once per actual CHUNK and once for END. END invokes originalRequestBoundary BEFORE signer.finish and respondProvider. After responding, server originalProviderPeerClosure precedes channel.close. Windows must observe actual ERROR_BROKEN_PIPE from the server read after the client closes; TRUE/zero is a zero-length message, not EOF. Client waiting for server close before its own close would deadlock the selected ordering. Linux request EOF is already observed and server peer-closure helper only enters its actual clock check; it adds no fictitious second peer EOF. Both current boundary/completion loops still contain the unbounded retry tails identified in this worksheet; finite q cannot bound them. The next candidate first-error/single-wait programme must cover each exact boundary and retain the real initial/completion/cancel/close results before declaring entered-call finiteness.
ProtectedKeySet construction is separate from every signing request. For EACH selected existing version it acquires the original child object, validates identity and actual access, and reads the original key object. Windows also performs GetSecurityInfo, GetSecurityDescriptorControl, GetAce, EqualSid, LocalFree and CryptUnprotectData with actual returned output length/definedness; successful DPAPI output is wiped and LocalFree'd. Linux requires the original root-owned0600/32-byte object and actual bounded read. Their SDK allocations, failure-before-wipe paths, key/map/string nodes, original handles and final retirement need original native-owner enrollment before entry. DPAPI, DACL or a key version string cannot approve the provider realm. signStream has actual positive progress bounded by B, with an additional END invocation and parser sequence cap; original idempotency alone adds a separate complete B<=392 backing and full validation before finish. Other domains never acquire that raw-key buffer. No capture of raw keys/idempotency MACs is introduced.
OriginalInputObjectRead is an IO component receiving a transferred Handle/identity/length/SHA/Budget; its constructor executes current() identity validation but does NOT authenticate those arguments. For n actual positive reads of a B-byte regular input, readOriginal success word is I C (C R C I C)^n C R C I C, where C/R/I retain the definitions above. Direct counts are n+2 identities,3n+4 deadline-check invocations,n+1 readAt invocations, including an actual1-byte-capacity EOF read. n=0 is required for B=0; otherwise1<=n<=B. The constructor's prior I is additional. The consumer callback is genuinely entered n times and its own code/allocations/failures must be concretely bound by the authentic importer, never counted as zero or assumed harmless. OriginalSnapshot additionally allocates the complete B bank BEFORE this read programme, overlaps its active bounded returned read window, and retains originalEof_ after return. Complete SHA equality is not the required independent ALL-byte comparison of that SAME bank against the independently immutable source.
readOriginal's catch sets unresolved_ for its actually failed prefix; no subsequent success or EOF may be fabricated. closeOriginal currently checks only unresolved_/closed_ and attempts original_.close: it neither checks the retained EOF borrower nor provides observer/archive/history custody. A true return is a current local handle result, not source authority, native borrower retirement or terminal durability. NativeInputReadObservation similarly returns identity/SHA/count only. The positive importer must privately join independent producer AND offered packet admission, actual immutable original object/returned bank/comparison, source/build/qualification and original constructor/borrower owners before any such result becomes usable. No public approved-wrapper constructor is inferred from these current argument types.
Actual native source search contains NO HTTPS/SSL verifier or owner-decision/PACKET importer implementation. The existing realm document's SSL_get0_param/X509_VERIFY_PARAM_set_time/immutable CA choices and detached B-before-A ordering therefore remain prospective source contracts, not actual callgraphs. Their source-qualified socket/DNS/HTTP/TLS partial-read/verification/error/lifecycle and original observer archive suffix programmes are still missing. An honest complete entered-call/rounded geometry equation cannot replace those absent terms with0. Likewise current provider parser/control buffers and unresolved allocations lack genuine native-owner/capture constructors. These precise missing definitions remain F3/F5/F6 work; whole02 is NOT freeze-ready, and no merely renamed source label or available authentication digest repairs them.
Original OpenSSL entered-call counterevidence for B HTTPS
Fresh generic FULL raw reads/SHA256 and genuine Git blob framing/SHA1 comparisons bind FOUR original Node22.23.2/OpenSSL3.5.7 source bodies, with4 PASS/0 failures in D:/projects/service-lasso/_audit/core1643-provider-owner-programmes-oct06-01/ORIGINAL-TLS-SOURCE-BINDINGS.json (SHA2568d509bd2b2124b2efc465125a5a8d18e0521458d5afd4cccb4b6802292409733). Scoped semantic inspection covered ssl/ssl_lib.c, ssl/statem/statem.c, crypto/bio/bss_sock.c and ssl/record/rec_layer_s3.c. Complete original raw/source closure remains the earlier held source; this is not a fresh75551-association audit, build/SDK qualification or native HTTPS run.
Original SSL_connect -> SSL_do_handshake -> original handshake_func/state_machine is not one native IO. state_machine loops between original reading/writing submachines until finished or its actual NBIO/error prefix. SSL_read_ex calls ssl_read_internal and coerces negative internal return to public0; ssl_read_internal may finish initialization/handshake and dispatches the method read, or enters the original asynchronous job branch when configured. SSL_write_ex -> SSL_write_ex2 -> ssl_write_internal likewise coerces a negative internal return to0. Thus a public0 cannot be treated as original EOF or supply actual errno/output-definedness. SSL_get_error -> ossl_ssl_get_error consults the original ERR_peek_error queue, selected BIO retry state and actual connection shutdown state; the producer must associate this classification with the SAME task's original entered operation before other OpenSSL work alters that state, while separately retaining the underlying native error. Source/body hashing or a later error-string projection is insufficient.
The original socket BIO's sock_read clears socket error, calls readsocket (or its enabled KTLS record path), then updates original retry/EOF flags. sock_write can use KTLS/TFO/sendto or writesocket according to the actual compiled source/mode. BIO_sock_should_retry queries the real socket error; BIO_sock_non_fatal_error expressly includes EINTR, EAGAIN/EWOULDBLOCK, EINPROGRESS/EALREADY and platform variants. Therefore the worksheet's first-entered-native-error-ends rule cannot be implemented solely as an outer SSL_ERROR_WANT_READ/WANT_WRITE loop: original BIO/error/record/handshake callsites and compiled KTLS/TFO/ASYNC/QUIC/mode branches must be bound or excluded by the original qualified source/build, without pretending they are absent. No new build-flag selection or native backend is made by this observation.
ssl3_read_bytes invokes the original record-layer read_record method, may process up to SSL_MAX_PIPELINES already pending records, and has multiple goto start paths for empty/alert/fragment/handshake processing. Its consecutive warning-alert counter resets on an original nonempty nonalert record. A consecutive-alert limit therefore does NOT bound a whole connection's records/native reads; nor does the eventual64KiB decoded decision-body bound include handshake/certificate/encrypted/alert/post-handshake traffic. Returning one positive application byte can include additional genuine original BIO/native progress and crypto allocations. Complete finite programme must enroll each actual original ciphertext/native read/write and handshake/record transition under a source-fixed finite owning programme BEFORE entry; original internal crypto, certificate/store/session/error/TLS/stack/control/output borrowers and actual immutable CA/source/native API leases all coexist as their real phases require. Those programme/geometry terms are presently UNKNOWN, not one call or zero.
Original SSL_shutdown explicitly returns0 for incomplete shutdown and may require another invocation; its public0 is not completed TLS close. The source-owned producer must independently retain TLS close-notify/result, actual final native socket read/EOF, HTTP exact framing/decoded body, once-close and failed/pending ownership. Neither HTTP chunk terminator, Content-Length completion, SSL_free nor a native close boolean establishes all these relations. B's fixed repository and comment reads each occur before AND after offered-object verification according to the realm candidate; every real HTTPS acquisition and its UTC/peer/source/error/archive programme counts separately, with no cached successful transport substitute.
Protected source vectors required for the eventual actual B implementation now explicitly include EINTR/EAGAIN at the original BIO boundary; WANT_READ after nonapplication progress; original error queue contamination; negative-internal/public0 read and write; SSL_shutdown0; actual TLS close-notify without native EOF; native EOF without complete HTTP body; nonempty records resetting consecutive-alert count; original post-handshake processing during application read; enabled build/mode branch mismatch; original UTC setter without genuine before/after association; CA/source/image mismatch; and failure of the second repository/comment read after complete packet comparison. These are prospective meaningful original-source vectors, UNEXECUTED and additional to the retained protected matrix. Authentic B-before-A/preentry owner/importer/capture/observer constructors and the complete finite native programme remain missing. No TLS success, SOURCE_GO, T/S selection or whole02 freeze follows from4 source-body custody passes.