Original clock-domain custody bounded source unit (#1643)

Development SOURCE ONLY under SPEC002 AC-4CF.1b / SPEC006 AC-6E.SA1, all CA01..CA08 and accepted ENTIRE D1. This checkout owns NEW original-clock-domain.hpp and prospective source vectors only. Frozen checkpoint16 prerequisite headers remain primary-owned and are not copied. Dormant source requires reviewed entire integration.

Provenance correction: initial detached managed HEAD was43c3cae9a79094b31fac20924a09c42d6490e40c and the live origin/develop read matched, but git switch -c ... develop actually selected the stale local develop3a8d0c9c1510c7e5832dae1eca7bd38eacf02444. The genuine graph is a4b0d807 -> a845979a ->3a8d0c9c. Earlier01/02 frozen precode/report/GIT-STATE claims of direct43c3 ancestry are FALSE and remain preserved as rejected evidence. No history is rewritten. This same owned issue branch reconciles ONLY freshly fetched origin/develop710059eded522b2301471f7d06d22a5989e60916 through an ordinary merge; five governance append conflicts preserve full incoming governance and the corrected whole-unit mapping. No main input, reset or branch rename occurs.

Own current task/process/domain custody must precede first HTTP sample. Queued workers acquire actual current task and correlate held original process/domain under SAME Budget. Linux retains pidfd, procfs/process/task directories, bounded stat bodies, time namespace FD, fstat/NS_GET_NSTYPE and actual sampling IDs. Windows retains original process/thread handles and actual native birth/ID/liveness/QPC bodies under existing rights. Native close failure is unresolved. No new forty-second end, callback grant, profile field, greeting field or primitive enum is introduced.

Linux v6.18 nsproxy.c copy_namespaces retains current time_ns for CLONE_VM; timens_on_fork runs only without CLONE_VM. Time namespace implementation timens_install denies a multithreaded process. Unshare changes for_children; exec_task_namespaces can change current namespace on exec. This supports qualified same-TGID thread association, not universal immutability. Remote single-task setns/exec transition-and-back cannot be excluded by two fstat observations. Frozen Core has no positive companion entrypoint/constructor to prove sampler/lifecycle exclusion. Peer adoption remains unavailable without complete original source/lifecycle qualification; no PID/main-thread or inode/frequency-only positive is fabricated.

ALL1093 checkpoint16 and ALL29968 D1 transitive associations were independently read and SHA256/size checked with zero failures. Original architecture ROOT1dbe0d3c13b3a456ab9547a940904dc5d8881f6ab5163ff93b9f76fc547d0364 and independent whole review remain retained externally. API semantics are context, not current kernel, rights or realm grants. Logical Budget is not physical FREE. Full128MiB owner/full64MiB support, native allocator, original realm/resources/source/calibration and production construction remain unfinished.

The rejected a4b0 prototype retained256 fixed raw observation slots. It remains in frozen01/02 and genuine Git history; it is removed from current header to prevent adoption as a positive producer. Its exhaustion/custody/destructor/control shortcomings are not acceptance boundaries. Current selected source proposal has no fixed history cap and no shared_ptr/Handle/Budget substitute. Native control-block allocation, owner retention of last-borrower/failed closure and complete physical retirement still require concrete primary backing. There is no positive domain/owner constructor merely from new declarations.

Concrete decision needed before whole positive integration: select native retained-history allocation/borrower accounting within SAME128MiB that proves full64MiB support; bind supported original Linux kernel/source semantics and actual no-setns/no-exec lifecycle throughout capture, queued work and authenticated peer adoption. Options are source-owned original task/lifecycle leases integrated with complete original owner, or a new whole mapped native exclusion design. A request field, approval bool, API name, equal inode/frequency, snapshot-only observation or unqualified main-task assumption is not an option. Preserve80 greeting/provider64, existing rights and all original deadlines. Different fresh ENTIRE architecture supplement review precedes material new ownership/lifecycle implementation.

Narrow whole D1 supplement proposal

Actual immutable checkpoint16 native-connect.hpp initiating Linux path creates its original socket with SOCK_CLOEXEC and SOCK_NONBLOCK, authenticates it via authenticateUnixPeer, then immediately calls companion establish(true, originalDeadline). It does not perform a current F_GETFD readback. No receiving companion socket/accept/entrypoint/launch definition is present. core-image.cpp is the production Core Node entry; its four-thread platform selection is not actual thread birth/liveness proof. Existing OriginalPeer authenticates SO_PEERCRED, retains pidfd/image, reads process birth, maps and image objects, then alive checks only pidfd readiness. Subsequent alive does not reauthenticate current mapped source. Exec preserves process PID/birth; inherited channel closure or later EOF does not itself prove no earlier namespace transition or effects. There is no selected peer-side inheritance/duplication/control source on which to claim exec exclusion. Therefore no positive peer-domain constructor is authored.

Proposed refinement remains within existing80 companion greeting/provider64 and existing rights: complete the original owner resource graph with strongly retained original process/task and connected channel objects; retain real descriptor flags/inheritance bodies on BOTH original sides; source-owned entrypoint/task creation and every sample site bind actual original task/TGID. The exact native supported kernel/distribution image and admitted complete source must establish current time namespace sharing and forbid same-channel source transitions/descriptor duplication/exec, or provide an independently reviewed native exclusion mechanism. The v6.18 source above supplies context only; it is not that host tuple. Every acquisition/sample adopts the immutable end only once after this actual predicate; missing association remains unavailable. No source-name/role/boolean callback is substituted for native custody.

Proposed history refinement replaces padded8192-byte cells with typed actual-size native return bodies plus separately charged exact bounded raw proc read chunks. SAME native owner reserves every control object, backing extent, vector capacity, raw frame, exception and shared borrower BEFORE allocation; failed acquisition and close preserve reachable original objects through its existing original owner ledger. Retained successful and failed original bodies are never overwritten to avoid a cap. Allocation/IO failure denies effect authority, preserving originals; it does not renew time or imply FREE. The complete arena and borrower model must prove the sum of all existing capsule64MiB, channel/provider/Audit/storage copies and new history fits128MiB for the complete valid journey, including worst-case checks and pending IO. No smaller arbitrary history cap or per-token allowance is selected. If that proof needs a different retained-success policy, it is a material whole decision before source implementation.

Review must include ALL current physical Core/CLI/CE1 source, original failed inputs, selected constructor/resource graph, every capture/queue/peer/greeting/sample/IO callsite and exact raw kernel/API bodies. Required prospective direct cases retain original raw outcomes for capture-thread before sample; real worker task correlation; same/different timens; original task exit/PID reuse; observed and transition-and-back exec/setns; inherited/duplicate channel substitution; denied read/type query rights; history allocation/borrower exhaustion; full64MiB streaming plus retained failures; original-expiry and unresolved native close. No mocked grant or authentic positive is supplied. Different fresh ENTIRE architecture reviewer must accept or reject this exact supplement before implementing its material missing owner/lifecycle boundaries.

The different ENTIRE review at a4b0d807 is PRODUCT_SOURCE_NO_GO and rejects this submitted supplement as insufficient. Full report336f9091881f0b71f1f05c8de81eec7c19a562d863144c935c8bf3b44588f9cb/root98d070732e9adc0fc65060d61628cf3d3d09332f666d6e237e63bf4c7bba3888 remains authoritative for all seven source findings and provenance correction. Its complete replacement requirements are selected for repair; they do not establish numeric sufficiency, authentic source or positive construction. Existing header/cases are rejected preserved partial source awaiting coherent replacement.

Selected complete owner-join source proposal

Primary owns the SAME CE2 native physical owner/geometry/layout/error/observer/actor interfaces and full eighteen remaining effects. Clock author owns private clock type/dataflow declarations and native algorithms only. original-clock-domain-owner-proposal.hpp is an exact required signature proposal with NO definitions or admitted constructors: OriginalNativeAdmissionOwner; intrusive root/frame/cell leases; actual ProcessLifecycle, SourceClockProgressGraph, CaptureAuthority, Sampler, PeerDomain, AuthenticatedChannel and MandatoryArchive leases. None is a boolean/function callback or additional actor/realm/allowance. Root enrollment requires already genuine owner+lifecycle+whole progress graph; absent backing has no positive producer. Primary must select definitions before a different whole review permits joins.

Source dataflow is exact. (1) Owner reserves root/control/terminal failure/native stack/exception capacity and strongly enrolls it before any native query. (2) Each transition reserves exact immutable input/raw output frame and an empty native handle cell, including alignment/backing/control and actual borrower costs. (3) Syscall writes its actual result; native error is captured immediately. (4) FIRST adoption is noexcept commit into the already linked cell/frame, with raw original handle/error/attempt and actual output body; only afterward validate and publish. No formatting/allocation/shared control/throwing record interposes. (5) Denial is a nonthrowing root state transition; failure returns actual retained outcomes, never unwinds a Handle. Every temporary stat/task/ns reader follows the same cell enrollment. Scalar native returns are stored verbatim as result/rawHandle; actualBodyBytes zero means no separate output-buffer body, not an absent return observation. Native queries write directly into pre-reserved aligned output extents.

Linux capture algorithm obtains actual getpid/gettid in pre-enrolled API frames, opens current pidfd and literal procfs, retains fstatfs/fstat actual proc object, opens source-derived process/task directories through held originals, reads bounded raw stat fields with exact chunks/EOF and decoded birth, opens current ns/time, records actual NS_GET_NSTYPE and fstat, and retains all original cells/inputs/results. No requested PID/path/readlink/inode authority. Namespace opens intentionally follow the procfs kernel namespace link only after held proc/task/type/source correlation. Around each actual CLOCK_MONOTONIC sample, retain current task IDs, process/task birth/liveness, namespace object/type and actual counter bodies through original frame leases. A successful partial read consumes strictly positive remaining source bytes; first unsupported EINTR/error denies while original body remains retained. Protected existing retries elsewhere remain unchanged and counted. Root-correlated actual process lifecycle and selected original kernel semantics supply no-transition exclusion; snapshots alone are unavailable.

Windows capture algorithm pre-enrolls actual current process/thread duplication cells, native process/thread/parent IDs, creation/liveness bodies and QPF/QPC results under existing rights. No current identity/process image/source/host calibration is inferred from frequency. Worker entry acquires ITS actual thread/task and correlates retained capture process/domain/lifecycle through SAME original root. Thread-local monotonic ordering belongs to that task; cross-task ordering uses actual qualified clock semantics and existing one-tick conservative arithmetic. No sample/start end is regenerated. This exact task/domain lease is the only prospective positive Deadline producer; raw sample/end constructors must be inaccessible to normal positive callers in primary's coherent integration.

Peer algorithm requires actual already authenticated connected channel with both original actors' exact creation/accepted descriptor/inheritance/flag bodies, actual source-owned sampler/task association, birth/image/current source closure, continuous no-setns/unshare/exec/migrating fork/clone/dup/SCM_RIGHTS/channel-transfer exclusion and selected original host/kernel/clock qualification. Original SO_PEERCRED or QPF alone cannot produce it. Root captures authentic sampler and domain before original end adoption. Receiver bootstrap holds this original channel/lifecycle under bounded original authority without operation authority, reads80 exact bytes once, independently samples its owning sampler, then checks representability/frequency/domain/expiry and atomically adopts end once. Original frame decoder handles valid pipelined next bytes; no receipt+40s, duplicate greeting or provider64 change. The actual receiving entrypoint/constructor and Deadline/caller definitions remain primary-owned missing source.

Close algorithm owner-serializes actual cell/use/native IO state, pre-reserves original raw close frame, then begins exactly one syscall attempt. Not-created/already-attempted/live-borrower means NO syscall and a separately retained disposition with nativeCallEntered=false, never synthetic close success. Actual close immediately captures raw return/error/handle/cell identity and commits noexcept. Linux EINTR and Windows failure stay unresolved, with no destructor retry. No source mutex spans native IO. Caller/frame destruction drops only an accounted borrower; strong root keeps failed/abandoned/native-unknown history. Explicit retirement requires actual ended cells/IO, zero actual borrowers and complete existing mandatory archive readback lease. No archive producer, payload digest or Budget.closed can fabricate those facts; absent producer keeps bytes retained and charged.

Progress/fit source dependencies are mandatory and precise, not guessed numbers. The complete graph enumerates all23 implemented commands, setup/image/maps/source reads, capsule signing/readback/stream transfer, provider67MiB message/parser, receiver, every Deadline check/wait/partial read and terminal recovery/close transition. One pending native IO owns one remaining-original-end completion wait; no unconditional5ms spin supplies an assumed count. Every protected bounded retry retains each actual native body; every positive short read decreases its source byte bound. Each callsite row needs maximum invocations, exact native input/body/output/control/stack/error/alignment/capacity extents, retained/archive lifetime and simultaneous phase owners. Full peak formula is the maximum over those complete simultaneous phase rows, INCLUDING unchanged67108864 expanded capsule and complete current provider message with moves/streaming rather than a second copy, and must be <=134217728. Nineteen original owning effects/observer/arena are absent in checkpoint16 (primary later reports eighteen remaining); the clock component cannot invent their rows or a passing sum. Unsupported tuple may deny; complete independently admitted valid64MiB journey remains mandatory.

Prospective native cases now require actual root/lifecycle/progress/archive fixtures and include a concrete real native process-acquisition return/cell/attempt check. Mandatory full acquisition-fault/borrower/task/timens/transition/channel/close/auth/end/receiver/maximal-journey cases are explicitly declared UNIMPLEMENTED and UNEXECUTED pending concrete primary APIs; declarations are not passing tests. Original protected evidence is unchanged. This is source-ready coherent interface/dataflow/algorithm preparation, not completed native product implementation or a new partial GO.

All imports/parsers/npm/compiler/build/tests/native/ACL/ENV execution remains prohibited until different ENTIRE product SOURCE GO and NEW complete-input ROOT admission. Parent owns tracking, original failures and final qualification. This partial header is not whole Core or GA completion.