Core1643 shared original native physical owner

Status: moving CE2 source architecture candidate, not an approved positive owner implementation. This decision supplements CORE-ORIGINAL-OWNER-REALM-AMENDMENT-PRECODE.md. The accepted CE1 and D1 frozen decisions are retained unchanged. The clock54f2/03, NQ R3 and O2 proposals remain independently scoped inputs; none creates the missing primary owner by declaration.

Original domains and eligibility

The landed parser/stream-copy predicate is 134217728 bytes per Core instance. Stage-declared compressed reservation aggregate167772160 and capsule aggregate1073741824 are separate storage predicates, not extra resident parser allowances. The literal parser predicate does not bound the entire ordinary Node image. CE1 nevertheless requires the same admission owner to account for its parser/copy, metadata, captures, runtime and IO overlaps before parsing. This proposal therefore records two classifications under one owner: admission-resident extents subject to the existing134217728 ceiling, and ordinary runtime/image/startup extents with independently finite original source/calibration associations. An extent used by admission is never excluded merely because allocated by Node, OpenSSL, an SDK, or a global object. No second parser arena, residual quota or new ordinary-runtime numeric grant is selected here.

Eligibility is conjunctive: the independently admitted original baseline producer, the exact external owner-approved offered packet and its original object leases, the original profile/grant/calibration/qualification/source/initialization associations, and the actual consumer image/lifetime. An arena reservation, pointer, process owner, ACL, provider MAC, catalogue row, commit or GitHub account is not an approval. The original runtime resources remain absent. Source acquisition and physical construction must be written after the complete candidate is separately reviewed; the absence cannot be disguised by an opaque successful factory.

Physical representation choice and rejection conditions

The proposed parser backend is one original native nonexecuting writable virtual-memory reservation. Its actual OS reservation, commitment, page geometry and guard geometry are part of the original native calibration/object association. The arena's headers, free-extent representation, cell records, live borrower links, indexes, alignment gaps and committed pages are charged within its same admission-resident accounting. The source uses checked integer extent arithmetic; no allocation receives credit before the original allocator/VM operation actually ends and the retained object has no borrower. Page size or alignment cannot be guessed from the host name. OS reservation/commit failures are retained native attempts; they do not enter a libc allocation fallback.

Private records have explicit fixed-width layouts and compile-time layout assertions in the eventual selected source. Cross-process frames use explicit byte codecs, not C++ structure memcpy. Cells identify owner/root/object generations and allocation offset/length, maintain intrusive borrower membership and a serialized state (empty, acquired, close-admitted, close-observed, unresolved, retired). Raw byte windows identify the same original extent and exact subrange. Window acquisition itself reserves its link/control cell before exposure; move and release do not allocate. Every arithmetic bound includes the actual backend rounding and allocator/control extents. Until the exact record layouts, maximum simultaneously retained cells and OS backend are derived below, no positive arena/root factory exists and no numerical control allowance is claimed.

The original native call stack is a retained thread-stack/ABI association. nativeStackBytes=sizeof(local return values) in the clock proposal is only a local overlay observation, not a complete SDK/compiler/spill/stack charge. The full original stack reservation, guard, commitment, TLS and source-native call-chain bounds must be independently associated with the sampling/worker thread. SDK internal allocations and returned buffers are separate extents, including error and cleanup paths. A stack cannot be credited again as a new per-call pool or considered ended at function return.

Exact joins and nonthrowing native transition

The primary owner implements the move-only RootLease, FrameLease and CellLease joins requested by clock54f2. Root enrollment requires the original process lifecycle and source progress graph. Native-frame reservation admits the exact input bytes, maximum original output extent, local-return layout and original retained thread-stack association; it simultaneously pre-enrolls the failure/disposition record. Empty-cell reservation precedes acquisition. The first source action after a native call obtains its native error and commits the raw result into the pre-enrolled frame without allocation or exception. A thrown std::runtime_error, newly grown string/vector, or newly allocated archive record cannot be this first commit.

The frame retains nativeCallEntered, actual scalar result, native error, actual raw handle, process/thread IDs, requested flags, attempt and actual output-body byte count. Scalar-only APIs retain the scalar without inventing an empty successful IO body. An unsuccessful begin-close commits a no-native-call disposition distinguishing not-created, already-attempted and live-borrower refusal. It is not a close success. Actual close is admitted once, records its first native result and never retries from a destructor. Linux EINTR remains unresolved if the original object's disposition cannot be established. Destruction releases only the intrusive borrower link; it neither performs native close nor frees unresolved history.

An original result frame becomes immutable before observation/publication. Clock, namespace and observer borrow the same frame or byte extent rather than copying its bytes into independent arenas. A frame retires only through the existing mandatory archive association, actual ended IO, complete closure/disposition and zero original borrowers. No GC finalizer, null assignment, logical Budget.closed, successful function return or hash comparison provides this retirement.

O2's original attempt owns the performer object, birth, original IO/clock/source associations and raw frame until immutable archive commit and per-effect receipt consumption. The archive encoder's65536 window limit is not the source API output limit: READ_ASSETS is300000 and actual original responses retain their full bounded body/window. SDK returned security/token buffers retain actual sized output under their existing native bounds. The attempt/index/receipt/failure/witness controls belong to this same backend. O2's independently retained observer views and kernel objects have their own actual cells under this owner, never a second allowance.

D1 first decision and deadline custody

The native process/domain/capture-thread root, raw sample frame and terminal/failure capacity preexist the first HTTP dispatch decision. The request's first actual native tick is committed before URL parsing, route classification and authentication. Later route classification selects the existing10s or40s endpoint from that same tick using D1's checked arithmetic; it never samples a replacement start or renews the end. Auth failure ordering remains original. Capture, queued work, worker and authenticated peer hold distinct original lifecycle/sampler leases correlated to that immutable capture authority and end. Linux original clock namespace/process/thread transition restrictions and Windows original QPC/frequency/source-thread observations remain real predicates, not equal-number claims.

The eventual Deadline receives owning sampler/domain and immutable end leases. The current raw OriginalClockSample/end constructor is an internal incomplete IO carrier, not the positive constructor. Companion greeting80 and provider greeting64 remain distinct. The digest-only connect(profileDigest,workspaceDigest) has no actual production caller and lacks original work/end/owner authority; it cannot mint now+40s or resolve a digest as a grant. A positive reattachment can only consume an already existing owner-bound scope. Otherwise its truthful unavailable disposition preserves the API without inventing approval.

Actual23 command payload phase derivation

The following formulas describe actual current channel payload backings, not the complete physical peak. Q is the original command request cap and R its response cap from protocol.hpp. Original inputQ remains live through request/response. The outbound MAC phase holds originalQ, Writer(Q+36), MAC preimage(Q+65): 3Q+101. The Windows send phase instead holds originalQ, Writer(Q+36), sent(Q+36), NativeIo min(Q+36,65536): 3Q+72+min(Q+36,65536). Response MAC checking holds originalQ, header4, received(R+32), resultR, MAC preimage(R+65): Q+3R+101. The receive IO phase can additionally hold its actual chunk while copying into received, but result/preimage have not yet been created. These formulas do not erase held assets, parsed command strings/JSON, job controls, native stack, peer checks, failure history or observer/archive owners.

The companion receiver MAC phase holds header4, prefix5, bodyQ, tail(Q+27), preimage(Q+65): 3Q+101. Its response sender holds original resultR, frame(R+36), sent(R+36), actual IO window at different source phases. The incoming request body and decoded NativeCommand borrowed references can still be live. Both actors' original allocations must be classified truthfully; a companion handle is never a Core parser window.

op	Q	R	Owning effect and retained state
1 OPEN	1024	1024	original selected journal/selector/provider lineage; implemented
2 READ_ASSETS	1024	300000	four original catalogue asset associations and bounded inline response; unfinished
3 RESERVE_STAGE	2048	2048	original stage object, root, reservation and declaration; unfinished
4 WRITE_STAGE	66000	256	existing original writer/offset/readback and upload state; unfinished
5 PREFLIGHT_SEAL	2048	256	original stage, catalogue, capsule and preflight binding; unfinished
6 PREACCEPT_INTENT	32768	256	original journal admission and intent check; implemented
7 AUDIT_ENSURE	32768	256	original canonical17-key Audit body/chain/index and current outbox; unfinished
8 ACCEPT	65536	12288	journal/preflight/key mapping/stage/capsule acceptance transaction; unfinished
9 WRITE_INTENT	128	128	original accepted journal intent and operation; unfinished
10 MATERIALIZE	128	128	held candidate directory/files, modes/bytes, rename and final reopen; unfinished
11 DISCOVER	128	65536	original directory census/object associations and receipt; unfinished
12 OUTCOME_PENDING	32768	12288	original operation/outbox pending publication; unfinished
13 AUDIT_ACK	256	12288	actual acknowledged Audit/index/outbox publication; unfinished
14 READ_OPERATION	1024	8202	original authenticated selected journal operation; implemented
15 RECOVER	5	128	original selector/journal/outbox/candidate recovery with no new request identity; unfinished
16 CLOSE	128	128	original objects/IO/observer/borrower closure; unfinished
17 CAPSULE_CHUNK	66000	256	original capsule object/readback and immutable window; unfinished
18 CAPSULE_SEAL	128	128	original held capsule, one-use provider and signer readback; unfinished
19 RESOLVE_KEY	1024	12288	original actor/raw-key preimage and four retained derivations; implemented
20 LOOKUP_STAGE	1024	2048	original stage/declaration/read handle association; unfinished
21 READ_STAGE	64	65664	actual original inline response/offset/final receipt/EOF; unfinished
22 RELEASE_STAGE_READ	128	128	original reader IO/borrower closure, not GC; unfinished
23 LOOKUP_PREFLIGHT	1024	12288	original selected journal preflight; implemented

The source currently serializes one original dispatch per engine and one original work per application transport State. It also retains up to16 stream slots and four key-resolution slots. Those bounds do not imply sixteen complete parser peaks or establish full failed-attempt/archive cell counts. Persistent journal rows, outbox entries, directory discoveries, file counts, per-read partial IO and independently held archive objects require their source-derived per-route counts. Eighteen missing handlers must be given concrete ownership/transition definitions before any whole all23 physical proof; a cap table alone cannot supply them.

Core stage and NQ actor/phase handoff

CoreStageSnapshot is produced by the Core original23 adapter from authenticated inline READ_STAGE responses. It borrows no companion FD/HANDLE and adds no public operation/ancillary transfer. Its immutable originalBytes(offset,max,Deadline) window, declaration, original stage observation/final response window and original owner/custody checks preserve the actual existing sequence, offsets, final raw hash and receipt. The current TS NativeAdmissionChannel owns sequence; a native adapter must transfer/retain that same sequence and its original result owner before NAPI exposure. Guessing a batch sequence or relying on external ArrayBuffer GC cannot produce this handoff.

The initial phase permits the original10MiB snapshot before the owner ZIP262144 limit is checked. It overlaps original23 carrier/control ownership, the four296448-byte asset source associations, TAR524288 baseline expansion and original descriptor/policy/manifest parsing. After the exact oversized-ZIP rejection point, the matcher phase can use the262144 accepted raw ZIP bound, with the same assets/TAR and the original failed authored expansion26214400 that remains before later configuration checks. NQ's exact Unicode/property/case closure, constructor program/trace/target/history/register bounds and interpreter optimization/overflow semantics remain separately under derivation. The ordinary RegExp source reference is the exact proposed Node22.23.2 jitless interpreter association with original flags, not a generic simplification, a different native backend or a claim that source presence enables staged syntax.

AST/graph and raw windows cannot be retired while compiled operands, captures, subjects or observers borrow them. Physical phase closure, or an explicit same-extent immutable transfer, precedes reuse. No matcher stack begins during the original oversized-raw rejection phase. Reference runtime source/build leases are original nonresident IO associations, whereas actual resident runtime/code/table allocations are separately accounted; source files cannot stand in for a live runtime-counter observation.

Full64MiB capsule capacity and true overlap

The existing generic capacity obligation is distinct from the current owner-authorized semantic inventory. Its expanded67108864 bytes plus the original Windows message67195929 bytes total134304793, exceeding134217728 by87065 before controls, raw buffers, native IO or observer ownership. Core ParsedStage.entries survives its seal await, producing the expanded-byte overlap. Full reading of capsule.hpp corrects the distinct native classification: NativeCapsuleStorage::sourceOwned_ retains NativeCapsuleNamespace whose NativeCapsuleApproval entries contain only path/mode/count/SHA/authoredBytes metadata, not expanded byte buffers. Its retained sourceOwned_ therefore is NOT another64MiB byte owner. The metadata remains charged, but the concrete full64 duplication is Core parsed byte ownership plus the Windows message. This counterevidence is not permission to reduce scope or deny every valid full64 capsule.

The existing requestProviderFileSignature already signs the actual held original capsule file through bounded native reads; it does not construct another full capsule buffer. The selected repair must make the preceding namespace/inventory byte owners physically end or transfer before the Windows whole-message backing begins, while retaining path/mode/count/hash observations and actual original capsule/root/IO custody. One WriteFile owns the message until ended original OVERLAPPED IO. Ordered chunk framing, existing domain/version/raw bytes and true original message boundary remain unchanged; Linux actual write-side EOF is separate. The signer cannot replace a genuine namespace with a new spool/path authority or claim a semantic grant from generic capacity. No raw borrower retirement implementation presently exists.

Mixed-secret journal and terminal decision boundaries

Original Blueprint111 excludes raw key/auth/confirmation values from native/raw captures and limits exact original body proof to nonsecret bodies. Blueprint217 requires successful ledger primitives to retain full original frame byte count/hash with independently correlated original raw capture/provider body. The actual journal includes confirmationId and keyMappings.keyHMAC; native capability greetings, TLS/key plaintext and ResolveKey/idempotency request bodies add separate excluded ranges. Existing aggregate journal/selector/artifact digests are already product format requirements, but their existence does not authorize new independently archived aggregate-secret observations.

No success primitive with null byte fields, redacted replacement body, concatenated noncontiguous partitions, secret-only digest, new MAC domain or encryption exemption is selected. O2's proposed full count/aggregate artifact with independent nonsecret partitions and original product validator custody explicitly changes the coverage claim from independent whole raw equality. It therefore requires a complete separate whole amendment identifying each changed clause and genuine original producer/authority; it cannot be enabled by this document. Until selected, mixed-secret attempts retain truthful private native counts/partitions without claiming successful whole raw ledger proof. Likewise F7 terminal/witness alternatives are pending different whole review. An expired D1 scope cannot be renewed to finish Audit/archive/closure.

Remaining concrete whole-source decision obligations

For a positive whole CE2 architecture verdict, select and prove the actual rounded cell layouts, live attempt/borrower/index/failure counts for all23 effects, actual stack/SDK/runtime/image source allocations and ordinary runtime finite qualification; complete source-pinned TLS/CA/native UTC/bootstrap producer ordering and original transferred object codecs; bind CoreStageSnapshot sequence/owner and full64 retirement; reconcile complete NQ program/Unicode closure and original counters; and resolve mandatory raw history, mixed-secret ledger and terminal witness semantics without weakening their coverage silently. Current clocks provide algorithms but no root backing; NQ provides data-level window semantics but no authentic producer; O2 provides attempt/receipt semantics but no shared geometry. These are source implementation/architecture gaps, not merely absent credentials. The whole review entrypoint binds this decision, realm, inert layout and complete original/current inputs for independent assessment. It records exact obligations and current counterevidence; unresolved terminal/secrecy alternatives are explicitly unselected review material, not an architecture/source GO.

Concrete private record representation selected for the candidate

The data-level candidate fixes the following 16-byte-aligned records; these are new private implementation layouts, not new public/profile fields or admission capabilities. Every reserved byte is initialized zero and excluded from native raw-result proof. The eventual source must assert the exact offsets/size/alignment on its qualified compiler; a mismatched build rejects rather than assuming compatible padding.

ExtentRecord64: eight U64 words (owner generation, extent generation, offset, requested length, rounded length, previous free extent, next free extent, state/allocator class). The final word is a fixed source bit encoding, never a supplied class. Every split produces another pre-enrolled record; split failure does not allocate an out-of-arena node.
NativeCell128: sixteen U64 words (owner/root/cell generations, native type/state, original scalar handle storage, acquisition attempt, close admission, close result, active IO head, borrower head, source association, birth association, clock association, actual object association, retained failure association, next). Object/native handle representation is local and never serialized by memcpy. A cell can only be published after its original actual acquisition commit.
BorrowerLink96: twelve U64 words (owner/root/extent generations, borrower generation, extent offset, length, original object, original IO, source role, begin attempt, ended attempt/state, next intrusive link). An ended link stays retained until its original frame/archive consumers end; its record does not vanish at release.
ObserverAttempt144: original O2 fields packed in source order: three U64 run/generation/sequence; two U32 operation/phase; four U8 platform/state/knownness/privacy; two U32 requested/returned; U64 offset; eleven U64 nativeResult/inputBorrower/outputBorrower/object/source/clock/IO/archive/receipt/reservation/next; four zero bytes to complete144. Result variants have separate exact records and cannot hide additional SDK output inside this control.
ArchiveIndex64: six U64 generation/sequence/nativeObject/byteOffset/encodedLength/next, then four U32 kind/state/sourceDomain/privacy. Every native attempt retains its own index even where actual immutable byte equality allows payload sharing.
PrivacyRange16: U64 actual encoder offset, U32 exact length, U8 source field domain, three initialized zero bytes. The8192 possible journal keyMappings/preflight secret ranges therefore require131072 raw control bytes before backend rounding, not a dynamic vector. This upper bound follows the actual4096+4096 journal rows; it does not bound total observer attempts or other privacy sources.

Root, raw-result SDK variants, receipt, witness, sampler/process-lifecycle and worker/IO control layouts remain distinct required records. No generic sizeof(void*) padding, dynamic std::string owner, exception_ptr allocation or unseen std::shared_ptr control block is included implicitly in these fixed records. A source-private lease is an arena pointer plus owner/root/record generations and is noncopyable. Its move transfers the actual link rather than constructing a second control. Exact record counts come from the entire owning effect/source callgraph and simultaneous retained failure/borrower states, not from dividing remaining bytes by these sizes. These record choices are progress toward the full candidate; the final all23 layout/count/SDK/source-stack proof is not yet complete.

Current channel payload maxima, before other owners

These are source backing capacities at distinct actual phases, computed from the preceding formulas. They are not native qualification, RSS, SDK/control/arena totals or all23 admission. The caller request remains held in the response-MAC column. Windows send includes the actual separate NativeIo chunk. Companion responding can overlap its still-held incoming command and decoded state; this table cannot exclude those owners.

op	request MAC	Windows request send	response MAC
1	3173	4204	4197
2	3173	4204	901125
3	6245	8300	8293
4	198101	263608	66869
5	6245	8300	2917
6	98405	131180	33637
7	98405	131180	33637
8	196709	262216	102501
9	485	620	613
10	485	620	613
11	485	620	196837
12	98405	131180	69733
13	869	1132	37221
14	3173	4204	25731
15	116	128	490
16	485	620	613
17	198101	263608	66869
18	485	620	613
19	3173	4204	37989
20	3173	4204	7269
21	293	364	197157
22	485	620	613
23	3173	4204	37989

The root is one RootRecord128 in the original preentry owner backing: sixteen U64 words for owner generation/state, original reserved base association, exact reserved length, committed length, platform geometry association, extent-record head, native-cell head, borrower head, attempt head, archive-index head, retained-failure head, original lifecycle association, calibration association, source association and transition serial. Pointer-bearing words are local native references; codec export uses original ordinals. Root backing is acquired under independently qualified baseline/bootstrap custody before HTTP dispatch and persists through final root closure; it is not inferred from its own initialized contents.

NativeResultRecord128 is sixteen U64 words for source API/disposition, call-entered/definedness bitset, actual signed scalar result bits, immediate native error, actual raw handle bits, actual process, actual thread, requested flags, attempt, actual returned body length, original input borrower, original output borrower, native-cell ordinal, original IO ordinal, original stack association and immutable publication serial. It is a source-private scalar carrier; actual native ABI bytes remain in distinct original input/output extents. A recorded scalar0 is not a fabricated zero-byte read. Windows native structure variants are decoded only with their selected defined fields and exact actual returned bounds; Linux errno is observed only where the selected API defines it. No raw pointer/undefined union/padding is published as original observation. Per-API input/output extents are individually pre-reserved before the native call, including trueEOF destination storage; a common128-byte result does not promise every SDK body fits128.

A candidate ReceiptControl128 has sixteen U64 words: original run/generation/effect, state/consumption transition, actual attempt range first/last, original object, source, clock, archive generation, original durability/publication, actual IO closure, original borrower, original consumer, replay-consumption association and next. Each field refers an actual pre-enrolled owned association. The codec and state transitions remain O2's exact closed proposal; no parser/hash/bool restores an eligible receipt. Terminal witness controls are intentionally not assigned a permissive fixed success representation while F7/O2 acceptance alternatives remain undecided. Required terminal/failure capacity must nevertheless be reserved before the corresponding effect; lack of a selected finite witness is a concrete remaining architecture gap, never a delayed allocation fallback.

Index paging cannot hide resident costs: durable-streamed history retains every actual attempt/index/native source association, and each in-memory cursor/page/buffer/lease/control has a rounded same-owner extent. An index cursor cannot require loading the whole prior history or recursively generate an unbounded new witness generation. A bounded traversal would retain original held archive read/EOF/source/native custody with exactly pre-reserved cursor pages, and any page IO remains an actual attempt under the independently selected finite terminal cut. This alternative needs the complete source callgraph/cut decision before implementation; mandatory history is not dropped, rewritten into an aggregate hash or credited as retired merely because written once.

Native backend and preentry commit recipe

For the candidate, Windows selects one VirtualAlloc reservation (MEM_RESERVE, PAGE_NOACCESS) followed by source-owned page-range MEM_COMMIT/PAGE_READWRITE; Linux selects one mmap(PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS) reservation followed by source-owned checked mprotect read/write ranges. Neither backend creates executable parser pages. Actual returned address/range, requested flags, immediate native failure, page granule, reservation and commitment are retained original observations. This recipe is proposed source selection, not native qualification. No MAP_FIXED replacement, executable fallback, environment address, caller-selected allocator or second reservation on failure is accepted. Exact guard/page rounding is checked against original geometry and complete charge BEFORE the transition.

The first reservation cannot allocate its own success/failure recorder from the reservation it has not yet obtained. Its original qualified image therefore contains one source-fixed bootstrap RootRecord128, NativeCell128 and NativeResultRecord128, plus their original immutable source/lifecycle binding, in native static writable data. These384 bytes are admission-resident ownership (actual image/page backing charged once at its complete native rounded size), not a free exemption. They exist before the first dispatcher/sample. Actual source-native stack/SDK transitions remain separately qualified; a static scalar buffer cannot pre-approve them. The baseline qualification must bind the real early image/loader/static initialization and native recorder so acquisition failure remains retained without throwing/allocating a new observer object. Static record contents do not authenticate their source.

After actual reservation commit, the backend enrolls its fixed records only in original checked nonoverlapping extents of that reservation. The allocator uses an address-ordered extent list and explicit checked splits/joins with fixed ExtentRecord64 owners; merging requires ended native IO, retired borrowers and original same-generation disposition. It never uses std::map/vector/global malloc for its free list. A split pre-enrolls the new record from the same existing free extent before exposing either allocation; all resulting metadata and alignment gaps remain charged. Failure to reserve the metadata denies before the effect and leaves the original extent intact. Free record reuse retains generation monotonicity with checked overflow; exhaustion consumes availability rather than wrapping/reissuing an old lease.

Actual SDK/Node/OpenSSL/libc allocations do not become arena-owned merely by receiving Budget.reserve. Their original source allocation sites/returned allocations, native deallocations and borrowers must join this backend or a genuinely independently finite ordinary-runtime owner classification. The eventual selected source must give original allocations a pre-reserved failure recorder even when native allocation fails. Current std::vector/std::string/shared_ptr/exception allocations and native library-returned storage remain unconnected counterevidence; this recipe selects no fabricated successful hook or byte credit. The C9 calibration record's existing measurementRef is not extended into an invented numeric runtime grant or a source authority. Its original external qualified measurement/source association must establish what its native bodies actually prove. The complete ordinary runtime/image finite qualification format/source recipe remains a specific unresolved CE2 obligation.

Concrete native-only parser/capsule handoff candidate

Select the private native-only CoreStageSnapshot→NQ QualifiedNamespace→capsule emitter route, rather than exposing expanded admission bytes as ordinary Node Buffer owners. This is proposed material source integration under CE2/NQ, not an implemented constructor. The original HTTP route/API/auth/config/lifecycle behavior remains unchanged; only sealed Core internal producer/consumer ownership changes. Actual native original23 READ_STAGE windows are consumed into the ONE Core parser backing. NQ publishes immutable namespace observations plus private original byte leases; JavaScript receives path/mode/count/SHA/binding/declaration metadata and a source-owned native plan lease, never a mutable64MiB byte bank. The controller's later DISCOVER equality uses retained original counts/SHA/modes/path observations; current .bytes.length is replaced by the corresponding actual admitted native count, not inferred from a detached or empty Buffer.

The source-owned native capsule emitter borrows each original qualified entry window and issues the EXISTING operation17 chunks on the SAME authenticated companion channel. It retains actual original successful append/readback observations and each chunk's IO borrower before advancing. After final unsigned original capsule has been written/read back under its existing product authority, every NQ expanded/raw byte borrower that would overlap signing completes its actual archive/effect transfer and physical retirement. The namespace catalogue/manifest/binding and metadata lease remains genuineheld. Only then does the existing operation18 invoke native held-file signing and allocate the one Windows provider message. The original operation/binding/fingerprint/count/frame SHA and same preimages remain exact. This introduces no new public request/opcode/handle transfer, no unselected spool permission and no approval from a decoded row.

NativeAdmissionChannel in native-channel.ts currently owns private sequence/pending/closed; PrivateChannel independently checks the actual original sequence. The native-only adapter must acquire an exclusive original sequence/work lease while no JS request is pending, consume every existing operation's actual sequence/response in order, and return the actual native next-sequence observation before the JS adapter resumes. It cannot guess the JS private value or supply a disconnected batch counter. The internal sealed adapter compares its original expected sequence and one-use native scope, never accepts a public supplied number as authority. Failure consumes/sticks the original channel and preserves every actually advanced command; no sequence rollback/reconnect/retry becomes a fresh grant. Exact private binding methods/lease codecs and their original caller dataflow must be included in the whole CE2/NQ review before implementation.

The legacy TS ParsedStage path creates expanded ordinary Node Buffers and retains them through capsule seal and later discovery. Merely nulling entries, wiping bytes, returning from parseStage or asking GC cannot implement the proposed retirement. Existing original Node source exposes napi_detach_arraybuffer, but detachment alone likewise proves no complete native backing/SDK/shared_ptr/control retirement; it is not selected as a shortcut for adopting the legacy buffers. Actual22.23.2 js_native_api_v8.cc checks IsDetachable then calls V8 Detach; JSArrayBuffer removes its extension/backing reference and sets length0, while node_buffer.cc has separately allocated CallbackInfo/BackingStore cleanup and asynchronous callbacks. Other native borrowers still require original ended ownership. The native-only route avoids creating that legacy expanded bank, while source-owned native allocator/window and original JS metadata allocations remain genuinely charged.

Reference-runtime dependency propagation

The exact NQ reference lease additionally retains the original standard-library/compiler/build association where source containers determine alternative order, actual generated special-case.cc source association from the source-fixed ICU generator (the generated body is absent from the original Git tree), and actual ICU default-locale source/lifetime where Canonicalize calls UnicodeString::toUpper() without an explicit locale. Neither Node/V8/ICU version nor source-tree availability substitutes for those dependencies. NQ's full versus simple Unicode closure/removeAllStrings behavior remains exact; a blanket simple-fold map is not equivalent. These observations do not create a locale request/profile field or authorize an environment probe.

The consumer must borrow genuine original runtime facts when the source invariant is not proved: executable-heap committed-memory and regexp-generated-code counters, original default locale and its generation/lifetime, actual staged flag states, and original generated table/build dependencies. A decoded numeric counter or supplied locale string is not such a lease. The Core source currently has no concrete producer for these runtime facts; the ordinary original jitless image walk must either establish the exact invariant from complete startup/allocator paths or provide source-owned native observations bound to the same original runtime/source/clock/physical lease. No zero-executable-memory claim or optimization-always-on grant follows merely from jitless preventing code-range remapping. Exact prospective observer/native record cells and returned extents must be reserved before any actual sampling hook is added.

Capsule metadata allocator/type choice

The actual NativeCapsuleNamespace/NativeCapsuleRead currently contain default std::string/std::vector types. They cannot adopt this native VM arena merely by copying Budget or changing an allocator typedef elsewhere. Select a private type/view amendment in the whole candidate: immutable fixed-record NativeCapsuleNamespaceView and NativeCapsuleReadView, with exact original source/custody leases, replace those dynamic metadata values at the native capsule/storage/materializer consumer boundary. This is not yet implemented or an approval wrapper. No global operator-new interception/libc fallback or sizeof-only charge is inferred.

NamespaceEntry288 has U16 original UTF8 path length, byte[240] path storage, U8 original mode, U8 flags (authoredBytes bit only), U32 byte count and byte[32] SHA, then8 initialized reserved bytes; raw sum280, aligned size288. The128-entry existing bound gives36864 actual record bytes before backend page/control rounding. Unused path tail is initialized and not a source native observation. Exact path/mode/count/SHA semantics remain the current capsule contract; selected qualified authored approvals remain authoredBytes=false. Existing public path byte cap240 is preserved; no repository metadata cap is introduced.

NamespaceHeader816 has the existing bounded identity strings in source field order: catalog identity256, manifest path240, template id128, commit40, version64, each with U16 actual UTF8 length; byte[32] contract; U32 count; five U64 original owner/root/catalogue/stage/reference-runtime lease ordinals, then2 initialized reserved bytes. Actual fields total814 and aligned size816. Commit length remains exactly40 by the existing codec; the field capacity is not a new acceptance limit. Original repository/descriptor/config metadata outside these bounded capsule identity fields remains borrowed original source spans, with original unbounded accepted string semantics. Namespace's128 entries plus header require37680 raw bytes, not64MiB.

ReadEntry288 has U16 actual UTF8 path length, byte[240] path, U8 mode, U8 reserved, U32 bytes, U64 raw capsule offset and byte[32] SHA; exact total288. ReadHeader retains original object/IO/source/clock leases plus count/frameBytes/expanded/frameSHA/wholeSHA/terminalMAC in an explicitly fixed record to be aligned with O2's actual object variant. Its original object owner SID/native identity is not a dynamically copied string or guessed pointer-size charge. Each128-entry result uses36864 raw record bytes; retaining both unsigned and signed observations in NativeCapsuleStorage::seal is a genuine simultaneous owner, not one overwritten success. Capsule cursor string reads compare directly against bounded original metadata views; current dynamically constructed previous/path/string digests must likewise use charged fixed/streamed encoder extents rather than hidden string concatenations.

The whole interface review must include all capsule-storage, materializer, command result encoder and NQ factory signatures consuming these original views. A compatibility overload silently retaining default-allocator full metadata would reintroduce unowned allocations. Their wire encoders retain the exact existing strings/field order/lengths and original digest preimages; the private representation change creates no new op/public/profile field. Actual source-before/after native equality and independently accepted catalogue/source approval remain separate from this data layout.

Source-derived capsule framing and progress counts

Actual capsule raw header maximum is713 bytes excluding its original17-byte domain prefix: version1 plus strings(68 version,260 catalogue identity,132 template id,44 commit,68 template version), contract32, operation40, fingerprint32, materialization32 and count4. Each entry metadata is281 bytes at path240 (length4+path240+mode1+byteCount4+SHA32). Thus67108864 expanded+128*281+713=67145545 provider raw bytes; unsigned file adds17 to67145562. This derives the actual existing ceiling rather than confusing the1GiB aggregate capsule reservation with one signing request.

Existing BEGIN body actual maximum78 (op1+seq4+domain1+version length/value68+total4), END9, each provider frame adds36, each CHUNK body adds13 to its original bytes. For n raw bytes and k=ceil(n/65536) nonempty chunks the complete Windows request is n+49*k+159 at version64. Exact maxima: Idempotency392/k1/message600; Journal16777216/k256/message16789919; Selector110/k1/message318; Capsule67145545/k1025/message67195929; Audit16528/k1/message16736. The provider maximum sequence1026 permits BEGIN+1025 CHUNK+END without wrap. These exact whole-message allocations remain owned through the original single WriteFile completion; Linux sends the same frames then actual SHUT_WR and native EOF semantics, without allocating a duplicate whole message.

Current Core controller emits one header chunk, one metadata chunk per entry, then each entry's ceil(bytes/65536) content chunks. At128 entries and67108864 expanded the sum of content chunk counts is at most1024+127=1151, hence at most1280 existing operation17 exchanges before operation18. This counts the source's original field/chunk partition, not a newly chosen operation cap, not NQ semantic permission and not an OS syscall count. A future native emitter can preserve that partition or supply a precisely documented equivalent existing byte stream; it cannot discard intermediate original exchanges/observations from a proof merely because bytes match.

For the native file signer, source loops fill each65536 original payload chunk from positive reads, retaining its exact offset and genuine EOF separately. If every native read returns its requested count there are1025 payload reads at the maximum capsule raw length, plus original domain-prefix read17 and final trueEOF read1. Actual short positive reads increase the number of native attempts, with each actual byte counted as progress; current source allows as many as67145545 one-byte payload reads. Scalar frame counts do not bound such underlying attempts, peer/deadline samples, waits or retries. Complete raw-history/control/storage capacity must cover the selected permitted source/native trace or truthfully exhaust before the next effect while retaining prior failures; it cannot claim worst-case full coverage using1025 alone. The original10s/40s end is not a count limiter by itself. This is the precise pending all23 progress/history proof, rather than an arbitrary fixed256/4096 attempt grant. ReadHeader160 now has six U64 original object/owner-root/source/clock/file-cell/readonly-borrower lease ordinals, U32 count, U32 frameBytes, U64 expanded and three byte[32] frameSHA/wholeSHA/terminalMAC; exact160 bytes. It borrows the original platform-specific ObjectObservationView rather than copying ObjectIdentity's default-allocator volume/file/owner strings. Read bank total is37024 raw bytes (160+128*288), with both unsigned and signed banks74048 where both coexist. The actual immutable object observation owns its original FILE_ID_INFO/stat/native security output and original frame; observed object identity strings/digest are generated in a charged bounded encoder using exactly the existing platform digest preimage, not a new identity recipe. In particular current Windows identity represents the native128-bit FileId.Identifier in the first16 bytes of a zero-filled32-byte Digest and emits64 hexadecimal characters; changing that to32 characters would alter existing object digests. Full original FILE_ID_INFO remains held independently of this unchanged encoding. Linux original volume/inode/uid decimal representations remain the existing unsigned native values. Original byte length/mode observations remain outside the stable object digest as platform.hpp currently requires.

Closed journal view rather than an unowned DOM

Select a source-private NativeJournalView/NativeJournalOverlay amendment for the full constructor/command/storage boundary. Current Json uses std::map/string/vector, parseCanonical copies original payload into a string, and readOriginalNativeJournal separately holds full frame and payload. Logical Budget reserves neither those DOM/control allocations nor their complete clones. Global malloc interception or assigning262144 token nodes as an assumed sufficient full journal does not repair the original accepted closed4096/8192 row scope. Current native parser defaults token262144/member131072/string32768 require compatibility proof against the original full retained journal, not silent adoption as new journal acceptance limits.

The selected reader traverses the original canonical frame in bounded source-owned byte windows, validates the EXACT16-key native journal and each original closed row schema/scalar/depth/escape/number/order rule, and stores fixed indexes to original immutable row extents. It computes full original payload/frame/provider MAC/EOF/object/generation semantics exactly. It does not read only requested fields or trust signed-but-unvalidated row data. Cross-row scope/equality/uniqueness checks resolve actual original indexed spans under the same original full source/lock/custody. A SHA match is not a duplicate-ID/string equality substitute. Arbitrary unknown JSON fields, duplicate keys, trailing tokens and malformed surrogate/UTF8/escape forms retain the current strict rejection. Original array order remains exact; an index sorted for lookup does not reorder the canonical serialized arrays.

JournalRowIndex64 consists of byte[36] actual opaque id/event reference, U32 collection/state, U32 original row offset, U32 original row byte length, U32 previous index, U32 next index and8 initialized reserved bytes. Actual row IDs/eventIDs retain their existing36-byte predicates; collection/state is a fixed native bit codec, not a caller admission. Native schema has seven4096-row collections (reservations, stages, preflights, operations, keyMappings, capsules, writeIntents), outbox8192, plus retained versions64. At their simultaneous structural bounds this is36928 records/2363392 raw bytes before backend rounding. Version records use the same64-byte class with an original version span instead of a36-byte opaque ID; no64-byte string value is squeezed into that ID storage. Original source/declaration/binding/actor/client/resource arrays remain validated source spans, with separately charged query decoder/index scratch and privacy records. No full decoded payload copy is required by this index choice.

Overlay changes are typed per existing command (reservation/stage transition, preflight/capsule, accepted mapping/operation, original outbox/write intent/receipt/outcome), with original before-row/source/lock and new bounded source encoder extents. The owning engine defines the exact count/fields and order for each of all23 routes; no supplied replacement JSON row or generic arbitrary mutation method is exposed. The next canonical payload streams unchanged original row extents and exact new/replaced typed rows into its original precharged frame/writer, with original global schemas/invariants validated before publication. An overlay is not durable publication or a receipt; native store still performs the actual one-use selector/journal provider transactions, original scratch write/flush/readback/no-replace or selected replacement, selector, reopened full validation and lock release under the same D1 end.

The current publishNext keeps actual previous/next DOMs and native raw read/canonical/prefix/frame/provider ownership. Replacing these with views requires all five currently implemented effects and eighteen unfinished effects plus native result encoders/observer privacy projection to join exact new types, not a compatibility overload returning old Json clones. Full frame signatures, stable identity digest, journal/selector generations, key MAC preimages, row limits and16MiB aggregate slot/scratch census remain unchanged. Actual canonical string/field encoding is streamed with unchanged preimages and source-defined privacy offsets. Complete per-command overlay and decoder/control counts still require the owning effect definitions;2363392 is an exact index representation subtotal, not an invented whole budget grant. The NQ owner has reconciled the consumable namespace phase explicitly: OriginalBytesEligible→CapsuleOriginalBytesTransferred→MetadataOnly. stageObservation() stays available as immutable genuine stage/source/catalogue observation; originalStageSnapshot() and entryBytes() are byte borrowers only in OriginalBytesEligible. Transition requires actual original operation17 append/readback AND genuine O2 archive/effect handoff, ended IO, zero byte borrowers and actual bank retirement before signer allocation. Source-only code/body return, requested hash or callback/receipt scalar cannot authorize it. MetadataOnly custody checks the genuine original capsule/archive/stage/catalogue joins, not dead original byte windows. Its producer is the primary original storage/observer join, never a constructible NQ parser approval wrapper. Exact ABI/consumer replacement is part of the whole pending decision.

Windows original message and kernel-buffer ownership counterevidence

Microsoft's original NtCreateNamedPipeFile contract states that pipe input/output buffers consume nonpaged pool and requested sizes are advisory: native allocation can round, enforce internal minima/maxima, and expand the write quota from pool while a write waits for the reader. Source: https://learn.microsoft.com/en-us/windows/win32/devnotes/nt-create-named-pipe-file . The read/type mode contract separately distinguishes each original message write from byte-stream data and permits blocking writes until adequate buffer capacity: https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-type-read-and-wait-modes . These are API-level source facts, not an executed measurement, qualified kernel allocation bound or proof that a whole request necessarily has two simultaneous complete copies.

Consequently a requested65536 pipe buffer is NOT a hard source-owned kernel memory ceiling. Current maximum capsule user message67195929 must retain its actual original allocation through ended WriteFile/OVERLAPPED lifetime; the original peer/channel kernel buffering and native control ownership must also have a genuine finite qualified source association. If a complete67195929 kernel copy overlaps the complete user envelope, their conditional subtotal134391858 already exceeds134217728 before controls. This conditional counterexample cannot be labelled universal Windows impossibility; the actual selected kernel implementation, returned disposition, reader progress and lifetime determine the real allocation trace. Neither configuration hints nor empty queue checks prove that trace.

A whole-compatible alternative for explicit selection/review is one ORIGINAL native message for each EXISTING BEGIN/CHUNK/END authenticated frame, with every message boundary validated against its exact existing frame length, and the entire original transaction total/ordered chunks/domain/version/preimage validated at END. This preserves the existing provider64 greeting, private frame operation bytes, fixed five cryptographic domains/preimages, original endpoint/actors and one-use peer association. It changes the current whole-request-message implementation choice and therefore is NOT implemented or selected merely by this document. It must reject early/extra frame boundaries, subsequent messages/frames and actual failed final channel closure; END or an original message boundary must NEVER be called OS EOF. Linux's actual SHUT_WR/zero read remains separately genuine. No per-chunk ACK/new operation/endpoint/credential/grant is inferred. This alternative removes the full user envelope by borrowing original held file chunks, but still requires concrete bounded native queued-message/kernel/control ownership and whole transaction source/custody proof before any positive fit claim.

Original command decode lifetime and borrowed field representation

The actual owning dispatch in command-engine.hpp is serialized by originalDispatch_ and NativeCommandSequence permits one original inFlight_ command. Decode currently creates eleven default-allocator std::string members in NativeCommand (actor/client/provider/reference/stage/preflight/confirmation/operationId/capsule/event/error plus declaration/binding internal strings); the structural caps do not charge their allocator metadata or repeated temporary substrings. All23 op decoders finish Reader::end before effect dispatch, preserving original duplicate/trailing/error disposition. chunk/payload/rawKey already borrow actual immutable request spans, with ResolveKey's originalRawKeyOffset separately retained for exact source-owned wipe. None of these views is authority or a retained source approval.

The complete private ABI amendment selects OriginalCommandTextView as an original-request extent ordinal plus U32 offset/U32 byteLength, borrowed from the SAME immutable command frame until completed effect/result/archive handoff. String predicates scan original bounded UTF8 bytes without heap substring copies. Exact limits remain actor/client256, provider128, catalogue reference256, opaque reference36, error64; declaration/binding preserve their existing closed decoder and scalar predicates. Secret confirmation/rawKey fields receive original privacy classification before any observer copy. This changes the private native representation only, not the actual byte length prefixes/op sequence/command fields or failure code semantics. It must replace commandScope/reference/binding decoders and all journal/storage/result consumers together; an implicit std::string conversion or compatibility overload is forbidden because it recreates unowned copies.

The dispatcher retains one original command frame, its text views, original result backing and actual failure/result/control records while request response/IO/archive borrowers exist. completeOriginal increments sequence only after selected effect completion; response failure permanently unresolved does not erase already committed effects. Sequence exhaustion remains UINT32_MAX with no renewal or reconnect by supplied digest. A single command inFlight bound is not a bound on cumulative retained native attempts, previous command archive records or storage borrowers. The full per-effect progress/history proof remains necessary and cannot be replaced with23 command cells merely because there are23 operation variants. Undefined owning effects are explicitly source work, with no synthetic default success or denial bodies counted as implementations.

Original input lease migration is an owning interface change

FULL actual original-input-lease.hpp confirms OriginalInputObjectRead is only transferred-object IO, never authentic realm/source approval. Its current readOriginal template passes a local NativeReadBuffer byte vector to a consumer then destroys that local at loop end, while originalSnapshot allocates a second complete object backing and copies bytes. Its unique_ptr EOF retains an actual nonzero-destination read but its object/control/default allocator and earlier per-read raw IO owners still lack the shared physical/archive producer. These source facts must not be relabelled a completed native borrower interface.

Select the shared OriginalInputWindowLease data-level migration: each actual read attempt commits into its pre-enrolled native result/cell; returned immutable window borrows the actual original read backing and raw SDK result, root/object/source/clock/deadline/IO association until genuine observer archive/effect consumption. The next chunk cannot reuse that backing while a borrower remains. Native owner transfer or actual endedIO+zero borrowers establishes retirement; consumer callback return is never an acknowledgement or source authority. Whole-file snapshot creation may allocate exactly one separately charged immutable snapshot only where the actual phase requires it, with the original read window separately accounted until copy/archive/borrower closure. Reference-source leases remain bounded nonresident original objects with such windows rather than manyMB resident source copies. Acquisition producer, authentic association and exact source qualification remain CE2 conjuncts independent of this IO representation.

Short-progress history capacity is a real supported-route condition

The source permits a positive one-byte read for each byte of a67145545-byte capsule signing preimage. Retaining one144-byte attempt record per such read would require9668958480 bytes for the attempt records alone; even an64-byte archive index per read would require4297314880. These resident record representations exceed parser134217728 before byte captures/SDK/results/receipts/clock/control;167772160 is stage reservation and supplies no native history allowance. Separately finite authentic retained history geometry must cover actual attempts. Thus the source must not promise that EVERY API-permitted short-read trace reaches successful64MiB signing under these original finite limits. Existing source/native resource exhaustion may truthfully deny before the next attempt while retaining prior original state. This is distinct from narrowing the supported inventory byte bound: a full64MiB trace with genuine sufficient native progress still requires a concrete positive finite-capacity source path.

The complete decision needs an explicit admitted source-native progress/record layout for that positive path and exact exhaustion semantics for worse progress, never silently treating requested65536 as returned65536. A fixed call quantum, elapsed40s or raw-storage size cannot be promoted into an OS progress guarantee. Durable streaming history can reduce resident controls but must count original archive IO attempts and actual bounded retained indexes, failure/pending ownership and chosen terminal witness semantics. The independently unresolved terminal contract cannot be assumed to provide free final archive closure. This numeric counterevidence explains why choosing a guessed universal per-command history pool is insufficient; it does not authorize dropped history, synthetic positive receipts, a new capacity field or a reduced capsule byte limit.

Reference interpreter interruption order remains original

NQ's retained original interpreter source identifies six fused SKIP_UNTIL scan loops without HandleInterrupts inside the scan body, whereas POP_BT increments its actual uint32 backtrack count and handles interrupts before pop/jump. The private qualifier cannot replace that with invented per-byte polling/backtrack counting or claim original cancellation/failure order from an adapter boolean. Shared D1 retains actual absolute end and source-native owner checks at real admitted transition/call boundaries; no end renewal. A result produced after genuine original end cannot be accepted merely because the reference loop lacked an interrupt checkpoint. The whole source decision must resolve native qualification work scheduling/end observation without silently changing the admitted reference semantics, exposing a new public error or manufacturing an interruption receipt. This source fact is counterevidence to a guessed universal per-byte deadline bound, not an executed runtime observation or selected compiler change.

Original row inventory and native overlay consumer closure

Actual journal-schema.hpp original collections include reservation resourceRefs up to128 per reservation, seven4096-row collections, outbox8192 and retained keyVersions64. NativeJournalView validates these original nested resource lists as borrowed original row spans; a36928-row top-level index is not a count of all nested resource objects. No unowned std::set/map/string index or128-per-row full expanded copy may remain hidden. Resource identity lookup uses bounded original span comparisons and a charged transient lookup index only for the current source-native operation, with full original duplicates/state rules checked independently. Original resource state released requires every real resource closed, never merely a new logical row value.

The closed consumer inventory is all23 decoded commands, NativeJournalCommandState's OPEN/READ_OPERATION/LOOKUP_PREFLIGHT/PREACCEPT_INTENT/RESOLVE_KEY, NativeJournalStore original read/publication/recovery, every eighteen owning effect definition, selector schema/publication and result encoders. Reservation/stage/preflight/operation/keyMapping/capsule/outbox/writeIntent rows retain EXACT current fields and original cross-row identities. No imported generic replacement row bypasses original declaration/binding/template/projection/audit validation. In particular operations' projection timestamps require actual original UTC authority; confirmation expiry/source secret fields cannot be generated from the current monotonic end or independently archived whole secret-bearing row. A typed overlay with missing original time/receipt/custody remains unavailable rather than accepting a supplied canonical row.

The source-native transition producer must name each row it changes and retain its genuine original lock/current-slot/index/provider/IO borrowers through completed publication. Recovery processes original pending attempts under the same explicit states and actual native evidence: it cannot bulk-mark every row released/acknowledged or reuse one mutable result as proof of4096 distinct resources. Row caps bound inventory, not the number of short native reads, resource-close attempts or raw observations required to resolve that inventory. Closed all23 ownership/transition code is still unfinished; this explicit inventory is the interface coverage requirement for the whole source decision, not a completed effect count.

Actual journal-schema.hpp lines91–92 require EACH reservation historySlots2, operationSlots1, auditSlots8 and journalBytes32768, with original aggregate raw167772160/expanded1073741824/copies134217728/capsule1073741824/journal16777216 census for unreleased reservations. These are selected durable logical inventory reservations, not native observer attempt/control grants. In particular historySlots2 must not be reinterpreted as two native observations for a64MiB journey, auditSlots8 as eight WriteFile calls, or journalBytes32768 as capacity to omit the required previous/scratch/current full native transaction. Shared physical geometry retains their original accounting and separately maps actual native owners/captures/IO without inventing a new reservation field.

Conductor selection of Windows per-existing-frame messages

The conductor selected the per-existing-BEGIN/CHUNK/END original native message alternative for the PRECODE candidate only. This replaces the candidate whole67195929-byte user envelope; current provider source is not yet changed and dependent implementation waits for the ONE complete CE2/shared-owner whole decision and a DIFFERENT entire review. No fit/native/source/execution grant follows. Provider64 greeting, five domains/preimages, exact original frame lengths/MACs/ordered total, one-use original actor/endpoint/peer association, existing23 operations and final actual channel/IO closure remain unchanged. No ACK/op/grant/new endpoint or F7/Core-secret retention acceptance is introduced. Advisory pipe size still supplies no qualified kernel quota.

The source dependency closure is provider-session.hpp original requestProviderSignature/requestProviderFileSignature BEGIN/CHUNK/END callers and serveProviderSignature; channel.hpp PrivateChannel::sendProviderBody Windows whole-envelope builder, receiveProviderBody/readProviderMessagePiece/ReadFile/ERROR_MORE_DATA boundary state and originalRequestBoundary/originalProviderPeerClosure/originalProviderResponseBoundary; provider-protocol.hpp original authenticated frame/ordered-total parser; provider keyservice caller and actual held-file capsule/journal/selector/audit signing producers; channel/native peer/OVERLAPPED cells/owner frame lifetimes and final read/response/close. The revised sender borrows exactly one existing frame extent at a time until its actual original native write ends. The receiver demands exact one complete authenticated frame per original message and rejects extra/early/trailing boundaries before granting that frame semantic completion. Completing END grants only exact framed-transaction completion, never OS EOF. Subsequent original frames/messages or unsuccessful final channel closure retain actual failure and invalidate selected use. Linux genuine write-side EOF continues distinct original semantics. Whole finite kernel backlog, native control/stack/SDK/error histories and request/response/storage borrowers remain mandatory explicit source qualification; no queue-empty assertion substitutes for them.

Exact current Windows receiveProviderBody rejects providerEnded_ != providerBoundary_, allowing only the END frame to terminate the whole original message. Selected revised state must instead require a genuine message boundary after EVERY original frame and reset only the next-frame boundary state after consuming the preceding authenticated frame; the whole transaction's ended flag remains separate and cannot reset. Header4 read must not already end a message; remaining length+32 must end exactly that same message, with no extra native bytes. Existing operation/order/sequence/MAC parser receives unchanged original bytes. No zero-byte message supplies channel EOF. originalRequestBoundary validates completed framed transaction separately from originalProviderPeerClosure, whose current genuine Windows ERROR_BROKEN_PIPE check remains distinct from TRUE/zero. Actual raw native results/error/OVERLAPPED/end records belong to shared owner/O2 even when the receiver rejects; resetting a state flag is not physical retirement.

Exact per-frame payload owners after selected message change

Current providerFrameMac uses the original NUL-terminated SLCORE-PROVIDER-TRANSPORT-1 domain via sizeof(domain), direction1, nonce32, sequence4, body length4 and original body. Domain bytes are28 including NUL, hence actual preimage body+69; the current Writer capacity body+80 is an independently real allocation request, not the preimage length. Neither may be replaced by companion transport's different preimage formula. At maximum chunk body65549, encoded message is65585. Current Windows writeMessage makes a second65585 NativeIo buffer; held-file signer also retains its65536 fill buffer and chunk body65549. These four payload owners alone sum262255 at write, before actual SDK/control/history/kernel/stack. During MAC construction the65536 payload+65549 body+65585 message+Writer capacity65629 sum262299. This is a source payload subtotal for the selected finite-frame implementation, not whole physical peak or an assertion that original IO/archival borrowers already retire. Actual NativeIo metadata/events/OVERLAPPED and kernel queues remain separately genuine owners.

Receiver original header4, body+MAC65581, extracted body65549 and MAC Writer65629 may coexist; current readProviderMessagePiece's NativeIo output extent may remain borrowed by original O2 history beyond byte copy, so it cannot be omitted merely because a shared_ptr local resets. ProviderRequestReader/ProtectedKeySet chunk currently returns copied Bytes under a callback; the shared private ABI must consume a borrowed original authenticated frame window and actual once-consumed signer scope instead, retaining frame/IO/source/clock/privacy through genuine effect/archive consumption. No copying a requested chunk and then wiping its original frame creates positive readback or borrower closure. Frame-sized finite windows remove the67195929 user envelope without claiming a full allocation-free path.

Inert exact record-layout source for whole review

The new physical-owner-layout-proposal.hpp expresses only source-private fixed records and compile-time size/alignment predicates. It is not included by production source and defines no allocation, root enrollment, grant, native call, archive publication or positive receipt constructor. It cannot repair the current Budget/default allocator implementation by existing as a header. All ordinals identify source-owned records only after a separately reviewed genuine producer joins them; zero-initialized record bytes imply no original observation. Native observer SDK bodies remain disjoint genuine borrowed extents, not structure memcpy wire encodings.

Attempt144 raw field arithmetic must be realized with actual C++ alignment: source-private fixed record storage puts its15 U64 fields first, four U32 next, four U8 flags then four initialized reserved bytes, totaling144 at alignment16. The earlier semantic listing (3U64/2U32/4U8/2U32/U64/11U64/reserved4) was arithmetic only and would introduce padding if translated literally. Source ABI order may change privately because no structure is serialized; original closed11-field primitive/frame codecs remain unchanged. Compiler size assertions are prospective and unexecuted under the source-only gate.

Result128 exact storage likewise uses fourteen U64 original native return/association fields (scalar,error,handle,pid,tid,flags,attempt,bodyLength,input,output,cell,IO,stack,publication)=112, private sourceApi U32+closed disposition U16+entered U8+definedness U8=8 and initialized reserved8, totaling128. Cell and IO have DISTINCT full64-bit ordinals; neither is truncated or combined into an untyped packed pointer. The earlier semantic sixteen-U64 listing did not correctly enumerate its seventeen concepts and is superseded by this explicit declaration. Private callsite/disposition widths are source-closed values, not truncation of native returned status/handle/pid/tid, which remain fullU64 plus the actual raw SDK frame. No compiler/build was run to assert these prospective layouts.

The inert source header now also realizes CapsuleNamespaceHeader816/Entry288 and CapsuleReadHeader160/Entry288 with explicit storage order and prospective size/alignment assertions. This is storage layout only: proposed NativeCapsuleNamespaceView/QualifiedNamespace must borrow these records from a genuine primary owner and accepted catalogue/source producer, not expose a writable public aggregate as approval. Original catalogue repository metadata is NOT stored/truncated into this header; its unbounded accepted strings remain original nonresident source spans under authentic catalogue leases. Namespace128-entry bank37680 and each read bank37024 remain representation subtotals, with exact owner/borrower/extent/page controls separately charged. No dynamic metadata/default-allocator compatibility conversion is introduced.

Selected provider phase separation and original kernel queue equation

Each original selected Windows message is BEGIN<=114 bytes, CHUNK<=65585 or END45, with the original whole capsule framed-byte sum67195929 and at most1027 message writes. No requested pipe buffer size proves allocation rounding/control. The qualified original kernel-owner equation must include at most the actually outstanding sum of those original message bytes plus source-native per-message/pipe/IO quota rounding and controls; it cannot replace that with1027*65585 or an unmeasured fixed65536 pool and label it exact. The whole original source/native queue observations and implementation qualification establish actual native occupancy; current API documentation alone does not. Deadlines/peer lifetime constrain permission and completion, not allocation quantum.

Provider signing begins only AFTER the original semantic stage phase and actual operation17 append/readback+archive/effect handoff have completed and all expanded/snapshot byte borrowers physically ended under the consuming-phase transition. Therefore original NQ match stack/compile program/expanded file bank cannot silently remain concurrent with a provider kernel backlog. Conversely the genuine namespace/catalogue/stage metadata/source leases, current journal/index/locks, capsule held original file, signer/HMAC state, original peer/clock/control/failure/observer archive views still remain actual same-owner objects. The proposed source route requires those real transitions, not a source function return. A generic full64MiB capacity fixture demonstrates only framed/storage byte support and cannot mint QualifiedNamespace, owner-policy acceptance or an authentic catalogue row. Current selected owner policy's smaller semantic accepted inventory is not permission to remove the generic full64 original supported native framing capacity.

Actual UTC remains distinct from D1 monotonic authority

Native audit-frame.hpp original admission payload is EXACT seventeen keys without timestamp. Native audit-storage.hpp explicitly implements frame append/read state but neither signed index publication nor durable Audit receipt. Existing journalProjection requires createdAt and completedAt genuine UTC ISO24, whereas D1 end is monotonic original permission. Controller's Date.now stage/confirmation expiry and software audit query metadata do not provide independent native UTC evidence. The eighteen owning effects cannot substitute original eventId entropy/timestamp encoding, unsigned index metadata, monotonic end conversion or a renewed deadline as UTC source.

The candidate original native UTC producer would use actual Win32 GetSystemTimePreciseAsFileTime or Linux clock_gettime(CLOCK_REALTIME) from the original retained sampler/process/task/domain, correlated with actual D1 monotonic sampling attempts and complete original returned SDK bytes. This is a separate SOURCE CHOICE needing the complete A1/O2 clock/source/receipt/index/persistence whole decision, not a currently selected positive adapter. It must record actual wall-clock reversals/unknown results truthfully and never claim NTP/server accuracy beyond original source qualifications. No new public primitive operation is inferred: actual native auxiliary UTC observation and its private source association must be explicitly mapped without relabelling FILETIME as QPC bytes or REALTIME as a MONOTONIC read. The source's real original native time authority, signature linkage, event correlation/order/restart/query semantics and original clock lifetime must be selected together. Existing provider Audit domain accepts the original17-key body; signing an arbitrary timestamp index under that domain would change the selected preimage/validator and is prohibited without exact governed amendment. No A1 trust/persistence code is implemented here.

Read-only primary API documentation supports only the above candidate UTC API behavior: https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsystemtimepreciseasfiletime describes a VOID function returning original FILETIME UTC through output; it distinguishes time-of-day from QPC interval measurements. https://man7.org/linux/man-pages/man2/clock_gettime.2.html describes CLOCK_REALTIME as system-wide wall-clock time affected by discontinuities/adjustments, with original0/-1 and errno disposition. These documents do not admit the native source/image/clock, establish UTC accuracy, qualify a sampler, sign an index or change the closed primitive operation grammar. Any source implementation must retain the actual output/error definedness and full original native body/association rather than inventing a successful returned scalar for the VOID Windows API.

SourceMemberIndex96 is now also explicit in the inert layout source. It borrows the SAME original archive/root/source authority through its bank owner and genuine live window borrower; it is not a per-entry native handle/caller approval. At the actual47300+3 source records the raw index bank is4541088, with exact backend rounding/extents/control and genuine original manifest/archive/read/EOF/clock/failure/SDK borrowers separately counted. This bank replaces neither complete logical source graph validation nor actual immutable archive object custody. It may coexist with the later NQ phase only under that full actual source-origin equation; no second parser128 pool or residual allowance is allocated.

Owning stage-read join: original23 caller/result custody, not transferred native storage handles

Current source inspection binds this gap to command-engine.hpp, command.hpp, stage-storage.hpp and the actual NativeAdmissionChannel caller. Engine lookupStage/readStage/releaseStageRead remain declarations. NativeStageRead has an original writer, independently reopened held reader, original identity, declaration, running SHA and monotone offset; its local close boolean is neither the RELEASE_STAGE_READ wire receipt nor the independent native close/archive proof. NativeStageStorage::writeOriginal currently destroys each local same-handle readback owner at loop iteration end. finish retains only its final zero-byte read buffer. Those real prior readback owners cannot disappear from mandatory history merely because finish retains EOF.

The selected candidate producer path is engine-owned StageSession, created only after original journal scoped actor/client/provider/workspace/stage checks and original written-object/read-receipt checks. It owns the reopened NativeStageRead and an original peer-bound channel-result sequence association. A read token is an opaque original resource correlation checked against that owning slot/generation; token bytes are not a process handle, source approval or independent receipt. LOOKUP_STAGE publishes the existing exact result fields only after actual reopen/identity observations are bound to the source-owned read session and mandatory archive/effect handoff. READ_STAGE checks the original token, exact expected offset and actual maximum, performs the original nonzero-capacity native read even at the declared total, and binds the actual result window to the request and response ordinals before exposing existing bytes/count/EOF fields. EOF is generated only by that real zero-byte native read, after full declared SHA/count and continuing writer/reader custody checks. Counter completion and declared-length exhaustion do not produce EOF.

CoreStageSnapshot is created on Core A from its actual authenticated23 inline responses, not from the companion file descriptor/HANDLE. Every response must retain exact original request sequence, framing/MAC validation, peer/channel lifetime, actual response body window and its source-owned result association before Node/NAPI exposure. Snapshot total is the original declaration raw count, at most10485760; exactly one genuine Core-owned snapshot backing may assemble the original chunks. A result window can cease occupying its payload extent only after its original bytes have been copied/checked into that backing and its real mandatory archive/effect borrowers have ended. The metadata association and actual failed/partial history remain held independently. This is a proposed consuming producer; current unique_ptr response destruction and NAPI Buffer copies do not implement it.

RELEASE_STAGE_READ admits one actual close attempt only after genuine snapshot/full response/EOF receipt consumers release their reader/session borrowers. It archives the original close result, source-owned object/clock/IO associations and required original read-receipt handoff before returning the existing exact response. If borrowers remain, native close is not entered: the pre-enrolled result records that actual disposition without a fabricated close or EOF primitive. Failed close, failed archive, expired original deadline or unresolved original writer/session retains the original custody slot and exact native failure. No destructor retry, resource-name lookup, reconnect or resetting the offset may repair the original association. The current class close method alone cannot be counted as this handler.

The proposed source representation keeps stage journal index rows under the original4096 stage bound; simultaneous reopened reader cells, response windows and failed/retained read-session objects are separate actual owner records. The4096 bound is NOT permission to allocate4096 complete10MiB snapshots, nor an inferred limit on repeated READ_STAGE calls or failed native attempts. Exact resource enrollment and source-owned pre-effect extent/cell reservations gate each actual reopening/read/result/close operation. Original wire/state semantics do not receive a new session count or byte cap from this candidate. Full64MiB capsule capacity remains a distinct phase from this original10MiB upload snapshot.

CE2 whole engine constructor and all23 owning-effect contract candidate

These are complete effect obligations for the proposed source boundary, not definitions already present in command-engine.hpp. There is no five-effect delivery subset. Existing original native store/stage/capsule/materializer components are consumers under these joins; no component can construct source approval or a receipt from caller digests. Each effect owns its original entered native attempts, same-instance deadline lease, input/result windows, source/native objects and mandatory evidence borrowers through the stated durable/consuming boundary.

The original companion administrative action produces OriginalAdmissionInputsLease only after the existing owner-realm producer AND offered-packet approval conjuncts, actual original independent B baseline/image, full P/G/allC/Q/S/I/source graph and held transferred object associations are checked. That lease retains the original importer/root/object/clock/peer/source lifetimes. OriginalNativeAdmissionOwner is constructed from those real source-qualified physical/resource associations and the concrete shared root/frame/cell layout; neither Budget nor decoded calibration outcome is this constructor. Before first HTTP sample, original capture-task/domain and failure-frame/root capacity are pre-enrolled by the owning production entry path. The proposed owning types require actual producer definitions after whole review; existing absent authentic resources retain unavailability rather than a successful callback.

NativeApplicationConnection::configured consumes the immutable original request capture/end plus borrowed owner/importer/workspace/services/storage/catalog/provider associations. Workspace and services strings remain correlations checked against original held roots, not path resolution authority. It creates the original companion channel/peer/source/deadline ownership and exactly one request-scope lease; partial acquisition retains failure and cannot enroll another realm. The digest-only connect API can consume only an already enrolled original scope whose profile/workspace correlations and actual remaining end match; with no such owned scope it stays unavailable and never creates a duration or a grant. The production caller is configuredCoreAdmissionApplication after original request/auth/permission gates, using the preexisting native deadline token; no browser credential is forwarded to this constructor.

NativeCommandEngine's owning constructor consumes original JournalStore, AuditStore, held storage/stage/capsule/services roots, original catalog/reference-runtime source leases, provider workspace/key-version lineage, original observer/effect/archive leases and SAME physical owner. Its original engine lock protects journal generation selection, candidate overlay and one-effect dispatch; object/session/result leases remain beyond that lock until real consumers finish. Constructor checks all resource/current-source associations and recovers original current selector/journal/outbox/write intents before accepting ordinary effects. Initialization lineage does not become source approval. Resources are not created when absent, and a signed empty Journal alone cannot enroll the engine.

Existing operation	Owning selected source contract and publication boundary
1 OPEN	Validate exact original profile/workspace/provider/keyset/init/store lineage; read both original current slots with distinct one-use provider transactions; select fully valid signed original generation; expose existing generation/resource fields only from that selection.
2 READ_ASSETS	Resolve only an original admitted catalog reference; retain exactly the original four held asset/source/owner associations and actual byte/count/hash/read/EOF windows; expose original result bytes without approving a decoded row or copying an unconstrained repository string into unowned storage.
3 RESERVE_STAGE	Validate actor/client/catalog/declaration/expiry against original scoped journal and catalog; pre-admit original raw/expanded/copy/history/operation/audit/journal/capsule reservation predicates; create original stage object only under held storage root; publish reservation and stage rows in one signed generation with real object/effect receipt. Failure retains created objects and original reserved resources.
4 WRITE_STAGE	Require exact current stage object/state/offset; native write original request bytes, full same-handle readback and continuing identity; preserve every actual read/write attempt. Zero-chunk final flag invokes genuine flush/full declared SHA readback/nonzero-capacity native EOF before publishing written state and original nativeWriteReceiptRef.
5 PREFLIGHT_SEAL	Require original written stage/declaration, real stage-read receipt, exact actor/client/expiry/confirmation association and source-qualified namespace/binding; publish stage sealed/binding plus unique preflight together. No parser caller or decoded Binding manufactures qualification. Confirmation bytes remain private.
6 PREACCEPT_INTENT	Validate exact sealed preflight/capsule and canonical premutation Audit17 payload; publish original pending outbox intent before any accepted operation or materialization write.
7 AUDIT_ENSURE	Consume original event/canonical Audit17 payload, bind original journal pending intent, append or correlate exact existing native Audit chain event; original event equality and generation/receipt validation determine response. UTC/index remains the separately explicit A1 boundary, not an unsigned fallback or ID-derived time.
8 ACCEPT	Verify original still-valid confirmation/preflight/source binding/sealed capsule and original scoped idempotency resolution; atomically publish consumed preflight, operation, key mapping and accepted outbox with all cross-row associations. Replay returns only an existing identical original mapping/operation; altered tuple denies.
9 WRITE_INTENT	Require accepted original operation/capsule and durable premutation/accepted prerequisites; independently discover target absence under held services root; publish original write-intent/absence receipt and never_written→write_intent before creating a candidate.
10 MATERIALIZE	Consume genuine accepted capsule inventory/readback, create confined private candidate, write/flush/same-handle readback/actual mode/full discovery, native no-replace rename, actual held/reopened identity and final discovery. Publish precise observed phase; attempted rename alone does not prove visibility, identity or namespace atomicity.
11 DISCOVER	Under original held root and retained write intent/candidate/source associations, perform actual directory/file discovery/readback/identity and correlate absence/candidate/final namespace. Observe unresolved/foreign states truthfully; no requested outcome or filename digest creates evidence.
12 OUTCOME_PENDING	Require original operation/native evidence digest and precise candidate outcome; publish pending outcome outbox plus candidateOutcome/phase associations. It does not finalize completed before native verification and real Audit acknowledgement.
13 AUDIT_ACK	Validate original event/operation, exact payload SHA/count and actual original Audit generation/receipt against original pending outbox; acknowledge once in signed Journal generation and finalize operation only if its original candidate/evidence/phase prerequisites agree.
14 READ_OPERATION	Scope actor to original operation and selected signed generation; return exact existing projection, not a new write or recovery inference.
15 RECOVER	Authenticate original selector/journal/key-version/store chain; inspect every retained reservation/stage/preflight/capsule/outbox/write-intent/operation from original objects; finish only logically and physically provable pending transitions under original receipts. Unknown stays retained. No unconditional deletion, reset, replayed expired confirmation or reconstructed positive materialization.
16 CLOSE	Check original expected resource digest against actual owned resource set; admit once-only native closure/retirement after real IO/archive/effect/borrowers end. Return exact closure state/digest from actual original closure; unresolved objects remain retained, no GC/destructor success.
17 CAPSULE_CHUNK	Require exact original preflight/qualified consuming namespace and capsule offset; append original inventory windows under reserved held capsule object, same-handle readback and native evidence handoff. Only after actual final byte transfer and zero live byte borrowers can expanded/snapshot payload banks end; metadata/source associations survive.
18 CAPSULE_SEAL	Require exact original count/full namespace inventory/actual capsule readback; use existing provider BEGIN/CHUNK/END preimage stream (Windows per-frame messages candidate); bind genuine provider signature/current peer/closure, exact total/full seal hash and owner/catalog identity before publishing sealed capsule. No second64MiB inventory/envelope and no END-as-EOF.
19 RESOLVE_KEY	Exact source-scoped actor/client/provider/workspace/preflight and original binding; provider-only original actor/raw-key preimage, current retained versions and original mapping comparison. No raw key or direct keyHMAC evidence capture; no private workspace suffix changes fixed preimage.
20 LOOKUP_STAGE	Scope actor/client/provider/workspace/stage against signed Journal; original written object reopen/read-session association produces existing optional read handle only when genuine. Actual generation/declaration/expiry/state returned from original selection.
21 READ_STAGE	Original read-session token/offset/max → actual retained native read, same original writer/reader/peer/source rechecks, native zero-byte EOF/full declared SHA and genuine existing final receipt. Core receives inline23 window; never companionFD/HANDLE.
22 RELEASE_STAGE_READ	Once-only original read-session close after actual result/snapshot/effect/archive borrowers end; preserve precommitted not-entered disposition or actual close failure; exact original closure digest only after genuine source-native custody.
23 LOOKUP_PREFLIGHT	Original actor/client/provider/workspace scope and current selected Journal; expose original binding/declaration/read receipt/expiry/confirmation/consumed operation and generation. Secret confirmation handling remains the exact original private path.

All mutating rows use the original single transaction path: selected authenticated current generation → source-owned typed overlay and exact canonical validation → distinct original one-use Journal and selector provider signing transactions → actual candidate write/flush/full same-handle readback/EOF → native publication/current-slot validation → original selector publication/readback → exact committed generation association. Publication failure retains actual candidate/current/IO/history state. No default map/string/std::vector allocator, current Writer copy or local scope destruction satisfies the physical owner join. Mixed-secret Journal validation/evidence and finite terminal retention choices remain explicitly separate changed-coverage decisions; none of this table selects secrecy declassification or F7 durable-prefix/LIVE acceptance.

Selected original V8 backend and actual Core runtime borrower

Conductor selects the ORIGINAL V8 ctor/test backend for this prospective CE2 candidate, replacing the proposed compressed compiler/cache semantic substitution. All failed compressed graph/Unicode/history/stack/closure proofs remain retained source evidence; their subtotals are not the selected positive implementation. Existing selected jitless flags and original Node22.23.2 source closure remain unchanged. This selects no code, native qualification, measurement, resource or positive lease. The conductor corrected the earlier overbroad whole-Node128 wording: original parser/stream128 coverage plus separately finite ordinary image/startup under SAME owner remain the actual Blueprint37/CE1 classifications. Preexisting cache/heap/backing used by admission is not a foreign or hidden scratch exemption.

The concrete source producer is Core's actual CommonEnvironmentSetup owning setup->isolate(), setup->env() and setup->context(), captured at that original setup construction before AddLinkedBinding/LoadEnvironment. OriginalCoreRuntimeLease retains those actual native objects, setup/platform/runtime/native source/mapped-image/allocator/clock/thread roots and genuine entered lifecycle, not an Isolate pointer supplied through NAPI. Native backend enters on that ORIGINAL Core thread with Locker, IsolateScope, HandleScope and ContextScope. Async companion/uv workers cannot dereference the Isolate; cross-process stage/runtime pointers are never serialized as authority. Stop/teardown waits for actual backend/callback/heap/cache/IO/effect/archive borrowers and records real native lifetime termination.

Fresh source hashes: original api.cc blobf9ce798dc29e1d48c6cb4de84cbcea9ddae0106b470771 bytes SHA20a0bb765f3c65aab3c5fa8a5a52e12ddf000bca0878df0bf41699431a8f6c72 uses its exact internal Isolate conversion at9419. isolate.h8f40fe7e101803ce53ddcfe16d8643a001381399109501 bytes SHA08826979edd2625122dd85c529fd9254b28087d0a90ff05e6621c81e76b70f66 exposes total_regexp_code_generated at1376; heap.h69602363551aa0eb5c648dd4bef7ad176517c962106159 bytes SHA17d7e2fbb6e4fe236f69c8655e5cd265774f4fc2e7bca2e3092237979753b360 exposes CommittedMemoryExecutable at1271. These exact native source getters support genuine same-image current-runtime observations; their sampled values are NOT zero invariants, supplied JSON measurements or permission to alter a counter. Original constructor/matcher actually performs its own original cache hit/miss/one-byte/two-byte compilation, postpeephole ByteArray creation/Size charging and IncreaseTotalRegexpCodeGenerated chronology. No logical port-history overlay replaces or fabricates those real effects.

Ctor AND test are source-selected exact original operations. Original api.cc7935 RegExp::New calls JSRegExp::New; its7992+ Exec API instead uses RegExpUtils::RegExpExec and allocates/returns an Object through exec-property lookup. That API is NOT selected as a substitute for the original .test boolean path. Proposed OriginalCoreRegExpBackend is a source-private fixed native-owned invocation closure executing the original JS expression new RegExp(pattern,flags).test(subject) in the actual original Core context; syntax-only validation executes the original new RegExp(pattern) without test. The closure code is an immutable constant belonging to the exact approved same-image production source, compiled once under original owner hooks on that actual context, never from caller code/argv/ENV/file or a supplied function callback. Its native strong function/context/source handles retain actual code/data and creation observations. Actual original RegExp constructor/prototype/test and related intrinsic identities/descriptor state must correlate with the source-qualified original context before use and after completion; mismatched/unknown source or replacement leaves native admission unavailable rather than substituting a decoded flag/builtin label. This is an explicit source-native runtime predicate, not a new public profile field.

Pattern/subject arguments are genuine source-owned primitive V8 String borrowers produced by the existing exact Core JSON/UTF8/path/config source codecs, preserving actual one-/two-byte/internalized/cache representation and original UTF16 units. Native code must not force every Latin1 result to one-byte, normalize Unicode, use a supplied decoded string as an approved source object or retain mutable Node Buffer equality as original byte evidence. flags are only the original source-selected u/iu/imu matching values, and the original unflagged constructor-only validation; staged modifiers/duplicate names follow the actual selected source flags. Source policy validation/canonical JSON/entry inventory remains original ordered validation, with this backend returning an actual boolean/exception observation under its original owning context. The boolean is a runtime result, not a primitive11 native receipt or source approval.

The native backend call is synchronous on the actual owning Core thread and preserves original V8 interrupt/backtrack/stack/exception behavior; no per-byte polling is inserted in fused SKIP_UNTIL loops and no NewWithBacktrackLimit changes original semantics. Source-native D1 end checks occur before and after genuine original transitions. Original late completion cannot become accepted after expiry or renew authority for Audit. Ownerpolicy RegExp exceptions retain original private generic mapping; outputvar syntax validation retains original caught manifest_schema_invalid mapping. Cancellation/OOM/stack/unknown source/runtime failures preserve exact observed native/JS result and original ownership; returning or dropping HandleScope does not certify cache/string/heap/backing retirement.

Source-owned allocator hooks must precede the actual Node/V8/ICU/OpenSSL/uv/parser/compiler/cache allocation they claim. The SAME complete owner records real heap/pages/suballocation/backing/code/cache/threadstack/TLS/IO/metadata/image classifications; cached programs, internalized strings, handle roots, failed compilations and original prior-regexp artifacts persist until actual source VM/native retirement. Full native body snapshot/expanded windows, original response/frame/SDK/history/source index/native catalog observations and backend overlaps remain in the exact128 parser/stream equation where attributable. Ordinary source-qualified image/startup bounds stay finite and explicit; no second parser pool/CLI budget/GC-free credit applies. Future native C/source/profile measurements can establish actual eligible resource tuples only through genuine source-owned hooks/objects/qualification, never from an asserted outcome or guessed cap. The source code/hooks/layout/callsite and finite capacity equations must be complete in the ONE whole candidate before positive implementation.

Single current private measurement carrier and capacity predicate

The unchanged original C9 wrapper's measurementRef resolves ONLY the exact9-key service-lasso.core-native-measurement.v1 record and exact8-key service-lasso.core-native-geometry.v1 body selected in CORE-ORIGINAL-OWNER-REALM-AMENDMENT-PRECODE.md. That record uses success/unavailable/failure, distinctly from C9's qualified label. ABI8, allocationClass7, nativeObject6, sourcePhase5 and count2 rows are strict closed current vocabulary; unknown/duplicate keys, missing required original source/native associations or overflow reject. No parsed outcome, digest or numeric count grants source/physical capacity.

The earlier sixteen-key service-lasso.core-native-owner-measurement.v1 /ABI5/pageGeometry3/qualified-failed-unresolved codec has been removed from CURRENT dispatch and remains exclusively historical in frozen whole reconciliation01/SOURCE-MANIFEST.json. No permissive union, compatibility fallback or chaining to that former body is permitted. Its complete physical coverage obligations remain required: original allocation ordinal/generation/backing/class/borrower/retirement history; full original threadstack/TLS/callgraph/SDK source ABI and local return subextent; EXACT23 actual owning programmes and their native effects/rejection/failure/recovery paths; retained144/128/128/64/16 attempt/result/receipt/index/privacy records plus all actual header/root/extent/rounding costs; native IO input/output/control/defined-error/completion/borrowers; actual kernel/view/mapping/queue/source backing and every immutable raw observation under its original source/task/birth/object/clock/API/closure association. Current originalObservationRef/nativeBuildRef/sourceProgrammeRef and O2 typed original leases must resolve all of those actual observations and algorithms; compact scalar keys omit no required native width or SDK structure proof.

Unknown original SDK/threadstack/kernel/retirement geometry denies positive owner enrollment. Exact current protocol maxima are not universal output quotas; current eighteen owning definitions remain source gaps and cannot be calibrated by their operation table alone. Advisory pipe size, JS reachability, cache Age, source filename, fs-verity digest, shared_ptr destruction or a supplied tuple cannot prove native physical lifetime. No256-row ring, arbitrary fixed retry count, discarded history or extra parser pool is selected. Direct secrets and unresolved terminal/mixed-secret217 coverage remain unchanged independent requirements. No authentic positive measurement/qualification/native producer exists here.

The whole phase predicate is explicit and parametric, not a fresh numeric grant. At every original source transition t, parser-resident(t)=SUM distinct still-owned parser-stream physical backings(t) including page/arena rounding, actual retained borrower cells, stack-attributable parser execution, compiler/cache/heap/string/backtrack/IO/native result/history and actual shared-source windows; parser-resident(t)<=134217728. Ordinary runtime/image/startup backings have their own finite original source/native limits under the SAME owner and are included in total-owner(t), without a second parser allowance or foreign/preexisting exemption. Stage-declared compressed reservation storage(t)<=167772160 and capsules(t)<=1073741824 apply only to their original storage domains. Every kernel/stack/SDK/fragmentation/control owner is finite and accounted once under actual source attribution. The predicate is checked prospectively before growth and again at actual publication/retirement; no measured RSS/GC/source cap is a physical bound.

For the original generic64MiB provider phase the selected per-frame Windows path retains no complete67195929-byte user envelope. The true original inventory backing67108864 may remain until the actual native capsule/archive transfer, alongside actual<=65585 message/frame slices and their genuine MAC/IO/control borrowers. There is no second67108864 Node representation. Metadata/path/mode/count/hash and original native source/catalog leases survive MetadataOnly; byte banks end only after actual op17 complete readback, reviewed O2 handoff and zero physical byte borrowers. This removes the proved134304793 duplicate-user-backing contradiction but does not prove fit: remaining real controls, kernel queues, histories, IO, V8 parser/cache/stack owners and page rounding must satisfy the predicate. Current controller Buffers and default-allocator native objects do not implement this transition. Failure to obtain an independently genuine finite measured/source-supported occupancy keeps native fit unavailable, not a fabricated lower cap or approval of an incomplete command source.

Original constructor/test API source distinction retained

Fresh full original source read binds Node22.23.2 deps/v8/src/builtins/regexp-test.tq Gitblob4e3bcb906c66c2fd9615477173d88330b463b5fe/rawSHA256bb9ce7ed6e3992dee6a04a042545585528852babfb0eb72ed6a42cd38cbf08f5 and deps/v8/include/v8-regexp.h Gitblob135977bfbb85eeb2f673672d39c9eee9367c62b7/rawSHA25655087b09662735d457e46fbb137689019d9a086be1b80cda7157e9d6aa1c176f. These are existing retained original source bodies; no V8/compiler/Node or regexp is run. The original test builtin converts the subject to String, tests its actual fast-RegExp predicate, uses RegExpPrototypeExecBodyWithoutResultFast and returns Boolean in that branch; the slow branch calls original RegExpExec then tests against Null. The public C++ Exec contract returns an Array/Object or Null and mutates global RegExp context. NewWithBacktrackLimit can force match failure after a supplied count. Therefore neither C++ Exec nor a fabricated backtrack limit can implement the selected original .test route by assertion.

The native-owned fixed JS closure deliberately executes the actual original constructor and .test builtin in the genuine existing Core context, preserving both original fast/slow branch selection and any actual original primitive-string conversion, allocation and exception chronology. Its source-owned intrinsic identity predicate is checked for qualification and drift; it does not rewrite ordinary user code or monkey-patch prototypes to force a fast branch. Capturing a different function or accepting a caller callback is forbidden. The original backend's actual cache/heap/return/global-context effects, including a slow-path result allocation if genuinely reached, remain physically owned and prospectively accounted. Source documentation is not a source-runtime approval; the actual qualified build/context/flags and complete native allocation/observation producers remain conditional whole inputs.

Source archive owning reader and build producer interface candidate

Select NativeOriginalSourceArchiveLease as a concrete private source-owned type with original regular object cell ordinal/generation, original actor/source/approval/input lineage, immutable mechanism observation lease, original byte length635654137 for THIS exact Node closure, raw digest observation, SourceMemberIndex96 bank47303, source-native IO/frame/kernel/clock/archive borrower roots and current read-only state. Construction is private to NativeOriginalInputImporter after both actual qualified producer and explicitly approved packet/native object conjunctions. Public borrowers receive originalSourceMember(ordinal) immutable offsets/count/identity and originalSourceBytes(ordinal,offset,maximum,originalDeadline) immutable owner-rooted windows; no function callback, path-open replacement, cloned source vector or approval constructor is exposed. A window's source/cell/frame/backend generations stay strongly joined until actual consumers and archive/effect readback end. Full membership/Git framing/graph validation precedes backend source qualification. The regular archive does not invoke OriginalInputObjectRead's whole-object materialization into a635MiB parser buffer.

The exact current closure association supplies a source-supported bound on source bytes and index count, not a general future Node-version quota or storage permission. A new independently approved source closure requires its own actual complete count/geometry/source association, preserving ordinary supported public version semantics. One original source backing is retained; bounded windows and actual source-level input/object indices consume their real domains. The full source file/kernel/Merkle backing remains in the SAME complete owner under genuine finite source-build/immutable-source ownership; it is not charged as zero, hidden under capsules or multiplied into a second parser pool. Parser-use windows/control/reference borrowers contribute to original134217728 while live. Unknown genuine source backing permission or finite native kernel/cache extent keeps this archive ineligible.

SourceOriginalArchiveBuild is a distinct original governed source-build invocation, not the B40s importer. It accepts actual independently authorized original source-input object associations and an actual NEW task-owned output-root/native write permission plus immutable absolute build end, all supplied by the governed source invocation under the existing actor. Its private constructor cannot derive write permission or end from source approval, a pathname, OS account ownership, build argv/ENV or now+duration. It enumerates exact47300 primary logical associations and3 original additional objects in the defined order; reserves actual source read/input/output/control/native frame/stack/history/Merkle/failure and output backing before each effect; writes the exact112/84 SOURCE-01 carrier with original Git framing/count/digest membership, flushes and performs complete same-original-object readback/real EOF, then ends original writable IO/borrowers before immutable enable. Linux enables/measure fs-verity only on that new original object under actual eligible native grant and observes its full native effects; Windows requires the source-selected held immutable output/exclusion/native qualification path with original write/delete mappings excluded. Unsupported or absent original immutability denies without hashing-as-immutability.

After true immutable verification the build producer offers original held read-only archive/object identity/verity-or-native-exclusion/source readback/closure observations for the separately authenticated source-owner decision; detached ROOT/PACKET/approval remains outside archive bytes. The producer ends its actual original output/write/read/immutable-control borrowers under reviewed history/terminal scope; a build method return, new hash file or source review cannot publish it as qualified. Archive creation output635654137 plus original retained input629291219 logical bytes, actual deduplicated backing, failure retained candidates, kernel/cache/Merkle and source native controls are finite-accounted by the actual original build grant and complete owner. These figures are different logical associations and must not be blindly summed as distinct physical input extents or treated as output permission. No source-build endpoint/actor/credential/settings, archive construction/native ioctl or execution authority is supplied by this candidate.

Selected material R4 compressed-stage validation and replay candidate

Conductor now selects the compressed-original-stage plus checked per-entry cursor/replay as prospective material R4/CE2 PRECODE, superseding its unselected alternative status. This is no semantic-equivalence/physical-fit/source implementation or resource approval. NativeOriginalStageSnapshot is produced only by the Core-owned existing23 READ_STAGE result sequence/framing/MAC/peer/native IO/final original receipt and actual complete source raw snapshot/EOF. It retains the original compressed raw bytes and immutable stage/native source observation, exact declaration, original root/slot/generations, owner and byte borrower links. NativeStageStorage's companion FD/HANDLE is not exposed to Core; no caller supplied file/path or generic read callback produces the snapshot.

OriginalStageInflateValidationLease privately borrows that snapshot and actual source-qualified inflater, full native SDK/frame/stack/IO/error/history owners, original central/local record metadata and current output bank. validateCompleteOriginalArchive preserves the original FULL source-pinned central-order inflate/CRC/SHA/type/name/duplicate/limit and final local-contiguity error ordering BEFORE the first policy/authoring/RegExp. It reserves cumulative original declared expansion quotas before each inflate and never accepts a first-pass subset merely because a later matcher would not use a file. Initial source snapshot may be10MiB and original ZIP262144 policy rejection occurs at its original position; no compiler/matcher stack is live before the actual original rejection point. Exact original inflater return/exception mapping is retained, not a custom success flag or replacement zlib code interpretation.

The validation output bank for an entry can end only through producer-owned endValidatedEntryBytes after its actual bytes/CRC/source association have been committed to retained immutable metadata, every actual current byte consumer and O2 archive/effect readback borrower has ended, and the physical bank has genuinely retired or transferred under SAME owner. The method is unavailable while borrowers/native IO/error outputs remain. Validating every entry and retaining original compressed member association does NOT by itself prove eager-reference allocation/error chronology equivalent; R4 reviewer must assess the actual early payload-end difference explicitly. There is no GC/null/function-return credit or dropped failed history.

NativeStageEntryReplayLease is produced from a COMPLETED original archive validation lease and exact immutable original member ordinal/offset/count/mode/path/CRC/SHA relation. It borrows the SAME original compressed snapshot, actual original reader/inflater/output bank and source-owned reference metadata; identity/full original sourceSHA/sourceEOF/custody are checked before and after actual replay. replayOriginalEntry(offset,maximum,originalDeadline) returns immutable owner-rooted byte windows, never new mutable Node entry Buffers. Complete replay validates original member byte equality, true inflater/source boundaries and real errors; later source read/replay/borrower failure invalidates positive use even after a successful first pass. Additional work/cancel/expiry/read/inflate/history/failure paths are real candidate differences from eager reference and remain inside the original immutable end, with no duration renewal or hidden scratch storage.

The actual original V8 primitive string/JSON owner receives the current entry's genuine original byte window and exact original UTF8/width/internalization/source-codec chronology; it is not told a SHA equals an approved string. Original policy/manifest RegExp constructor/test runs only after full archive validation, with actual cache/heap/compiler/backtrack stack owners and native deadlines. Old entry bank cannot retire while the original V8 string/reference/backend or archive consumer still borrows it; V8 copying/internalization may retain a distinct true allocation and cannot be claimed to transfer ownership by naming a window. Subsequent entries share the one genuinely retired bank only after source-native last-borrower acknowledgement. Metadata/catalogue/namespace and original compressed snapshot remain held for later generic capsule transfer/emission; no second full64MiB expansion is retained.

The original capacity predicates64MiB inventory,10MiB upload,262144 owner ZIP bound,160MiB stage-declared compressed reservation,1GiB capsule aggregate and128MiB parser/stream are unchanged. Whole phases include snapshot, metadata, source index, inflater/window/current entry, original String/JSON/cache/compiler/stack, original transport/provider/IO/result/error/control, O2 histories/archive and actual rounding/kernel owners concurrently. Per-frame Windows provider consumes actual original entry windows or genuine completed native capsule backing, retaining every outstanding IO borrower; it neither keeps a67195929 user envelope nor frees snapshot/metadata at logical return. The whole phase equation and source-native observation/readback/closure producers must be reviewed as ONE candidate; this text grants no positive QualifiedNamespace constructor or native fit and preserves every earlier failed compressed compiler/proof alternative.

Genuine original last-match subject and shared-context lifetime

NQ R4 original builtin source relation binds regexp-test.tq4e3bcb906c66c2fd9615477173d88330b463b5fe and builtins-regexp-gen.cc7f54ca5aee7184f4e48e0f02db6b7b99b238fc2f: the successful fast .test route avoids a JS result array but retains actual original RegExpMatchInfo, whose LastSubject/LastInput fields refer to the original subject. A failed subsequent match does not prove that prior successful subject is released. Thus one active native replay bank is NOT one live V8 subject/body, and even correct physical ending of a native byte bank cannot retire the original V8 strong subject/cache/heap allocation. Source-owner extent accounting keeps actual original subject objects alive until the original context/heap reachability and real allocation/backing end permit retirement.

The selected actual existing Core context is shared across genuine original Core consumers and calls; it cannot be renamed foreign, assumed pristine/empty or reset between admissions. No clearing lastMatchInfo, new private context, cache reset, replacement intrinsic or GC timing is selected to manufacture credit. The whole source/context phase model must include genuinely reachable historical subjects and original cache/compiler/width objects from previous calls/other original consumers, without guessing prior content or treating getter fields as native receipts. Current CONFIG forbidden-name/value successful match immediately rejects template_difference_forbidden; a claimed within-one-call progression from one successful large forbidden match to another is not reachable merely by reading the .test implementation. Cross-call/other-consumer histories and actual failure retention still require genuine source reachability/physical observations. Original validated UTF8 nonstream width and JSON-created/internalized width are distinct source relations; no universal two-byte or one-byte simplification supplies fit.

Original allocator failure and growth source counterevidence

Fresh source reads bind original Node22.23.2 deps/v8/src/utils/allocation.cc Gitblobdc8a3696fa41899e8fb297396cd9eb1995eb86fa,13379bytes/rawSHA256c33fc530f3bd21d192d960be448761bcfdfe25e85f9e26f6450daa7dc436802f. Malloced::operator new calls AllocWithRetry and then FatalProcessOutOfMemory on null; AllocWithRetry repeats the native allocation with OnCriticalMemoryPressure; AlignedAllocWithRetry also ends fatal. Original PageAllocator initialization obtains the platform allocator with a default fallback. Therefore installing a page callback, returning null at134217728 or throwing a new C++ Denied through V8/libc frames is NOT a proven recoverable admission denial. No default allocator fallback is selected for original physical ownership. The source-original .test selection does not waive original allocator semantics or provide an undocumented catchable OOM.

Original deps/v8/src/regexp/regexp-stack.cc Gitblobbf1edfae2941934329f4b015be32f37acb4b042f,3417bytes/rawSHA256462a1661e6c9a68c092c90b2878c4ad117fd7d2f69fcda4716fc455ec18c8bd4 has EnsureCapacity return kNullAddress only for requested size above its maximum, otherwise allocates NewArray, copies the old live backing into the new backing and only THEN deletes old owned storage. Its source order requires a true old/new growth overlap, not max(finalSize) accounting. This is the RegExpStack implementation; the selected jitless INTERPRETER's own backtrack stack path must be separately traced before attributing that exact growth routine to an actual match. Generic source presence is not reachability proof, and no guessed96MiB actual stack peak is asserted from these fragments.

Consequently NativeOriginalAllocatorHooks requires a source-qualified no-fallback native allocation path installed before the actual source allocations, an exact source-preserving native failure/entered-call history and a prospectively admitted complete phase reservation proving required original allocation headroom BEFORE backend invocation. An ordinary source-qualified build may instrument original allocation events and owned backing/suballocation without changing the original RegExp algorithm, but cannot call a null/fatal/GC path a recoverable private17-field denial. If the exact supported original tuple cannot provide a complete finite reserved peak, native fit remains unavailable; this does not remove the generic complete API/source implementation or lower original inventory/upload/parser caps. A different recoverable allocator-failure mechanism would be an explicit material source/behavior amendment needing whole decision and review, not an inferred implementation convenience. Existing C measurement and whole source hooks remain unimplemented/ungiven; the concrete original fatal/growth facts are retained in the candidate for whole review, not bypassed by an opaque approved allocator object.

Preentry ownership record versus authority enrollment

The constructor graph has TWO explicit states. NativePreentryOwnershipRoot records actual source-controlled early physical backing/task/thread/image/ABI/API/clock/native failure custody before CRT/Node/V8/HTTP/args parsing. It starts Unqualified and cannot issue a source grant, authenticated actor, original profile, provider capability, QualifiedNamespace or positive admission receipt. Its static source-image bootstrap cells and subsequent genuine native backing have the original physical lifetimes and finite source-selected ownership recorded; no no-op Budget, source label, compile-time own digest or OS account becomes authority. All exact ordinary startup/image and parser-origin extents remain accounted while unqualified. No runtime allocation/constructor is executed in this source task.

NativeOriginalInputImporter can transition that SAME existing root to AuthenticatedOriginalInputs only after the original independently admitted baseline producer AND explicitly owner-approved offered packet/native custody/native qualification/profile/grant/calibration/source associations pass. It does not allocate a new parser pool, discard early history, change original first samples or rebase a deadline. The source-owned actual early source/native observations must resolve the exact qualified source/build/image/clock/allocator/body/SDK predicates of the independently offered original inputs; mismatch or missing early custody consumes enrollment and leaves native admission unavailable. A measurement file or actor qualified label cannot turn incomplete preentry history into authentic observation. The qualified root keeps its actual original birth/physical frame generations and original unqualified-attempt history; only its authority predicate changes through the authentic importer.

This makes bootstrap data ownership distinct from the source/trust positive constructor. It is not a provisioned source realm or permission for source execution/VM/native IO: actual production launch and initial source-native resource effects require the separately governed exact full source GO and execution ROOT/tool/resource admission. The prospective source entry must exist before first allocation/sample; current core-image.cpp's ordinary std vectors/platform/setup allocations before binding do not implement it. Source reviewed code/image/resource admission supplied independently for a future launch does not become a runtime self-issued grant; owner control-plane decisions and native qualification remain separately checked. No arbitrary argv/ENV/path/hash/current Journal initialization is allowed to construct AuthenticatedOriginalInputs.

The original B administrative entry uses its preexisting root/task/domain and first native sample before args/ROOT/HTTPS, preserving its new private40s end and authentic offered-input enrollment. Core A's preexisting capture root samples at original first dispatch before route/auth, selects the original10s/40s from that SAME tick only after source-owned route association, and worker/peer samplers retain their actual source-native thread/domain/lifecycle joins. Baseline/source/profile unavailability leaves actual capture failure/unqualified state truthful while original authentication-safe ordering continues; an auth401/403 cannot be replaced by a native resource/parser/Audit fallback. Digest-only connect is unavailable unless it resolves a genuine existing owner-bound original work/capture scope; no receive-time now+40s or guessed original authority is constructed.

Provider task resource-work clock: complete prospective internal policy, not caller authority

The exact inherited deadline clauses are source-safe-template-admission.md section finite budgets (line442: native storage/Audit wait10s within original40s; independent timers; late results cannot authorize writes; unresolved native ownership survives timeout), BLUEPRINT115 (keyResolution lifetime at most remaining original40s, no renewal, late-result/connection-loss invalidation), and BLUEPRINT121 (preflight10s/commit40s includes original held reads; independently timed IO retains ownership). BLUEPRINT21/23/101/111 specifies provisioned original provider, fixed domain/version/original bytes and version+MAC, but does not specify a provider accept-origin duration or send caller end in its64-byte greeting. Current provider-session.hpp requestProviderSignature and fileSignature receive the caller Deadline by reference; all current journal/selector/audit/key-resolution callers pass their existing original end. serveProviderSignature also receives a Deadline reference, but no production provider accept-loop, original first-tick producer or positive task constructor currently exists. A duration-only Deadline constructor is not that producer.

The prospective NEW internal resource policy is a provider-local maximum40s task scope, further intersected with any independently selected stricter provider qualification bound. This is not selected implementation authority and requires the complete CE2 different whole review. Its original clock sample is taken by the pre-enrolled provider acceptance task immediately BEFORE the first native accept/connect-wait attempt for that one task, using its owning original sampler/domain/frame/root. Queueing, native accept completion, original peer/process/image association,64-byte greeting authentication, BEGIN decoding, retained-version/domain/scope checks, all ordered CHUNK reads/MACs/HMAC updates, END validation, original request boundary, signature preparation, response write, original peer/channel closure and failed retirement share that immutable provider-local end. It never starts at BEGIN or after queue/auth, never replaces Core's HTTP end, and never transfers deadline authority through provider64/BEGIN. No acceptance tick is described as the original HTTP tick.

The provider can finish a cryptographic operation under its own still-live resource scope after Core's original end, but Core/companion must reject its late result under their original end before publication, keyResolution issuance/use, native writes or accepted generation. Existing stricter storage/Audit10s remains checked inside the original40s, not widened to the provider-local40s. A provider MAC proves its cryptographic scope only; it cannot renew the caller, manufacture an Audit receipt or authorize late mutation. Caller failure/timeout initiates actual cancellation/close under the same owning cells; the provider observes actual original channel loss or its own end. Cancellation is an attempted native effect with retained raw result and pending buffers/handles, not proof of completion. An expired task has no authority to begin a new sign/response; any already-entered operation retains actual completion/unknown state and cannot free backing until the reviewed original IO and archive/borrower retirement obligations end. No independently missing terminal/secrecy grant is supplied by this policy.

The prospective constructor chain is NativePreentryOwnershipRoot -> original provider acceptance-task sampler/frame -> ProviderTaskResourceScope(first native sample, checked fixed end, source program and task generation) -> one original authenticated PrivateChannel -> serveProviderSignature. The caller chain remains original HTTP first sample -> source-selected10s/40s immutable end -> Core worker/companion original domain association -> connectOriginalEndpoint/provider64 -> requestProviderSignature/fileSignature -> original response/body/IO boundary -> caller end check -> owning effect. ResourceScope is a distinct private native type and never converts into an original request token/keyResolution deadline. There is no caller-supplied duration, new public field, extra greeting field, ACK, endpoint, actor, key grant or reset.

Prospective unexecuted whole-path cases: accept queue delayed until expiry before connection; accept completion racing end; greeting/peer authentication consumes whole scope; BEGIN arrives after provider expiry; partial/trailing/duplicate/out-of-order CHUNK; END precedes genuine Linux write EOF; Windows final frame boundary followed by extra frame; response delayed beyond caller10s or40s while provider remains live; provider expires during HMAC/response; caller expires between response authentication and generation publication; failed CancelIoEx or unresolved overlapped completion; Linux close disposition with retained task/image roots; peer exit before closure; provider channel closure after caller abandonment; storage/Audit stricter10s enforcement; same original key-resolution handle cannot be renewed by another provider result. Each retains actual original native attempts, distinguishes never-entered denial from entered/unknown completion, proves no late caller effect, and charges queue/task/frame/SDK/kernel/failed-retirement history in the same complete owner equations. These are specified future vectors, not run results or qualified finite-kernel completion promises.

Provider scope qualification additionally retains the genuine independently admitted startup/image/build and original ProtectedKeySet resource lease, original provider identity/keySet/retained-version association and original caller peer/process/image/lifetime binding through every entered key operation and attempted close. Native key resource acquisition has its own pre-enrolled startup program and independently finite admitted startup end; it is not renewed by creating a signing task. A task may borrow a still-live authentic key resource but cannot initialize, replace, rotate or extend it. Missing/mismatched startup/source/key/profile association remains unavailable. Provider resource expiry invalidates new work and retains physical IO/key-borrower/error ownership; caller acceptance expiry independently invalidates acceptance even if the provider cryptographic/resource scope survives. Every asynchronous caller boundary (connect/accept association, greeting completion, request write completion, response header/body completion, MAC/version verification and original channel-close completion) rechecks the SAME original caller end before the next effect; no single check at final response alone suffices. The existing storage/Audit wait10s is a tighter independent caller-side scope within original40s, including its async waits; provider-local40s cannot widen it. This mapping records the conductor's permission to document the NEW private source policy for complete PRECODE review, not production code/native fit, authentic lease supply or terminal durability selection.

Original interpreter overflow-before-check allocation counterevidence

Fresh retained source read distinguishes the actual jitless interpreter from generic machine RegExpStack. regexp-interpreter.cc original Git31fe5039bdb82477bd5078f7d2ace9252b5cabec/rawSHA256B9144AE37159F741D942D9EF605A2EEEF40373E674FC098DDB3AE3E957EC7AA2 defines BacktrackStack with base::SmallVector<int,64>. push first calls data_.emplace_back(v), THEN tests actual size against RegExpStack::kMaximumStackSize/sizeof(int). Original small-vector.h Git edaab3a7a6b42f27fd5b91844655501b637f70bf Grow allocates power-of-two(max(minCapacity,2*capacity)), copies original in-use bytes, then frees old dynamic storage. It invokes FatalOOM on a null allocation. Therefore, conditionally IF a genuinely reached original allowed pattern/body pushes beyond a64MiB capacity, the overflow-producing push first requires128MiB new and64MiB old concurrent payload backing, BEFORE returning stack-overflow through the original interpreter.192MiB exceeds parser/stream134217728 without any other owner. This is a conditional source transition, not proof any admitted original pattern reaches it, not blanket unsupported-input denial and not a universal Core image limit.

The earlier compressed-port64MiB stack+overflow4 arithmetic cannot qualify this original backend. A complete whole candidate must derive a genuine supported-pattern/input reachability ceiling below that transition, or explicitly submit a compatible material representation/failure-semantics alternative for whole review. Silently checking the max before emplace, preallocating a different stack, chunking SmallVector, dropping old ownership before copy, resetting matching state, making allocator null recoverable or excluding failed growth changes actual source behavior. None is selected by this source observation. All source histories are retained; NQ source owner and conductor received the exact original paths for reachable-callgraph analysis. No pattern/compiler/native test was executed. small-vector.h original8536bytes/rawSHA256AB9E755698529975D924608068911408530DB68063E6614D0C53B2AA9AB99D3F is retained under original-raw-objects/ed/edaab3a7a6b42f27fd5b91844655501b637f70bf.raw; exact source identity does not itself approve a reference runtime or reachability result.

Prospective compatible alternatives for this exact interpreter transition, pending complete whole review: (A) source-derived reachability proof for every accepted original owner pattern/subject and actual retained context/cache chronology establishes a maximum below the growth transition; no narrower pattern language/input cap is permitted. (B) a source-owned interpreter BacktrackStack representation checks the EXISTING semantic maximum before allocating an element that would exceed it, returning the SAME original MaybeThrowStackOverflow branch with the same unchanged accepted language, bytecode, counters and externally observable result/exception. This deliberately changes the overflow attempt allocation chronology and removes original fatal growth allocation; exact failure classification, interrupt/backtrack ordering, stack state rollback and original native failure history are explicit amendment coverage, not inferred equivalence. (C) a source-owned segmented backing preserves integer push/pop/peek/sp/set_sp order, original semantic maximum and same overflow/error API without a new128MiB contiguous replacement; segment/control allocation, actual retained borrow generations, index/arithmetic/native failure ordering and no-copy stack lifetime have concrete owner costs. It cannot use source logical64MiB as permission for an uncharged full backing or claim vector allocation failures are recoverable. Both B and C are material original backend private implementation alternatives, not selected code. The original native-owned JS constructor/test closure and original RegExp language/cache/results remain; any exact semantic/status difference must be named and reviewed. Source allocation hooks and all other parser/stream owners still require a full134217728 phase equation. The conductor requested evaluation of these alternatives, but supplied no positive backend qualification, budget change or implementation grant. Exact original regexp-stack.h Gitdadd0105e0b7161e12e8045c987cd43b7d5367a1 line80 supplies kMaximumStackSize=64*MB. Original interpreter MaybeThrowStackOverflow lines220–226 throws only for CallOrigin::kFromRuntime; other origin returns EXCEPTION for the owning builtin continuation. Any bounded representation alternative must preserve this genuine call-origin distinction and actual continuation/exception propagation; it must not collapse all overflow into a new public policy denial. Current provider-protocol.hpp ProviderRequestReader::eof checks only ended_ grammar; it cannot be used as an original native EOF observation. Current channel.hpp still has the previous whole-Windows-message sender/receiver, so the selected per-existing-frame native message implementation remains prospective until whole review. Its exact native ReadFile/ERROR_MORE_DATA boundaries, request-final-frame association and eventual genuine ERROR_BROKEN_PIPE closure must replace that old code coherently; a codec END or empty queue cannot complete its IO/observer lease.

Historical SOURCE-01 comparison to stage allowance; not an observer cap

The exact source archive635654137bytes exceeds stage-declared compressed reservation167772160, but that reservation is NOT an established observer/source archive cap. Historical arguments assigning complete native source read output to that stage allowance are invalid and remain only in frozen prior inputs. Complete source/evidence custody needs its own authentic finite backing. Chunking limits live IO, not total mandatory retained raw bytes. The source/build archive backing permission and domain must be genuine and separately finite; ordinary source existence or capsule1GiB cannot silently grant this storage. This is a specific unresolved coverage/ownership join, not a reason to truncate source entries/readback/history or claim source hashes prove original native output.

A MATERIAL prospective alternative, requiring explicit whole source/observer review, is typed original-output custody transfer: every actual native IO output is independently compared byte-for-byte to the same genuinely immutable original held source range under its continuing object/source/clock/IO association; the full native attempt, exact output offset/count, immutable source range and original equality operation are archived and read back; the immutable byte borrower then retains that original backing/range through every required consumer. Actual IO output cannot be retired merely because the source file has the same digest. A genuine source-native transfer producer must establish full byte equality and strong object/immutable interval ownership, and the required observer clause must permit the resulting original-body custody scope. This proposal supplies no positive producer, duplicate raw-storage exception, source permission, secret capture approval or durability amendment. If the selected proof requires a distinct independently archived original native output copy, this alternative is incompatible and the exact capacity conflict remains for a complete compatible decision.

Within-limit interpreter growth also requires real old/new overlap: a32MiB dynamic SmallVector capacity growing to64MiB owns96MiB payload until copy/deallocation completes. Thus the overflow precheck alternative alone does NOT prove parser128 fit: at most32MiB remains for all simultaneously owned original stage/source index/metadata/inflater/current native bytes/V8 strings/JSON/cache/compiler/register/match-info/IO/control/history/SDK/kernel/stack/rounding resources. This32MiB is an arithmetic remainder, NOT a selected quota or allowance. Segmented alternative must likewise count every actual segment and control/root/borrower/native failure extent. Neither representation may remove original accepted language or hide prior retained context subjects/cache to manufacture a favorable phase. The complete positive source phase equation must be based on real original live owners and source-defined transitions, with host-native qualification/calibration remaining explicit future inputs.

For whole evaluation, a concrete segmented candidate uses65536-byte payload segments (16384 original int32 cells) and at most1024 simultaneously live segments for the existing67108864-byte semantic stack. Its source-private segment directory can use24-byte rows {extentOrdinalU32,reservedZeroU32,extentGenerationU64,firstStackIndexU32,capacityCellsU32};1024rows=24576 raw bytes, before genuine Root/Extent/Cell/Borrower/rounding/SDK/native allocation result/history costs. Rows are native owner ordinals/generations, not serialized pointers, caller-created segment references or authority. The active stack's original integer operations and bytecode/counter/call-origin behavior remain; max overflow follows the same original continuation, while allocation chronology and failure attempts are explicitly different material coverage for whole review. Segment acquire must be pre-enrolled before the operation, nonthrow native commit preserves actual acquisition result, and original backing end requires genuine zero borrowers/ended interpreter use/native retirement/mandatory history. Directory storage and every segment belong to SAME parser/stream owner; this is not another64MiB pool. This geometry is a candidate representation, not selected code, supported-host allocation or whole fit. A native allocation failure cannot silently become a recoverable public policy error, and no segment can be retired solely by reducing sp while original native borrowers/history remain. The segmented candidate retains every allocated segment until the original interpreter invocation ends; pop/set_sp never free an allocated segment or manufacture phase credit. This matches the original SmallVector capacity retention within an invocation. Later invocation/context lifetime and actual physical retirement still follow original native owner/archive obligations; segment representation does not claim heap/cache or previous match subject retirement.

Selected prospective segmented original interpreter repair

The conductor now selects alternativeC for the ONE whole CE2 prospective PRIVATE source architecture, requiring a DIFFERENT ENTIRE review before implementation. AlternativesA/B and original SmallVector96/192MiB counterevidence remain preserved history. The candidate replaces only the original interpreter BacktrackStack backing representation with the fixed1024-row/65536-byte segment geometry described above; the native-owned original Node/V8 constructor/test closure, bytecode, full original accepted pattern/input language, semantic67108864 maximum, integer push/pop/peek/sp/set_sp ordering, call-origin EXCEPTION/throw continuation and actual counter/interrupt chronology remain. A push that exceeds the EXISTING semantic maximum is checked before obtaining another segment and follows the same original overflow continuation. This deliberately changes original overflow allocation-before-check chronology, within-limit geometric copy allocation and allocation failure locations, and these exact changes are material whole-review contract items. Original allocatorFatalOOM is preserved as fatal where an actual required segment acquisition fails; it is not translated into recoverable denial. No native failure result is fabricated for an allocation that was prevented by the original semantic limit.

Every acquired segment remains held through the complete interpreter invocation, even after pop/set_sp reduces use; actual interpreter end is followed by source-owner borrower/archive/native retirement obligations. The fixed directory24*1024=24576 raw bytes, every segment's actual page/reservation rounding, source owner extent/cell/borrower records, original threadstack/local overlay, SDK/control/result/error/retained failed allocation history and real future qualification belong to the SAME parser/stream134217728 equation. No segment-domain pool, reduced language or foreign/preexisting cache exemption is introduced. The source-qualified build association must explicitly identify this private original interpreter repair rather than claim unmodified Node source/binary equality. The full source archive retains original source and separately approved exact patch/build association; source/approval does not become native image qualification.

Prospective unexecuted review vectors include full allowed positive patterns/subjects; each65536-byte boundary and final64MiB boundary; overflow at maximum+one integer with original CallOrigin propagation; reserve/acquisition failures before any segment becomes usable; successful allocation plus failed publication/archive retained; integer ordering across every segment; pop/set_sp retaining original capacity until genuine interpreter end; exact bytecode/backtrack/interrupt chronology; original successful and failed test subject retention/cache/string-width history across calls; native replay byte-bank end while genuine V8 subject/cache remains; teardown with live original borrowers; actual ended IO/once-close/mandatory archive before physical credit. Segmentation removes the proven stack-copy transition, but cannot establish the whole positive phase fit by itself. This is source proposal selection only, not code, measured native fit, runtime/resource grant, new public cap or execution admission.

Core snapshot immutable bytes and source actor boundary

The selected snapshot producer is the actual Core NativeApplicationConnection23 response adapter, not companion NativeStageRead. Each READ_STAGE original response window remains owned under its actual sequence/header/MAC/peer/native IO and mandatory archive association while the adapter copies the original observed bytes into ONE Core-owned snapshot payload extent at the exact expected offset. Count/offset/hash/canonical declaration and original final EOF/receipt must all correlate before immutable snapshot publication. A response-window copy is a real separate transient allocation/IO borrower until its original transfer/archive/physical end; zero-copy terminology does not erase it. The snapshot never adopts a companion FD/HANDLE or an arbitrary caller Buffer.

The snapshot payload has dedicated page-rounded native extent boundaries, disjoint from control/other mutable payloads. After complete original acquisition/EOF/hash and before NQ borrowing, the proposed source-native immutable transition establishes actual readonly payload mapping protection under the same owner/native attempt/result/lifetime cells; it preserves actual native status and failed protection ownership. This is a private owner backing operation for whole review, not a new public primitive, rights grant or OS readonly attribute claim. No writable Node Buffer/ArrayBuffer view of this snapshot is returned. Native replay/validation borrows const native original windows; original V8 codec/constructor/test receives its actual source-owned String/JSON copies, with their independent heap/context/cache/subject lifetimes retained. Those copies are not relabelled as snapshot borrowers or freed by native snapshot end. Same-image sealed production source controls the native borrowing producer; public caller input cannot construct an original snapshot/approval token.

Core's original runtime isolate/context remains Core-thread-owned; it is not transferred to companion/provider or dereferenced by a worker. Core performs canonical schema/policy/authoring semantics through the selected original backend source. Companion original storage/materializer rechecks its own authentic catalogue/capsule immutable-source/binding/count/path/mode/hash/native custody contract under the existing23 operations. It receives existing authenticated ordered capsule bytes and metadata, not a live Core isolate pointer or a privileged generic JS parser. The whole original native capsule/source binding must preserve that actor separation; a matching digest, caller boolean or MAC alone cannot substitute for the actual source-qualified Core and companion catalogue/namespace association. Original backend heap attribution must count real native backing/page/reservation owners and actual simultaneous parser-use lifetimes; payload sizeof or GC death alone is not physical credit. A shared ordinary startup heap page borrowed by parser cannot be treated as foreign/preexisting/free. The concrete source-native allocation owner must classify the genuine overlapping backing and its source-owned active/history use once under the complete root, while including every attributable parser/stream extent in the original128 predicate and separately finite-accounting ordinary image/startup resources. Default V8 allocation fallback, global malloc, a second heap pool or a supplied decoded category tuple cannot substitute for that source-defined producer. This is an explicit capacity dependency of the original backend, not a universal ordinary image/RSS128 cap.

Normative RAW167772160 scope correction from governing stage reservation clause

Fresh FULL physical read of source-safe-template-admission.md selected finite bounds (line438) states four active-or-retained stages per actor/client and sixteen per workspace/Core instance, then reserve declared compressed plus catalogue maximum expanded/capsule and copy allowance before201: raw aggregate<=167772160, expanded/capsule allowance<=1073741824, parser/stream copy allowance<=134217728; narrower catalogue limits dominate. Sixteen*10485760=167772160. BLUEPRINT37's raw167772160 must retain that governing stage/reservation context. It does NOT expressly impose that number on every source-owner build file or observer archive. Earlier shorthand in this moving candidate describing RAW160MiB as a universal raw-evidence allowance is overbroad and corrected here; corresponding SOURCE635654137-versus160MiB contradiction is conditional only on an independently established actual observer-storage clause, which has not been identified. No stage/capsule/source permission is enlarged by this correction.

SOURCE-01 construction/readback and any separately retained original IO-output archive still require exact genuine finite source/build/evidence storage/backing/native owner/borrower/permission associations. Their storage cannot be charged to the stage compressed allowance or capsule aggregate simply because another number appears large enough. A full original observer raw-copy route may be represented under an independently qualified finite source/evidence storage owner; no original input permission or numeric allowance is invented here. Typed lossless interning remains a separately reviewed alternative, not needed solely to repair an unsupported universal160MiB interpretation. O2's requirements remain: actual pre-enrolled syscall output, immediate result/error/count, original exclusion, genuine independent comparison of ALL actually returned nonsecret bytes against exact immutable source offset before borrower end, real comparison attempts/readback/history and a separate reviewed custody transfer if used. Immutable source bytes alone are not original syscall output, and digest equality is not byte equality.

Selected prospective SOURCE-01 lossless payload interning

Parent source selection is retained at ga-windows-linux-resume-20261004-01/core1643-parent-source01-prospective-selection-oct05-01.json,1453bytes/SHA25670DA042A2B3FB5AC129754F00356DC908818A0AEC87555DF8EB482D4545F3941. Full O2 source response SOURCE-01-ORIGINAL-IO-CUSTODY-CONTRACT.md,12701bytes/SHA256EF9BF4D3A776BBEA1E5A989C4A9D81691280FF36252E558F45D4C0A8E95FE316 was freshly read/verified. OptionI is selected ONLY as concrete prospective whole-review architecture, not acceptance/storage/native/code authority. The complete eight-step original-output transaction and nine object/peer/source/clock/allocation/IO/borrower/archive/generation joins in that exact response are required alongside these owned codecs.

Each actual read reserves attempt/result/index/original output/native IO/source-range/observer comparison/failure cells before entry; immediately commits actual entered/result/error/returned count; excludes all source-owned mutable aliases while the independently admitted observer compares ALL actually returned nonsecret bytes against the exact genuinely immutable original source range; retains native source/task/clock/object/offset/requested/returned/EOF and comparison attempts; calculates any allowed primitive digest from actual held returned bytes; transfers payload representation to the equal original immutable source range BEFORE the temporary original output borrower genuinely ends. Receipt construction consumes those typed original relationships and real archive/readback/retirement chain. Source file bytes are the retained equal raw payload representation, explicitly NOT the original syscall destination; a digest, mapping flag, callback or parsed ordinal does not authorize the transfer. Every receipt consumer retains the source object/range/native immutable interval strongly; pathname reopen/same-hash replacement/task death cannot restore it.

Logical covered bytes and distinct retained physical payload backing are separate exact counters. Repeated full reads count repeated logical native coverage, original actual result/history/index/SDK/control/failure and comparison operations even when their equal payload uses one635654137-byte source backing. Original non-source/unequal/control/framing/SDK-produced body extents retain distinct genuine raw custody and finite backing. Secret ranges retain their real private product/native ownership and selected closure obligations, NEVER raw capture/digest/interner export; the parent selection's secret custody wording supplies no exception to111 and no mixed-secret217 confidence amendment. Source and observer storage/backing/count limits and actual rights must be separately finite and independently authentic; no stage raw160MiB/capsule1GiB borrowing. Original terminal and secrecy choices remain separate and unselected. The source-native constructor and independent observer producer must implement this real chain after whole review; no successful original receipt exists today.

SOURCE-01 construction overlap: retain original output before immutability

A concrete prospective construction representation closes the interner-before-immutable ordering: the separate governed source-build invocation retains the actual original native raw-object read outputs in ONE source-build-owned payload bank until the NEW complete source archive is written, flushed and made genuinely immutable under the selected platform mechanism. Exact raw-object payload total629291219 bytes (all47300 original entries plus original commit/tree/tag, repeated logical entries preserved) is a source-derived raw payload maximum, not a Core parser allowance or a supplied native grant. Actual source read windows target disjoint pre-enrolled spans of that bank; no second full source copy is silently created. Each original read/EOF/identity/result/control/failure is separately retained, every returned span has its original attempt/generation, and original native SHA/Git-object framing checks bind each complete body before its source record header/payload is emitted. Source write input borrows those same genuine original held bytes through actual completion; native write acceptance does not prove readback/durability.

The source-build bank remains owned while final NEW source archive635654137 bytes is established immutable. Only then may the independent original observer compare the actual retained returned spans byte-for-byte with their exact immutable archive member ranges, seal the typed original-output/interner/archive handoff and allow genuine bank retirement after all borrowers/IO/history obligations. This large overlap is in the separately governed finite SOURCE BUILD owner/class, not hidden under Core parser128, stage raw160 or capsule1GiB. When the later Core importer/reference reader borrows the already immutable archive, its actual windows/source index/controls and original parser-use overlap remain charged to the inherited Core domain; it does not inherit a free large native bank or build-process heap.

Windows finalization creates the source-qualified same-object reduced-right readonly duplicate and genuinely ends every write-capable handle/mapping/pending operation before the offered readonly archive is adopted; final full readback/EOF is then from that held readonly original object with continuing write/delete exclusion. Linux enables and measures fs-verity only on the NEW task-owned completed output under eligible source-qualified filesystem/kernel/rights, then performs full held readonly readback/EOF. Neither platform modifies retained source originals. Each genuine readback output remains pre-enrolled and held through actual independent comparison with that already immutable source range and typed lossless interning handoff. Original construction read outputs cannot be discarded before archive immutability merely because their hashes matched. Source-build task end/failed immutability/observer loss retains that entire real bank/output/control ownership; no renewed end/retry creates approval.

The finite storage/resident equation must count the original input backings actually owned by this build invocation (deduplicated only by original physical association, never equal hash), NEW635654137 archive backing and filesystem/native metadata/verity backing, packed629291219 original-return payload bank plus real alignment/page rounding, SourceMemberIndex96*47303=4541088 raw index bytes, actual per-call attempt/result/IO/receipt/index/borrower/control/SDK/threadstack/image/native kernel owners, distinct non-internable control/failure payload and original observer views. Shared observer readonly views count their actual native view/kernel ownership without a fabricated second payload copy; actual copies count separately. Exact backing/category maxima and native permissions require independently authentic source-build/observer qualification. This equation is a complete representation choice, not yet a numeric native allocation license or whole fit; positive construction needs the actual complete source programme/count proof and source-native owner producers after whole review.

SOURCE-01 positive full-request-progress data counts were recomputed from actual original raw-object physical lengths (data-only filesystem sizes; no body rehash/native read):47303 logical members,629291219 total raw body bytes,52596 requested65536-or-final-tail raw body reads plus47303 genuine EOF attempts (one per member), and9700 requested chunks for each635654137-byte complete archive read/write pass plus its separate genuine EOF read. These are source-derived POSITIVE full-progress path counts, NOT an OS return-size guarantee or a universal maximum of every short-progress/native wait trace. Source programme capacity must retain all actual attempts; worse progress consumes real pre-enrolled count/storage slots and denies before the next effect when exhausted, preserving original state rather than dropping history or shrinking source membership. Whole native SDK/clock/identity/close/flush/compare/transfer/archive/terminal/failed counts remain additional; these data counts alone cannot size the complete owner. Each repeated readback pass increments logical coverage even when OptionI shares immutable payload bytes.

SOURCE-01 finite data-loop programme bounds, distinct from positive full-progress counts

The proposed construction/import read and write programmes use a source-owned monotone offset and never restart an already entered body operation under a new end. For a declared original body B, a successful nonterminal body read must return at least one and at most requested original byte; zero is genuine EOF and terminates the read (success only at the exact declared end). A successful write must return at least one byte; zero write is a terminal failed-progress disposition, not a retry. An entered native error terminates that loop after its actual result is retained. No EINTR/EAGAIN retry, polling, size-query retry or async cancellation loop is implicitly included in this count: any selected such transition needs its own explicit finite source programme and real attempt slots before entry. Changing original wrapper retry/error behavior is a whole-review compatibility item; this prospective count does not claim the existing wrappers already implement it.

Therefore a body read of B bytes needs at most B positive-progress entered calls plus one terminating EOF/error call; a body write needs at most B positive-progress calls plus one failed-progress/error call. At exact successful completion a write has no fabricated EOF. The source-derived worst data-read count for all47,303 raw members is629,291,219+47,303=629,338,522 entered calls; the corresponding full archive read pass is635,654,137+1=635,654,138. These deliberately large bounds preserve every possible one-byte successful progress trace, unlike the52,596/9,700 positive requested-progress counts. They are programme upper bounds only for the stated source loop, not promised native completion or resident history counts. Each read call also owns a nonzero actual destination reservation even for expected EOF.

Original attempt/error/index/receipt history is durably paged under the separately selected finite source/observer backing, with every live page and current IO borrower retained. Paging is not deletion or credit for still-borrowed records. The archive encoder cannot recursively demand an unbounded independent witness for every witness write: its original finite terminal/maintenance programme must be separately defined and reviewed before a positive archive producer exists. A bounded cursor does not alone prove that programme. Consequently these data counts may establish finite nonterminal storage lower bounds, but do not authorize choosing resident cell count, truncating history, accepting an unobserved byte, or adopting the unselected durable-prefix/live-terminal alternative.

The complete source programme ledger partitions (1) data body reads/writes, (2) original identity/lock/immutability/flush/close and SDK output sizing calls, (3) original clock/lifecycle checks, (4) independent comparison/readback and typed handoff, (5) archive record/page IO and finite terminal maintenance, and (6) first failure/cancellation/unknown completion. Each partition must declare actual source transition, maximum entered calls, retained output extent, live cell overlap and durable record extent. Fixed SDK sizing must use a qualified actual maximum with one query plus one fill or an explicitly finite retained retry programme; supplied size alone cannot grow an unlimited body. No generic residual quota, deadline frequency assumption, fixed256 history or guessed all23 capacity fills an unspecified partition. Full positive source membership remains possible under independently authentic sufficient programme qualification; missing qualification remains unavailable without reducing the complete source language.

Original inflater and replay chronology dependency retained in this candidate

The current NQ R4 source response at0e7a0e11 retains ten actual Node-carried zlib source bodies. Original inflateRawSync uses16384-byte chunks, spare output and concatenation, existing output-limit/error/native-close order; zalloc includes max(sizeof(size_t),alignof(max_align_t)) header and an actual null allocation becomes Z_MEM_ERROR, then Node generic error and ZIP archive_unsafe. This differs from original V8 allocator FatalOOM and cannot be conflated with it. Original unused compressed bytes are rejected through the original bytesWritten relation. The selected replay candidate must explicitly preserve or submit for review each changed chunk/concatenation/allocation/error/close transition. A direct native output bank has equal-byte intent but is not by itself original failure chronology.

The complete validation pass owns each actual compressed input/output/inflater/native-return bank until its original CRC/count/member relation and mandatory observer/archive handoff end. The prospective replay pass repeats genuine original work; its actual inflater state, output windows, V8 input String/JSON copies, retained previous successful subject, current cache/compiler state and segmented interpreter stack overlap remains in the whole phase equation. First-pass SHA/CRC does not authorize later replay success after an original read, allocation, cancellation, native close or immutable association fails. No callback, hash or source-qualified label may manufacture that missing positive outcome. This unresolved source compatibility obligation remains explicit for the whole reviewer and cannot be represented as an already implemented qualified cursor.

The cost of full worst-progress history is explicit rather than hidden by interning. IF each data-call archive retains one actual proposed Attempt144, Result128, Receipt128 and ArchiveIndex64, their raw fixed-field subtotal is464 bytes per call before privacy rows, source/native SDK bodies, record framing/alignment, archive page/index/terminal operations and their own results. The629,338,522 member data-read bound then requires292,013,074,208 raw fixed-field bytes; one635,654,138-call archive read pass requires294,943,520,032. These conditional source arithmetic values are not granted storage limits, production record codecs or measured kernel behavior. OptionI shares equal payload backing but does not erase these original distinct attempts. A smaller authentic programme qualification must state its exact source-native progress/call-count acceptance predicate and preserve exhausted/failed state; it cannot claim that the9,700 requested-progress path guarantees the same count on arbitrary native returns. The whole reviewer must see this distinction before selecting finite source/observer backing and terminal programme geometry.

R4 original backend matching-phase source equation

The NQ actual-source join now states the reached matching phase only after compressed owner ZIP262144 check. Current expanded entry E<=8388608 even when earlier aggregate expansion reaches26,214,400 before later rejection. Its native expanded payload and actual decoded V8 String are distinct physical owners. Fatal valid UTF8 decoding has UTF16 payload<=2E, with actual object/header/backing/page/alignment separate. RegExpMatchInfo LastSubject/LastInput point to the SAME original String and count once by original physical association, not twice by field name. A genuine prior retained subject across actual Core calls remains independently live unless actual original allocation/backing retirement occurs; no per-call reset is selected.

Let P(t) be the sum of DISTINCT genuine original RegExp cache table/key/pattern/FixedArray/Latin1ByteArray/UC16ByteArray backing and control owners at source time t, including old/new table growth and retained heap after Age. Original two cache generations do not bound P(t) by two copies or nine slots: older-hit Put promotes the SAME FixedArray, Age shifts roots without proving physical end. ReserveCaptures allocates NEW match-info, copies OLD and then replaces context association, so both original backing owners overlap until genuine physical retirement. Source equations retain these original semantics and allocation events rather than supplying a decoded cache estimate.

The reached phase sum is actual shared compressed snapshot + source/member/namespace indices + canonical assets/TAR/JSON owners + E + current String + distinct prior subject + acquired segmented stack payload<=67108864 + directory24576 + P(t) + original compiler/register/match-info owners + transport/SDK/clock/O2 history + actual native page/reservation/fragmentation. Ordinary finite startup/image ownership remains separately accounted under inherited classification; parser-attributable heap/cache resources cannot be exempted as preexisting. This equation is a source-defined capacity obligation, not a fixed residual allowance. Positive qualification needs the concrete preentry allocation/backing hook and real generation/borrower/end relation; cache age, JS reachability or GC request alone is not physical credit. No native fit or positive backend producer is claimed today.

Prospective programme qualification facts are evidence, not source authority

A future independently authentic original native qualification must associate the complete SOURCEBUILD programme with its exact source/native image, original task/domain/end, input member graph, actual backend geometry and admitted storage/object rights. The programme's finite facts are not a new profile field or self-issued grant: the existing original source-owner approval, independently admitted producer and offered-packet conjunction remain necessary. In particular a numerical measurement cannot repair an unobserved native effect, permit an extra source actor, or prove that archive self-observation/secret coverage was selected.

For each source-defined transition, the whole source ledger records a finite maximum entered-call count, source-defined input maximum, SDK-defined maximum output, fixed attempt/result/control bytes, actual simultaneously live count, durable record count and one original failure disposition. Maxima derived from original source loop arithmetic retain those exact source references; host/calibration geometry supplies actual allocation page/reservation alignment and native kernel/view/object charges, not a replacement loop count. A physical predicate supplied by genuine qualification must be compared against the complete ledger BEFORE the first effect. Unknown finite geometry or insufficient original resource causes unavailable/retained failure at that boundary; it never starts an effect and retroactively claims budget credit.

The programme may reserve one live reusable IO frame only after the previous frame's original result/output/observer/archive/borrower transition ends; its immutable historical record is still retained in separately finite backing. Reuse increments generation and cannot overwrite a pending failed frame, typed receipt consumer or SDK-owned asynchronous body. All independently borrowed source windows remain strongly associated with the original held immutable archive. A directory object variant keeps actual lock/namespace/native parent custody and no fabricated byte SHA. The provider, companion and Core original response frames cannot be counted as a single source-build frame merely because their payloads match. These source dataflow obligations apply to every one of the23 command contracts, while concrete existing eighteen owning method definitions remain unfinished.

SOURCEBUILD original object lifetime count before payload interning

The construction source programme retains original input object/native acquisition/birth/exclusion cells through the immutable archive comparison and typed output handoff, rather than closing every original object after its first body read and later relabelling a reopened equal-hash file as the original source. Its source-derived logical maximum is47,303 member associations. At most one held original regular-file acquisition is needed per distinct genuinely correlated native input object; deduplication requires that actual object identity/lifetime and both member associations, never Git/raw SHA equality alone. The47,303 logical bound therefore remains the conservative held-native-cell bound until a genuinely qualified producer proves its exact original physical deduplication. The historical unique Git-object count is a content/source fact, not proof that current input pathname objects or native handle owners coincide.

Under the current inert NativeCell128 representation,47,303 original cells alone occupy6,054,784 raw bytes before root/extent/borrower/acquisition/SDK/birth/clock/result/closure/native kernel costs and actual rounding. The source programme also holds its new output archive, actual observer views, comparison buffers and pending IO cells; those are additional original objects. Existing filesystem/task/process file-handle limits and source profile rights must admit that complete lifetime, or the constructor remains unavailable before acquisitions grow beyond authentic capacity. No RLIMIT/token/privilege mutation, increased OS limit, early original close, reused handle-number identity or source approval from pathname existence is selected. Actual once-close after the required archive handoff retains its original close result and failed/pending borrower history.

The original Node-carried inflater layout is source-specific: inftrees.h6e7f0fa2 declares ENOUGH_LENS1332 and ENOUGH_DISTS592, total1924 code records, not a stock upstream852+592 assumption. On a qualified ABI with ushort2/code4, inflate.hf127b fixed arrays lens320ushort +work288ushort +codes1924 account8912 raw bytes before its scalar fields/padding; the approximate7K source comment is not a capacity bound. Additional original state contains six pointers, three unsigned longs, enum plus six ints and sixteen unsigned scalars. The original15-bit window32768 is separately allocated, with actual Node zalloc aligned prefix and native owner/control/page/stack costs additional. Actual sizeof/packing/ABI remains an independently genuine build/qualification fact, not executed in this source task. Whole replay-phase equations use this complete exact carried source layout and actual output/chunk/concat chronology rather than a generic zlib implementation or guessed7KiB state. Full original inflater identities for the previous relation: deps/zlib/inftrees.h Git6e7f0fa2a8afdea3875ab8cbbc987444ba19cdd5/mode100644/2925bytes/rawSHA256333f0200383beec341de555e917ab805cfe68af7daafde0443dd6c70bd73d2cc; deps/zlib/inflate.h Gitf127b6b1fa5f7d0266e3b502701948dfd3c6abc8/mode100644/6683bytes/rawSHA256e8d4a51b07694bf48cb91979c19974cf6a5ab0b8a09d26ec0d14df349230673e. Both belong actual original Node commit aa4c77582be995286fc6e00aaf530dc7ade102a9/treecee5f56eb6b8b6b8e300419196dc90e8c7abd64b and original-raw-objects prefix layout. NQ working03 R4-INFLATER-STATE-LAYOUT-SOURCE-RELATIONS.json/R4-ORIGINAL-ZLIB-SOURCE-RELATIONS.json retain the complete raw capture associations; its actual current source85a3b30be50ff5eca6265daa0c7a5a8038517990/treec9075d77f3e1cdf4532ba60e5a09233ec48b063a is source candidate, not authentic reference qualification.

Fresh actual platform.hpp source read confirms the Linux readAt and writeAt helpers internally retry EINTR without a finite attempt count or internal original Deadline check. The source programme B+1 equation above therefore is NOT a bound on the current helper: it requires the explicitly prospective first-entered-error-terminates repair (or a separately reviewed finite retry programme). Every actual interrupted syscall is an entered native attempt with actual errno, not a never-entered disposition or invisible wrapper retry. Outer deadline checks cannot retrospectively bound those internal native calls. This is an exact source chronology/acceptance change for the whole review; no product implementation or existing source bound is claimed.

O2 source-defined SDK bounds distinguish read/write requested count<=65536, Windows directory result buffer65536, TokenUser and PRIVILEGE_SET4096 each, from GetSecurityInfo's OS-allocated returned descriptor, for which the current source has no preallocation cap. No generic65536 SDK body assumption is selected for that descriptor. Complete owner geometry must reserve and account its genuine OS allocation/native result/LocalFree/failed-retirement lifetime under an actual qualified source maximum, or replace the API through an explicitly reviewed genuine original-security query route; an after-return guessed size is insufficient prospective physical reservation. This remains an identified source interface obligation, not missing credentials alone.

Proposed FIRSTPASS original returned-bank aggregation: retain bytes, relocate lineage explicitly

The selected prospective first construction pass retains the complete629,291,219 actual returned-byte bank through final NEW archive immutability and all actual independent comparisons. It does not require one resident Borrower96 per historical byte-progress syscall merely because every actual returned span must remain correlated. An explicit producer-only aggregation proposal keeps ONE strong OriginalReturnedBankLease over the entire genuine extent/root/generation until ALL span comparisons/payload handoffs and pending IO end. Every native read targets the next disjoint remaining byte interval; after actual completion, its true returned prefix never becomes a write destination again. No mutable Node view or external writer alias exists. The genuine actual-output bank is not copied, relabelled immutable source, retired or credited at this ownership transfer.

The active IO/output borrower can transfer its completed original range into that SAME bank capture group's ownership only after real IO completion and explicit original attempt/result/range/history association retention. An entered incomplete/error operation never receives a success transfer. Each original span keeps original bank ordinal/generation/offset/count, actual attempt/native source/task/object/clock associations and its full retained result/history chain; it is not a hash-only range. Historical span records may reside in separately finite genuinely owned history backing with bounded cursor pages, but their actual write/readback/error/borrower/end effects remain counted. Active frame or metadata storage can end only through actual reviewed relocation/native physical retirement after that full handoff; GC, overwriting a record, dropping an intrusive link or a bare durable file hash cannot free credit. This proposal is an ownership representation amendment for the whole source reviewer, distinct from OptionI's later independent equal-payload interning transaction and from terminal durability acceptance.

The inert SourceMemberCapture64 record specifies seven U64 fields originalBankOrdinal,originalBankGeneration,originalInputCell,firstAttempt,lastAttempt,actualReturnedBytes,originalHistoryChain followed stateU32/reservedZeroU32. With47,303 member controls this adds3,027,392 raw bytes to the conservative first-pass geometry, before root/extent/borrower/record bodies/native rounding. One aggregate bank lease does not eliminate any actual native attempt, byte output, original source cell or historical consumer. It merely separates original backing ownership from per-attempt historical attribution. The conservative payload/control first-pass minimum is629,291,219+6,054,784+4,541,088+3,027,392=642,914,483 raw bytes, plus live IO/clock/result/frame/pages, source/observer image/thread/SDK/kernel, immutable archive construction backing and all genuine retained history. This is the separate source-build class, never parser128/stage160/capsule1GiB.

All source member bank ranges remain strongly held as a whole until the POSTimmutable comparison pass and typed payload-owner handoff finish; no partial decommit or per-member source bank credit is selected. Native input objects remain conservatively held through their exact live last consumer/identity-after/comparison/handoff and genuine once-close result, then closed historical native objects remain proof records, never usable source capabilities. The earlier worst629,338,522 resident Borrower96 links is a counterexample for a one-live-link-per-attempt representation, not an asserted universal lower bound. If the original full contract mandates keeping every attempt's live borrower/control independently rather than genuine aggregate ownership with complete history, the whole reviewer must identify that exact incompatible clause; no positive transfer is inferred today.

Provider per-frame source calculus preserves complete original capsule scope

Fresh key-provider.hpp/provider-session.hpp/provider-protocol.hpp source reads distinguish ORIGINAL provider preimage body from old Windows whole-transport envelope. Current per-domain raw body maxima are idempotency392, Journal16777216, selector110, capsule67145545 and Audit16528. A65536-byte CHUNK payload therefore requires at most1,256,1,1025,1 CHUNK frames respectively; each complete request additionally has one BEGIN and one END. Capsule END carries sequence1026 after1025 chunks; the existing parser limit1026 covers that original raw body. The old67195929 Windows envelope is NOT another67195929-byte cryptographic preimage or a reason to change these fixed domain counts.

Actual maximum CHUNK body is13+65536=65549 bytes; original transport frame is lengthU32 +body +MAC32 =65585. Actual BEGIN body maximum is78 (its Writer reserves79); END body9. Thus capsule old-envelope arithmetic is67145545+1025*(13+36)+(78+36)+(9+36)=67195929, preserving the previous complete physical counterevidence. Selected one-message-per-existing-frame design bounds each genuine Windows request message at65585, not whole67195929. Original BEGIN/CHUNK/END/domain/version/ordered length/MAC and provider64 greeting remain unchanged. Each frame's actual message boundary is checked; END is still not native channel EOF, and actual later peer/channel close must retain its original outcome.

Current providerFrameMac uses a Writer capacity body.size()+80; at maximum this is65629 before actual allocation rounding. Existing source also creates original file-read/chunk assembly, body/frame copies and parser-owned chunk copy. These are DISTINCT live native backing when their source scopes and IO/archive borrowers overlap; the small65585 message size alone is not the whole allocation proof. Selected physical owner must replace default std backing through the reviewed exact source view/arena interfaces, pre-enroll each message/IO/SDK/control/historical handoff and retire no frame/body merely on C++ scope exit. The generic64MiB native inventory/file signer path remains complete and reads the actual original capsule object/windows; it cannot keep a duplicate64MiB expanded Node body or label provider copies foreign/unowned. No production message-mode change, source owner implementation or native capacity qualification is inferred by this calculus.

Prospective caller-owned Windows security descriptor query

The source candidate selects NtQuerySecurityObject on the SAME originally held file/directory handle, replacing current GetSecurityInfo OWNER and OWNER|GROUP|DACL reads only. Microsoft's exact API documentation explicitly describes user-mode Nt naming, caller-allocated self-relative output, existing READ_CONTROL for these three information classes, and an NTFS file descriptor upper size of65536 bytes. The API's STATUS_BUFFER_TOO_SMALL returns no copied security information. Sources: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntquerysecurityobject and https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-nt-and-zw-versions-of-the-native-system-services-routines . This is a prospective material private API replacement for entire review; no call/import/build or platform profile admission occurs here.

Pre-enroll one aligned65536-byte original output window, original ULONG LengthNeeded cell, actual NTSTATUS result/control cell, input flags/held-handle association, current task/clock/stack lease and mandatory failure/archive consumers BEFORE entering the native query. Qualified actual source ABI must bind ULONG32 and the genuine user-mode ntdll export/import lifetime; the driver documentation's NtosKrnl requirement table is not a user-mode link instruction. NTFS eligibility belongs genuine existing original platform/filesystem qualification, not a new caller profile string or a universal descriptor bound on every Windows filesystem/object type. No SACL, ACCESS_SYSTEM_SECURITY, privilege activation, handle replacement, pathname query or backup-semantics mutation is selected. Unsupported original object/filesystem/ABI remains unavailable, preserving the actual cause and held custody.

Immediately commit actual NTSTATUS and LengthNeeded without throwing or allocating. Only STATUS_SUCCESS with a length within the pre-enrolled backing, valid self-relative offsets and complete owner/group/DACL structure may expose immutable borrowed descriptor ranges to existing owner/mode validation. STATUS_BUFFER_TOO_SMALL, malformed offsets, original-handle/lifetime mismatch or other status retains the entered attempt and denies; no dynamically growing retry or GetSecurityInfo fallback is selected. Unwritten bytes are never raw capture. Actual security output retains its original native-output borrower until independently required comparison/archive/consumer handoff and physical retirement; the descriptor is not inferred from requested flags or a copied owner SID. All output pages, SDK/kernel/task/stack/control/failed history are charged to their original classes. Existing win32.security_info primitive semantics and eleven fields remain unchanged; new private source API identification is not a new primitive or permission. A positive eligible NTFS source fixture must assess identical owner/mode decisions and genuine actual descriptor bodies, alongside short-buffer/status/access/malformed/lifetime/borrower failure cases.

Exact clock programme terms and bounded IO repair are separate source choices

The frozen clock programme AD56C7E35BD45B7E4E555E651480AE3D83E6E819D9752DA821DB5ED048C5E2B4 at _audit/core1643-clock-domain-native-programmes-oct05-01/PROGRAMMES.md establishes four named Windows APIs per successful current sample (QPF,QPC,current PID,current TID), three Linux APIs (getpid,gettid,clock_gettime), and additional peer-alive two Windows/one Linux calls. These are named API counts, not inferred kernel-entry counts or complete lifecycle qualification. Actual current failures omit required raw error custody; future native commit must retain that actual result/error through pre-enrolled cells. Capture/worker/peer-domain/lifecycle definitions remain absent and their programme terms UNKNOWN rather than zero.

A source-selected nonrecursive recorder samples each real transition only according to its actual owning programme; recording that sampler result does not recursively demand another identical sample. The whole architecture reviewer must assess this explicit recursion cut against original observation coverage. Current channel timeout/IO_INCOMPLETE/EAGAIN and procText EINTR loops do not acquire a finite entered-call count from a40s end or5ms wait. The prospective owning programme therefore selects one submission, one bounded native wait and one result query; on an actual unresolved asynchronous result, at most one cancellation plus one follow-up wait/query, then retained unknown with original IO/backing/cell owners live. Successful byte-progress loops consume at least one actual byte each and first entered error ends that task; interrupted attempts are recorded errors, not invisible retries. These source repairs preserve real caller end checks and cannot claim late cancellation ended IO or renewed acceptance. All changed interruption/wait/error chronology is an explicit entire-review obligation before implementation, not a count proof for today's helpers.

Complete engine transaction ownership states for the proposed eighteen definitions

The selected shared implementation boundary uses one producer-only NativeEngineTransactionLease per serialized original dispatch. Its source states are Enrolled, CurrentObjectsSelected, OverlayValidated, OriginalSignaturesHeld, CandidateWritten, CandidateReadbackBound, JournalPublished, SelectorPublished, CommittedReadbackBound, ResultBorrowed and Retired; any entered failure moves to RetainedFailure with its actual reached state. These are private ownership states, not new public operation/phase enum values. The lease holds original current-slot/selector/root/lock observations, immutable generation/source identity, exact command/request/result sequence, typed changed-row extents, two DISTINCT provider sessions, candidate handle/IO/backing, original signatures and mandatory observer/archive/history borrowers. Each state transition requires the actual preceding native result and typed original ownership transfer, not a supplied receipt digest. No handler creates a second lock, owner pool or recursive transaction to publish a failure.

Enrolled reserves the exact operation request/result maxima already defined in protocol.hpp and the changed-row/index/encoder/native IO/result/error cells before any effect. CurrentObjectsSelected retains original selector and both current Journal candidates through full native validation, source lineage and actual selected generation. OverlayValidated preserves original unchanged row spans and typed new rows, validates the complete schema/cross-row/quota/state invariants, and resolves exact canonical output length before growth. Existing opaque UUID/timestamp/confirmation generation and original UTC authority are independent authentic producers; the transaction cannot synthesize their authority from its monotonic end or row offset. OriginalSignaturesHeld retains one-use provider associations separately for original Journal and selector preimages, including genuine channel outcomes. The original two transactions must never be collapsed into one consumed provider connection.

CandidateWritten and CandidateReadbackBound require actual original write/flush/full same-handle readback/nonzero-capacity EOF and object identity/source checks. JournalPublished and SelectorPublished retain the exact native publication status, object identity and original parent/root/exclusion observations independently; a rename status alone is not publication confidence. CommittedReadbackBound reopens under the SAME held original root and correlates the current actual selected generation/selector/full frame with the candidate and retained original native effects. Only then may the handler expose an original response window. A crash or failure at any earlier boundary leaves its actual object/Journal/outbox/native state for RECOVER, never logical rollback by deleting unknown originals.

Each of the eighteen owning definitions consumes this common lease only where its existing contract mutates signed state; read-only native object observations use a separately pre-enrolled ReadEffectLease and no phantom Journal commit. READ_ASSETS, DISCOVER, LOOKUP_STAGE and READ_STAGE retain actual IO/session/window owners; RELEASE_STAGE_READ and CLOSE consume genuine once-close admission only after their live consumers end. MATERIALIZE keeps its candidate-write/readback/discovery/rename/final-reopen programme under the original write-intent operation, publishing only existing precise observed phases. CAPSULE_CHUNK uses original qualified entry-window and append/readback handoff; CAPSULE_SEAL keeps metadata and held capsule/source objects after actual expanded byte-owner retirement. ACCEPT consumes confirmation exactly once only in the same authenticated operation/keyMapping/preflight/outbox publication. AUDIT_ENSURE/AUDIT_ACK keep original Audit object/native validation separate from Journal acknowledgement; absent original UTC/index/secrecy/terminal coverage cannot be replaced by a successful callback.

RECOVER iterates the complete fixed collection bounds of the originally selected Journal, not an unbounded filesystem scan: seven collections<=4096 each, outbox<=8192, retained versions<=64, exact existing capsule entries<=128. Its row cursor has original generation/offset/length/index ownership and cannot mutate or recycle a row while another original view remains borrowed. For every inspected original retained object, recover must run the same typed native effect/readback/identity/closure programme as the ordinary effect it correlates. Byte loops are bounded by the exact selected object's declared validated count with true EOF and first entered error termination; directory rows must be bounded by the original namespace/resource quota and source-native enumeration output programme, not by ignoring foreign entries after128. Unknown directory completeness or unbounded SDK result remains an explicit source qualification failure before positive recovery. No expired confirmation is regenerated and no pending outbox event is asserted acknowledged from an index-only record.

Today's command-engine.hpp still declares these eighteen methods and does not define NativeEngineTransactionLease or ReadEffectLease. journal-overlay.hpp does not exist; the existing NativeJournalCommandState uses default shared_ptr/string/DOM/Writer owners and logical Budget. The states here select prospective dataflow for the whole architecture reviewer, not an implemented allocator, committed effect, authenticated initial producer or complete numerical peak. The final source implementation must replace all those consumers coherently after the whole decision, with actual failure/retirement branches and production configured constructor/registerAdmissionBinding caller connections. No subset or fixed-layout declaration counts as all23 delivery.

Native qualified geometry is a constructor operand, never a measured receipt callback

The whole source constructor consumes an independently authentic OriginalNativeGeometryLease resolved from the existing C measurementRef and qualificationRef conjunction; neither current parseOriginalCoreCalibration's qualified string nor a caller-supplied numeric object constructs it. The lease associates exact original actor/image/source/build/kernel/filesystem/SDK/ABI/task/resource observations with the SAME owner root and the reviewed complete source programme. Its immutable values include native allocation granule/reservation/commit accounting, actual thread stack and TLS backing, fixed source record class alignment/stride, kernel object and native view occupancy, SDK output/temporary backing bounds, source programme live counts and retained error/IO/history capacities. Each value is a genuine original qualification fact with an original held observation/source association; any missing constituent remains unavailable before enrollment. This is not a new public profile field or an unspecified generic remaining quota.

Actual resident predicate is evaluated as sum over DISTINCT simultaneously live original backing extents and controls, each rounded by its authentic source/native backend geometry, plus separately actual kernel/view/stack/SDK terms. Physical allocation is charged once at native acquisition and suballocation retains that same original extent charge; alias/view/control owners are separately counted where they actually allocate. Source-attributed parser/cache/compiler/String/body/transport/history occupancy uses the original134217728 predicate. Ordinary finite startup/image/source-build backing is evaluated under its separately original classified finite resource association, not relabelled foreign or exempt because it began earlier. A source programme transfer cannot change a resource's class to manufacture credit.

The generic full64MiB capsule path's prospective positive ownership chain is held original capsule object → one original65536 payload read window → existing original CHUNK body/frame/MAC-owner windows → native message/IO/result/archive handoff → actual frame/window retirement before next CHUNK. It keeps source/namespace metadata, original provider/key/source/peer/clock lifetimes and every retained history record, but no64MiB Node body or whole Windows transport envelope. The resulting predicate uses the maximum simultaneous per-frame windows and their source counts, not inventory length as resident storage. Thus complete64MiB support is represented without asserting a measured positive host/profile today. Late native error or insufficient original history/control/kernel resources denies before the next effect with all originals retained; a successful payload digest never substitutes actual comparison, EOF, close or history ownership.

For original V8 matching, the same geometry lease must associate the actual preentry allocation hooks and original Core isolate/context/cache/heap generation owners. Per-allocation admission enforces the unchanged128 predicate while preserving exact selected failure chronology, including fatal native allocation failure rather than interpreting it as ZIP or recoverable RegExp failure. A bound on JS visible live handles, a forced GC or two cache generations is not a physical backing maximum. Future qualification must cover actual supported input/workload/history and source bounds; code cannot assert every accepted expression fits merely from a current cache sample. SegmentedC and replay close specific duplicated/growth representation choices, not the complete original heap/cache/control proof. The review candidate must retain these future qualification dependencies expressly and must define every source hook/control/retirement producer before implementation is called complete.

Actual embedder call sites that the owner producer must replace coherently

Fresh core-image.cpp source inspection establishes the exact integration order: argc/argv copying into std::vector/std::string; InitializeOncePerProcess; fixed jitless flag; MultiIsolatePlatform::Create(4); InitializePlatform/Initialize; errors/execArgs/default EnvironmentFlags; CommonEnvironmentSetup::Create; original Locker/IsolateScope/HandleScope/ContextScope; AddLinkedBinding; production program std::string copy; LoadEnvironment/SpinEventLoop; Stop; setup destruction; Dispose/DisposePlatform/TearDownOncePerProcess. None currently enrolls the actual OriginalNativeAdmissionOwner or captures its physical preentry root. The current call order is a concrete unfinished source boundary, not evidence that its earlier allocations are free or that registerAdmissionBinding can retroactively own them.

The prospective source integration must enroll native owner/root and source-qualified native backend before every attributable allocation boundary; pass SAME genuine runtime ownership into platform/setup construction; retain actual setup/isolate/env/context native association at construction; pre-enroll original capture task/domain/request failure slots before dispatch; and bind registerAdmissionBinding to that source-owned runtime lease. The linked binding resolves no caller pointer, profile digest or JS option into a runtime owner. The native-owned RegExp constructor/test closures use original Context and builtins, immutable arguments and actual handles rooted in this runtime; Node async workers return original frame ownership to Core thread rather than access its Isolate. Stop and teardown serialize against original outstanding backend/callback/request/worker/capture/peer/IO/archive borrowers and retain original native failure outcomes.

Allocator integration is complete only when its exact original source allocation paths are accounted: V8 page/heap/ArrayBuffer/Zone/malloc/native containers/compiler/cache/String and segmented interpreter backing; Node native Buffer/control/source program/argv/errors; libuv platform/worker/thread/stack/TLS/IO; OpenSSL/TLS initial and request allocations; native source importer/SDK/runtime/root/metadata and actual loaded image/view mappings. An ArrayBuffer allocator alone, uv_replace_allocator alone or late OpenSSL memory hooks does not cover those paths or establish preentry lifetime. The exact reviewed repair source/build association must name their actual changed source members and original generated/build/SDK closure. These are required material source-hook definitions in the whole candidate, not positive implementations in the current embedder. Source-qualified original startup geometry may remain a future unactivated authentic input, but missing hook/source choices cannot be reported as missing runtime credentials alone.

Exact native channel loops covered by the pending IO programme repair

The current channel.hpp has entered-call retry loops at lines86-90,103-107,123-125,141,146-147,293,303-308 and319. They include repeated GetOverlappedResult/WaitForSingleObject(5), poll(5), interrupted poll and EAGAIN/EWOULDBLOCK send/recv; the true EOF reads at293/319 also retry. Each is a current owning source gap, not bounded by frame maximum, elapsed40s or active pending-slot count. The prospective common programme replaces all these sites coherently rather than fixing provider transport alone.

For each Windows transfer, before submission retain original channel/peer/source/task/clock/native OVERLAPPED/event/output and their generations. One actual submission may complete immediately; otherwise one WaitForSingleObject using the checked original remaining end is followed by one GetOverlappedResult query. Unknown completion permits one CancelIoEx plus one bounded follow-up wait/query under the same applicable resource end; it does not authorize another acceptance end. If completion still cannot be proved, no pending association or SDK buffer/event is destroyed or reused, and the real original unknown is retained. A returned failure code and actual transferred count are committed before exceptions. Channel close is not attempted while that original IO still owns the handle/backing; closure is postponed in retained state, never reported complete because CancelIoEx returned.

For each Linux transfer, one poll with original remaining end precedes one actual send/recv attempt; interrupted or would-block/error ends that task with actual errno/result, rather than an invisible repeated attempt. Successful short reads/writes advance by their actual positive byte count and retain each native attempt; exact framed length still applies. Required final EOF remains a separate positive-capacity original recv returning0 with its actual peer/source/clock/exclusion association. Zero returned progress before required framing ends is premature EOF; END, a message boundary, lack of currently queued bytes or response write success never supplies it. A timeout preserves pending/original buffer/native owners, not a synthetic zero-byte EOF record.

Per-frame Windows message semantics preserve the existing exact BEGIN/CHUNK/END byte/MAC/ordered-length grammar and no additional ACK. ERROR_MORE_DATA is interpreted only against the exact current original message length and pre-enrolled expected output body; no extra message bytes or premature boundary is accepted. Original provider response remains one bounded response followed by genuine original channel closure validation. Linux original half-close and Windows message boundary are distinct native events with their actual raw outcomes. This complete source repair changes wait/retry/cancellation failure chronology and must be assessed by the different entire reviewer before implementation. It supplies finite entered-call counts per source transition while expressly retaining unresolved native lifetimes; it is not measured positive completion or permission to discard failed attempts.

The prospective descriptor consumer parses only the actual returned self-relative window under the original qualified Windows layout. Its relative header requires20 bytes; every nonzero owner/group/ACL offset must remain within actual LengthNeeded and refer to a complete original structure, with checked overflow before pointer exposure. SID revision/subauthority count and authority/subauthority ranges are validated against the genuine original SDK/source ABI; an actual SID has at most15 subauthorities, so its binary extent is at most68 bytes. An ACL requires its actual header and complete AclSize within the returned window. Mode verification requires the existing exact protected-owner ACL/owner-token/AccessCheck semantics; merely seeing a requested execute mask never establishes mode. AccessCheck remains a distinct entered SDK effect with its pre-enrolled PRIVILEGE_SET output and original token/task lifetime, not a replacement descriptor validation claim.

Current identity's sidText calls ConvertSidToStringSidA and allocates a LocalFree-owned buffer; current setMode and observedMode call ConvertStringSecurityDescriptorToSecurityDescriptorW and allocate OS-owned descriptors. These remain additional concrete SDK owner gaps even after replacing GetSecurityInfo. The whole prospective representation selects a source-owned bounded canonical SID encoder over the validated original binary SID and source-owned exact owner ACL/relative descriptor construction, preserving exact original SID authority decimal-or-hex formatting and protected0644/0755 ACL masks. No supplied SID or altered permission is accepted; existing actual effective owner remains the source. Exact canonical SID maximum derives from S-revision-authority plus fifteen decimal U32 subauthorities, with all punctuation checked before writing; source encoder never requests a generic unlimited string allocation. Descriptor construction retains genuine actual Owner SID separately and exact one OWNER_RIGHTS (OW/S-1-3-4) ACCESS_ALLOWED ACE trustee, existing masks0x001f01df/FA and protected DACL semantics. Actual SetSecurityInfo native effect and subsequent full original query/AccessCheck remain required. These private representation repairs must be compared against original SDK conversion outputs in prospective positive/negative source fixtures after admission; no conversion/native code is executed or treated implemented now.

The exact official Nt query primary body is retained at _audit/core1643-ce2-source-author-working-oct05-01/official-security-query/ntquerysecurityobject-original.html,56078 bytes/SHA25655bbc4cbcc08be1a6de3beaa6ca983e25081dc64550ebc9a0acea5605077b601, with actual URL/retrieval/source association beside it. This read-only document custody is not a native SDK qualification receipt or positive platform profile.

SID text clarification for the preceding prospective encoder: IdentifierAuthority is NOT universally decimal. Exact Microsoft MS-DTYP2.4.2.1 uses decimal below2^32 and0x plus twelve hex digits otherwise; subauthorities remain decimal without leading zeros. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c92a27b1-c772-4fa7-a432-15df5f1b66a1 . This supersedes the earlier shorthand original SID decimal text for authority only. With revision1 and at most15 subauthorities, canonical text capacity is4+14+15*11=183 non-NUL bytes (184 including terminating NUL); lower-authority decimal uses at most179. The actual source encoder must preserve original qualified ConvertSidToStringSidA formatting, including hex case/zero padding, and prospective fixture equality must cover authority0xffffffff/0x100000000/0xffffffffffff plus zero/max subauthorities. The format grammar is source evidence, not an executed API equivalence result or proof that an arbitrary SID is the authenticated owner.

Provider closure observation actors and exact current Windows ordering

Fresh channel.hpp originalRequestBoundary/originalProviderPeerClosure/originalProviderResponseBoundary/readProviderResponse reads preserve the existing Windows ordering: provider observes the original END message boundary, writes one bounded response; client verifies that exact response boundary and closes its original handle; provider then observes actual ReadFile/GetOverlappedResult ERROR_BROKEN_PIPE on the SAME original endpoint before its own once-close. Client must NOT wait for provider close before its own close, since that would deadlock the selected order. Client's response boundary check is not native EOF. Provider ReadFile TRUE/zero is an actual zero-length message and is denied, never promoted to channel EOF. Linux request write-side shutdown/recv0 and subsequent response/peer closure remain distinct original observations.

The two original actors' closure observations retain separate original source/task/object/IO/tick/result owners. A caller's successful CloseHandle does not prove the provider observed peer EOF or ended its pending read; the provider's actual ERROR_BROKEN_PIPE does not prove the client's metadata/control arena ended. Exact original source observer/archive integration must correlate their existing one-use peer/nonce/sequence associations and actual native outcomes without adding an ACK, endpoint, wire field or acceptance-renewal token. The response's version+MAC remains the unchanged cryptographic result, not a new final native closure receipt. Current local scope resets/shared_ptr destruction/logical Budget.closed are not genuine archive/effect/last-borrower retirement. Required provider raw closure history is obtained from that actual original provider observation, not reconstructed by the client from message completion or a capability digest.

Native security query resolution is a source-private NativeSystemApiLease, retained under the existing independently qualified original Windows platform/native dependency association. It binds the exact NtQuerySecurityObject NTAPI signature, source-owned literal export name, genuine originally loaded ntdll module/export RVA/code/source/build/native mapped-image lifetime and original caller task/handle rights before query entry. Existing GetModuleHandle/GetProcAddress source lookup alone is not that qualification and a function pointer from caller data is never accepted. The lease uses the actual already loaded qualified system dependency; it invokes no ambient DLL search, new LoadLibrary path, privilege or resource provisioning. Missing original module/export/source/native custody stays unavailable with truthful lookup/error observations. Genuine platform qualification must cover the same original API implementation and filesystem descriptor semantics, not rely on the driver documentation requirement table as proof of user-mode linking. These native dependency/code/metadata/view lifetimes and lookup calls join the complete owner's ordinary/native SDK classes and archive programmes, without a second parser pool or a new public tool/profile entry.

Exact protected ACL trustee clarification: the original SDDL D:P(A;;FA;;;OW) and D:P(A;;0x001f01df;;;OW) use the SPECIAL OWNER_RIGHTS SID (OW), not the actual account owner SID. Microsoft SID Strings explicitly maps OW to SDDL_OWNER_RIGHTS/SECURITY_CREATOR_OWNER_RIGHTS_RID: https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings . Therefore the prospective bounded descriptor encoder must retain that exact original special trustee in the one ACCESS_ALLOWED ACE, existing mask/no-inheritance/protected-DACL semantics and actual qualified SDK structure bytes. The actual owner SID remains a DISTINCT descriptor.Owner/token-owner/AccessCheck association and is not substituted into the ACE. This supersedes any preceding owner ACE wording that could suggest the account SID as trustee. A source fixture must compare actual native SDK-created original SDDL descriptor against the exact proposed owner-rights ACE and separately actual owner/token identity; no permission change, SDK execution or positive mode proof is inferred.

O2 exact defined-output/security/aggregate reconciliation input

The complete17347-byte O2-AGGREGATE-BANK-SECURITY-CLOCK-RECONCILIATION.md SHA2568369c86c92f0ef446689f6977a9cd506d53921bd1f6ec33e8e2d17f52b693d4f was fully read and preserved under _audit/core1643-ce2-source-author-working-oct05-01/external-o2/8369c86c92f0ef446689f6977a9cd506d53921bd1f6ec33e8e2d17f52b693d4f-O2-AGGREGATE-BANK-SECURITY-CLOCK-RECONCILIATION.md. It provisionally reconciles genuine aggregate backing custody against original217/71/111: no identified clause requires a separately resident Borrower96 for every historical completed span, while the SAME actual bank and every real original attempt/result/range/history transfer remain mandatory. This is source-author reconciliation, not a different entire architecture verdict, native fit or positive implementation.

Native query/result fields retain explicit source-defined validity. NtQuery actual NTSTATUS is always the scalar native return; LengthNeeded and descriptor bytes are exposed only where the original API contract actually defines them. Preinitializing output memory does not make failed-call untouched bytes native output evidence. STATUS_BUFFER_TOO_SMALL retains its defined required length and no successful descriptor bytes; other failures retain only actually defined original outputs. TOKEN_USER SID pointer must resolve wholly inside the actual original returned4096-byte backing before any SID view, never arbitrary native pointer dereference. Descriptor relative offset/range/overlap and actual ACL/ACE fields are checked before AccessCheck or source-view exposure. A source parser replacing GetSecurityDescriptorOwner/Dacl/Control/IsValidSid preserves original semantics but records no fabricated successful helper call: actual invoked helpers remain distinct source API attempts.

The exact OW SID is S-1-3-4:12 bytes under qualified original SDK layout. One ACCESS_ALLOWED_ACE is header4+mask4+SID12=20 and the ACL is header8+ACE20=28 raw bytes. Preserve original ACE type/flags0/count1/ACL revision/initialized headers, protected DACL, and masks0x001f01df versus FILE_ALL_ACCESS0x001f01ff. Actual descriptor.Owner, original effective/duplicate token state and AccessCheck(FILE_EXECUTE) remain distinct native observations. No private encoder substitutes tokenOwner as ACE trustee, invents FILE_GENERIC_EXECUTE grant, or treats equivalent SID notation as the unchanged identity digest. Geometry includes actual rounding/native temporary/stack/control/view owners beyond these raw28 bytes; API caller buffer bound is not a guarantee about opaque kernel/ntdll temporaries. Full source qualification and native hook programme must cover the original owner-attributable terms.

SINGLE selected measurement dispatch; historical sixteen-key alternative superseded

For this current whole CE2 candidate, C9 measurementRef resolves ONLY service-lasso.core-native-measurement.v1 EXACT9 keys and its service-lasso.core-native-geometry.v1 EXACT8-key geometry/ABI8/allocationClass7/nativeObject6/sourcePhase5/count2 bodies selected in CORE-ORIGINAL-OWNER-REALM-AMENDMENT-PRECODE.md under Complete private native geometry carrier candidate. The earlier physical section Concrete private original-measurement carrier and capacity predicate candidate with sixteen-key service-lasso.core-native-owner-measurement.v1, ABI5/pageGeometry3 and qualified/failed/unresolved measurement outcomes is explicitly HISTORICAL SUPERSEDED and MUST NOT be accepted as an alternative, wrapper or chained current measurement record. No permissive union/version fallback or nested dispatch to the old sixteen-key body is allowed. Current private outcomes success/unavailable/failure remain distinct from unchanged C9 qualified wrapper. Original old proposal bytes survive in the frozen reconciliation01 source cut as evidence; no positive reader exists today.

Only the old codec vocabulary is superseded. Its complete physical obligations remain mandatory under current sourceProgrammeRef/nativeBuildRef/geometry originalObservationRef, fixed allocation/native-object/source-phase tables and actual original O2 root/frame/cell/IO/history observations: all23 actual owning programmes, full thread-stack/TLS and SDK ABI/source layouts including time_t/struct layouts, distinct allocation/control/borrower generations, kernel/view/queue/failed native occupancy, real observation/error/output validity, full retained attempt/receipt/index/privacy/history and original terminal/secrecy coverage. The compact ABI8 convenience scalars do not waive any native SDK layout merely because its type is not a top-level convenience key. Those complete original typed observations/source associations must resolve or the current constructor remains unavailable, never assume omitted type widths or free kernel allocations. No caller-supplied decoded counts become native maxima.

The earlier physical text Raw evidence storage<=167772160 is likewise superseded by the explicit later Blueprint438 classification:167772160 governs aggregate stage-declared compressed reservation, not a universal observer/source archive cap. No renamed observer/raw allocation domain acquires that allowance. Publisher SOURCEBUILD and observer backing remain separate finite genuinely charged original resource associations. This resolves vocabulary and dispatch coherence without granting new storage, authority, secrecy or terminal acceptance.

Closed named archive/attempt storage mapping and genuine large history offsets

ArchiveIndex64 CURRENT inert proposal fields are six named U64 slots archiveGeneration,archiveBackingOrdinal,archiveByteOffset,archiveRecordByteLength,originalAttemptOrdinal,originalRawViewOrdinal then four U32 originalOffset,byteLength,observedState,nextPageSlot. archiveGeneration is the genuine retained archive generation; backing ordinal resolves SAME original root/cell/generation/immutable backing; offset/record length are checked U64 actual history coordinates and do not truncate at4GiB. Attempt ordinal resolves the complete original performer/native source/task/object/clock/IO/result/history association. Raw view ordinal resolves only a genuine nonsecret originally observed view permitted for this source codec; zero is source-kind nonapplicability, never successful empty data or replacement secret reference.

The two U32 offset/length fields refer ONLY to the original source-bank/current native body subrange whose actual source bound fits U32; they are not history addressing. observedState is source-fixed private typed state, not packed native generation. nextPageSlot is ONLY a bounded resident cursor-page slot (or explicit no-next sentinel0xffffffff), never a global history ordinal: with65536-byte index pages, <=1024 actual64-byte slots fit before actual page headers/alignment. Cross-page traversal resolves original U64 backing offset/record length and actual page readback/generation association, not a truncated next pointer. Archive ordinal/generation wrap, range overflow, stale source view, undefined/secret body and unqualified native history backing deny projection/consumer use. This maintains64 raw bytes without pretending allhistory fitsU32 or sourcebank occupancy covers persistent indices.

Attempt144's formerly opaque eleven associations now have exact named storage slots objectAssociation,birthAssociation,sourceImageAssociation,taskAssociation,clockAssociation,ioAssociation,nativeCellAssociation,inputViewAssociation,outputViewAssociation,stackAssociation,archiveEffectAssociation. The private source API codec determines each actual applicable original association and definedness; nonapplicable source-kind slots are explicit0, while missing required actual original association cannot become positive evidence. Native primitive11 projections still demand their exact nonzero identity/source fields and actual raw capture where applicable. The order and original owner/root/attempt generations/tick/sourceApi/transition/input-output lengths/entered/disposition/resultDefinedness/privacy fields remain unchanged. No structure memcpy is wire encoding; named values resolve typed original O2/native owner associations, never decoded caller ordinals as authority.

This is an INERT private storage declaration repair only: current physical-owner-layout-proposal.hpp6594bytes/SHA256efa0eca4bd5e4cf94201e08d7a2fa89741072cbcd8d078b9315e82c79dd22670. Prior6258-byte/294a0e... declaration remains frozen in whole reconciliation01. No include/compile/sizeof/staticassert execution, allocator/positive constructor/native operation or archive encoder implementation occurs. Actual rounded class geometry and source-native admission/borrower/end definitions remain whole review/implementation obligations.

Current single closed observer archive and SDK dispatch

The exact CURRENT private proposal is SLOENV02/header136/two contiguous sections with association common29/kinds0..8 and distinct SLOSDK02/header90/variant80/fixedbody47. O2 envelope06 RESPONSE8194 SHAd761880b4db0d95b8075a33f462f43941d3db309f11eb84945f950d7e2428978 ROOTc0e8c4f9d063c1e6d44e048f54992fd76e086203d85e21a08a1dccbe097b1d76 binds its byte-identical carrier05 RESPONSE5938 SHA12d0a061557efec0433b19d7dab8a6c34bbb1241b90d53889529d8f09ef1a93d. Previous common29+SDKbody47 and omitted-discriminator formats are HISTORICAL FAILED, not capacity alternatives or current decoders. Current complete SDK maximum65690 and independently coexisting controls+wire66154 are raw lower bounds only. No positive terminal witness, T/S acceptance, native/source fit or resource grant exists. The exact closed proposal follows in full; native encoder/decoder/typed table definitions and all owning callsite joins remain source work after whole review.

Current exact SDK record body and carrier

This source-only candidate corrects the outer-carrier gap in reconciliation04. The nine association kinds0..8 remain unchanged. Their common29-byte association header DOES NOT frame SDK results. The earlier65,629 figure was a hypothetical association-plus-body calculation, not a valid complete SDK record; it is preserved historical failed framing and must not be used as current wire capacity.

Select a separately framed PRIVATE SDK record, not a tenth association kind, public primitive, command, actor or wire endpoint. This is a prospective source codec requiring entire review, not an existing implemented or originally observed carrier. A byte stream admits this codec only through its separately source-fixed SDK-record section; no heuristic magic scan, alternate decoder, mixed association dispatch or generic API-name field is allowed.

Exact header, in order: ASCII8 SLOSDK02; U16BE version exactly2; U8 platform (0Linux,1Windows); U8 executionState (0notEntered,1pending,2returnedKnown,3retainedUnknown); U8 resultDefined (0or1); U8 reserved exactly0; nine U64BE fields runOrdinal,generationOrdinal,originalAttemptOrdinal,originalResultCellOrdinal,originalSourceLeaseOrdinal,originalTaskOrdinal,originalClockOrdinal,originalObjectCellOrdinal,originalIOCellOrdinal; U32BE sdkBodyLength. Header size is8+2+4+9*8+4=90 bytes. All ordinals are actual same-run typed owner-table references, never pointer values or grants. IO ordinal0 is allowed ONLY for an actual source synchronous SDK variant without an IO cell; all other refs nonzero. Object/result/attempt/source/task/clock refer genuinely held original native/source cells of their exact types, not association rows manufactured to satisfy a parser. Generation, once-use state and typed cell validity must be checked before any correlation.

ExecutionState2 requires resultDefined1 and an actual original returned result. States0/1/3 require resultDefined0 and preserve the actual original attempt disposition without a fabricated return. Unknown/pending/native task death never becomes successful zero/empty output. For SDK variant80 platform must be1. Its body ALWAYS begins U8 sdkVariant exactly80. In executionState0/1/3 the body is exactly that one byte: no raw NTSTATUS, length or descriptor is encoded. The native attempt/source/IO cells retain the actual prevented/pending/unknown chronology. In state2 the body is exactly the previously selected47-byte fixed SDK80 body including the discriminator, optional actual LengthNeeded4 only if genuinely defined, and optional exact ByteView only if descriptorDefined1. State2 may represent native status failure; output-definedness is independently dictated by actual API/status/source semantics, never by treating any returned call as success.

SDK80 returnedKnown body order is U8 80; four U64 fileCell/APIlease/task/clock; three U32 securityInformation/inputLength/rawNTSTATUSbits; U8 requiredLengthDefined and onlyif1 U32 actualLengthNeeded; U8 descriptorDefined and onlyif1 ByteView. The file/task/clock values MUST equal the corresponding outer actual typed references; APIlease independently resolves the genuinely admitted selected ntdll native system API lease/export/source interval. A mismatch rejects the record; duplicated values confer no independent authority. No arbitrary source-selected dispatch remains unnamed.

ByteView is U32BE segmentCount followed by exactly that many U32BE offset/U32BE length/U8 class entries, with exact length bytes only for class1 nonsecret. Source-known extent length, complete ordered partition, initialized API output, privacy classification and original backing/capture borrower bind every entry. DescriptorDefined0 encodes no ByteView. A homogeneous defined nonsecret descriptor has S=1 and C<=65536, hence maximum returnedKnown SDK80 body47+4+(4+9+65536)=65,600 bytes and complete record90+65,600=65,690 bytes. Returned status-only record90+47=137; notEntered/pending/retainedUnknown record90+1=91. Checked bodyLength excludes header, equals exactly the consumed variant bytes, and cannot authorize allocation before source reservation. Trailing bytes/unknown fields/versions/platforms/states/variants reject.

Physical controls Attempt144+Result128+Receipt128+Index64=464 are not durable wire fields. If all independently coexist with the maximum encoded SDK record, raw lower bound464+65690=66,154 bytes before rounding, IO, clocks, native ABI, stacks/kernel, borrower and full history. Sharing requires actual same-backing source proof, not equal scalar values. A source counter/Index result points to the exact SDK section byte offset/length using U64 fields and the actual original attempt ordinal; the nine association section and SDK section remain separately length-delimited. Their source-approved enclosing archive must specify section counts/lengths and reject cross-section/trailing substitutions; no association header29 is credited to SDK framing. Current SDK section count equals actual emitted records, including failures/pending/unknown, not successful calls only.

This closes one private carrier blueprint only. Its new source encoder/decoder/table joins are explicit required source work, not an activation credential gap or current native implementation. Complete programme still includes all actual native calls, pure-source effects, clocks, archive IO/flush/readback/protection/close and failure/borrower handoffs. Original self-inclusive terminal durability has no finite complete bound; mixed-secret111/217 acceptance and prefix/LIVE suffix or atomic-provider alternatives remain unselected. Prior reconciliation03/04 full FIRSTPASS bank, one-way NOACK, static source/runtime, SID/OW definedness, actual source and current9->8 C9 dispatch constraints are unchanged. All original failed formats and source histories remain inputs; no implementation, fit, authority or whole acceptance is inferred.

Current exact two-section enclosing format

This response together with the byte-identical SDK-CARRIER-05.md is ONE source-private enclosing-format proposal. It retains earlier03/04/05 failed/superseded formats as historical inputs, not alternate dispatch. None is a public primitive, actor, endpoint, authority or implementation. Terminal acceptance T and mixed-secret acceptance S remain unavailable/unselected; no complete durable all-result archive is claimed.

Exact file prefix in order: ASCII8 SLOENV02; U16BE version exactly2; U16BE flags exactly0; nine U64BE runOrdinal,generationOrdinal,archiveObjectCellOrdinal,sharedPhysicalRootOrdinal,originalTransactionOrdinal,originalSourceLeaseOrdinal,originalTaskOrdinal,originalClockOrdinal,originalTerminalWitnessOrdinal; U64BE associationCount; U64BE associationOffset; U64BE associationLength; U64BE sdkCount; U64BE sdkOffset; U64BE sdkLength; U32BE reserved exactly0. Header size8+2+2+98+68+4=136 bytes. All ordinals nonzero genuine typed same-run owner-table references; none is a serialized grant, pointer or proof by count/hash. originalTerminalWitnessOrdinal names an actually held typed unresolved/proposed terminal owner and cannot assert selected terminal acceptance. If no genuine witness owner is available, positive archive construction is unavailable; scalar zero is not a successful placeholder.

Canonical sections: associationOffset exactly136; sdkOffset exactly136+associationLength; fileLength exactlysdkOffset+sdkLength, checked U64 overflow before each addition. There are exactly TWO sections, association first and SDK second. No alignment gap, footer, digest field, additional section, duplicate directory entry, hidden metadata or trailing bytes. The directory is completely included in actual archive write/readback/byte comparison and original physical/native ownership. File/object approval binds actual full bytes and original native provenance externally; this header cannot approve itself. At construction no independently approved current immutable output is assumed before its real write/flush/protection/readback/equality/EOF programme.

Association section contains exactly associationCount complete common29 headers and bodies, kind exactly0..8. Count/length must agree with consuming EXACT associationLength bytes; sdkCount likewise consumes EXACT sdkLength bytes using SLOSDK02 header90 and its checked sdkBodyLength. Empty section requires count0 and length0; count0 with nonzero length or nonzero count with zero length rejects. Each individual body and record end is checked within its section before reservation/reading. Unknown version/kind/SDK variant/flags/state/definedness or trailing body bytes reject. No magic scan or auto detection dispatch. The source-approved input role selects this exact version; magic equality is format recognition only, never source authority.

Native reader uses the actual held immutable regular archive object, genuine full declared-byte read programme, and one actual nonzero-request read after fileLength returning true source-defined EOF. Zero before fileLength is failure; later positive bytes are trailing-data failure. Windows message boundaries are not regular-file EOF. Count loops use U64 checked ordinal advancement and exact remaining bytes; no U32 cast of whole count/length/offset. Original native read results/buffers/clock/identity/borrower/flush/protect/close remain actual programme observations. Parsing fullbytes or comparing a hash does not create those results.

Ordering and binding: association ordinal unique across its run/generation and strictly increasing; references to encoded associations resolve only earlier complete entries or genuinely held admitted predecessor typed tables. No forward references, cycles or foreign run/generation acceptance. SDK records follow actual original attempt ordering by U64 originalAttemptOrdinal and must be unique per actual result/disposition record under the source-owned once-use ledger. Pending->known update is a NEW explicitly retained observation for the SAME actual attempt, with distinct originalResultCellOrdinal and declared state transition; it must not overwrite prior emitted history. If one-attempt multiple records occur, compare key (originalAttemptOrdinal,originalResultCellOrdinal) strictly increasing and require exact actual native source transition. Duplicate key/replayed disposition/reordered result rejects. A pending record never becomes an entered result by decoder inference.

All SDK run/generation must equal prefix; source/task/clock/object/IO/result/attempt typed references resolve the authentic held current or approved predecessor owner table, with source-selected predecessor lifetime binding. SourceLease equals the prefix selected recording source lease; actual original performer roles are separately resolved through each attempt/source lineage, not silently relabeled recorder. Duplicate body cell/task/clock refs in SDK80 equal their outer actual refs. Independent observer/task/clock and archive/control ownership are separate genuine held cells; equality of numbers does not admit them. SDK section offset/length and record offset/length use U64 ArchiveIndex named slots; no association kind8 becomes a SDK union. Association records establish correlation to actual preexisting owners; neither section creates the owners or positive receipt.

Kind8 generation U32 attemptCount and U32 associationCount remain EXACT unchanged widths. This candidate admits ONE generation only when actual distinct attempt count<=4294967295 and associationCount<=4294967295, and the kind8 counts equal the actual unique attempt set/association directory count under its exact existing semantics. U64 sdkCount is independently allowed to include distinct pending/known/failure disposition records, but each references an admitted attempt in that checked generation. It is not truncated into attemptCount. A record-count overflow or unavailable next reserved slot fails BEFORE a further uncovered native effect, retaining all existing native history. It is truthful resource exhaustion, not proof of sufficient progress. This candidate does NOT silently select a generation/page split to fit U32; introducing more generations would require exact genuine predecessor/one-use/lifetime/programme definition and cannot cure terminal self-observation. U64 section lengths/offsets remain valid above4GiB even with checked U32 generation counts. Kind8 encodedLength equals exact fileLength, while its actual archive/transaction/root/clock/witness refs match the prefix's typed owner identities. No own/future digest is embedded.

Archive owner is original actual regular-file/native root custody; transaction owner retains original writer/flush/protection/identity/readback/EOF attempt sequence; source/task/clock joins genuine original source and lifecycle; shared root retains actual allocations/index/pages/SDK output/copy/IO/failed cells; terminal witness retains genuine held native results only under its actual granted backing/task lifetime. No header can infer all these ended from local close or a successful write. Real final close/borrower retirement results remain the unresolved terminal suffix under unchanged all-results durability. If the parent later selects a changed bounded prefix/LIVE witness acceptance, it must explicitly select coverage membership, suffix ownership and failure/power-loss semantics; this envelope does not do so. If full all-result durability is retained, the causal self-observation contradiction and absence of an atomic durable original effect/result provider remain NO-GO. T and S are not fields/defaults/flags in this file and no selection is encoded by flags0.

These exact wire/source joins complete the private framing blueprint only. Actual first-pass output bank/history, finite original source programme, per-effect private receipt constructor, independently qualified static image/source/SDK API leases and physical rounded capacity remain whole-candidate obligations. No actual realm/grant/native original call, successful all18-route fit, secret waiver or whole source acceptance follows from this response.

Original domains and eligibility​

Physical representation choice and rejection conditions​

Exact joins and nonthrowing native transition​

D1 first decision and deadline custody​

Actual23 command payload phase derivation​

Core stage and NQ actor/phase handoff​

Full64MiB capsule capacity and true overlap​

Mixed-secret journal and terminal decision boundaries​

Remaining concrete whole-source decision obligations​

Concrete private record representation selected for the candidate​

Current channel payload maxima, before other owners​

Native backend and preentry commit recipe​

Concrete native-only parser/capsule handoff candidate​

Reference-runtime dependency propagation​

Capsule metadata allocator/type choice​

Source-derived capsule framing and progress counts​

Closed journal view rather than an unowned DOM​

Windows original message and kernel-buffer ownership counterevidence​

Original command decode lifetime and borrowed field representation​

Original input lease migration is an owning interface change​

Short-progress history capacity is a real supported-route condition​

Reference interpreter interruption order remains original​

Original row inventory and native overlay consumer closure​

Conductor selection of Windows per-existing-frame messages​

Exact per-frame payload owners after selected message change​

Inert exact record-layout source for whole review​

Selected provider phase separation and original kernel queue equation​

Actual UTC remains distinct from D1 monotonic authority​

Owning stage-read join: original23 caller/result custody, not transferred native storage handles​

CE2 whole engine constructor and all23 owning-effect contract candidate​

Selected original V8 backend and actual Core runtime borrower​

Single current private measurement carrier and capacity predicate​

Original constructor/test API source distinction retained​

Source archive owning reader and build producer interface candidate​

Selected material R4 compressed-stage validation and replay candidate​

Genuine original last-match subject and shared-context lifetime​

Original allocator failure and growth source counterevidence​

Preentry ownership record versus authority enrollment​

Provider task resource-work clock: complete prospective internal policy, not caller authority​

Original interpreter overflow-before-check allocation counterevidence​

Historical SOURCE-01 comparison to stage allowance; not an observer cap​

Selected prospective segmented original interpreter repair​

Core snapshot immutable bytes and source actor boundary​

Normative RAW167772160 scope correction from governing stage reservation clause​

Selected prospective SOURCE-01 lossless payload interning​

SOURCE-01 construction overlap: retain original output before immutability​

SOURCE-01 finite data-loop programme bounds, distinct from positive full-progress counts​

Original inflater and replay chronology dependency retained in this candidate​

R4 original backend matching-phase source equation​

Prospective programme qualification facts are evidence, not source authority​

SOURCEBUILD original object lifetime count before payload interning​

Proposed FIRSTPASS original returned-bank aggregation: retain bytes, relocate lineage explicitly​

Provider per-frame source calculus preserves complete original capsule scope​

Prospective caller-owned Windows security descriptor query​

Exact clock programme terms and bounded IO repair are separate source choices​

Complete engine transaction ownership states for the proposed eighteen definitions​

Native qualified geometry is a constructor operand, never a measured receipt callback​

Actual embedder call sites that the owner producer must replace coherently​

Exact native channel loops covered by the pending IO programme repair​

Provider closure observation actors and exact current Windows ordering​

O2 exact defined-output/security/aggregate reconciliation input​

SINGLE selected measurement dispatch; historical sixteen-key alternative superseded​

Closed named archive/attempt storage mapping and genuine large history offsets​

Current single closed observer archive and SDK dispatch​

Current exact SDK record body and carrier​

Current exact two-section enclosing format​