Core1643 original observer: whole precode candidate O1
Status: Development, SOURCE DESIGN ONLY, 2026-10-05. This is a proposed entire observer/capture/archive/receipt unit, not architecture GO, positive producer code, source completion, an original owner grant, execution admission or native acceptance. A DIFFERENT entire architecture review must select or reject the complete candidate before positive code. Original Core23 effects and CA01..CA08 remain the complete product obligation. There is no all-deny implementation delivered here.
Scope, receiving base and exact inputs
The separate sole author owns only NEW original-observer.hpp, original-observer-capture.hpp, original-observer-archive.hpp, original-observer-receipt.hpp, this decision, and tests/helpers/core-admission-original-observer-fixtures.mjs. Primary Core ownership retains every existing platform, authentication, storage, stage, capsule, journal, Audit, materializer, command engine, binding and constructor file. Hooks described here are integration responsibilities requiring coherent primary changes after selection; dormant headers cannot complete those effects. No observer entrypoint, build target, packaging, public route, profile key, actor, privilege, credential or ordinary wire field is added by this candidate.
Own branch feature/1643-original-native-observer-oct05 starts from refreshed origin/develop710059eded522b2301471f7d06d22a5989e60916. The preceding receiving base43c3cae9 differs only in Todo/SSO documentation and its SPEC002/intent/backlog mapping; those changes are preserved and are not observer inputs or runtime approval. The active primary's different issue branch is not branch origin.
Design inputs include complete frozen1095 tracked+untracked primary files in core1643-original-observer-interfaces-oct05-01, ROOT15c6f4fc58cea29695cd6afa82b5f5e87dc6900ba3af8810a0a904444f1fc541; INTERFACE-CONTRACT.md12740/SHAfba65f90a81ef17835df6daa03ee6509acd39a741fbae48cd54872f83ac6d3d8 and CORRECTIONS.md589/SHA61235f93251141ceb83a834b9b730c171d60f88037107860a0abed1c82db63b8 stay together. Audit uses closed17-KEY payload, cap16384, provider unsigned/signed frames16528/16560; the original17-byte phrase is retained historical typo, not a selected size. DRIFT-01 is a separate nine-file delta, manifest87563ad08626a6df706de273c67d0cbde51976920a8d78ec2e10ed7af4d56a7f. Its materializer now checks expected mode before/after full native read and real EOF; local EOF remains an uncaptured original.
Accepted CE1 and D1 decisions/reviews, complete NQ1 proposal/NO-GO/amendment/counterevidence, partial original-clock author and checkpoint16, original F1-F4 architecture/reviews, entire current Core/CLI source and original failed/private evidence remain cumulative inputs. The accompanying external complete-input packet must contain actual original byte associations, raw Git objects and receiving source, rather than a list of packet names or inherited PASS booleans. Current CE2/NQ work is not final frozen authority and cannot supply a fabricated positive prerequisite.
Concrete selection and material decision boundary
Select a typed native capture transaction at each original performer API call, transferred through the already CE1-admitted original owner/object interface to the existing independently admitted observer. Capture is part of the source-built performer; independent observer checks actual transferred original objects and complete original source/run lineage. Capture performed by the observer is explicitly an observer operation, never relabeled as a Core/companion/provider operation. Service collector and observer remain separate original roles.
O1 proposes two new PRIVATE representations: a source-built native attempt carrier and a versioned bounded archive envelope. Neither is a new public/native primitive enum or a source authorization mechanism. The native attempt owns its actual SDK result storage, native object/peer/source/clock leases, allocation extent, live IO state and borrowers. The envelope records that attempt and its complete associations in durable original observer storage. The receipt is privately constructible by the correlator only after the relevant full conjunction. No bool, callback, digest, parsed JSON, path, supplied timestamp, source-owner label or native handle integer grants success.
The runtime predicate is the actual selected full production core-image.cpp: source-selected --jitless, closed generated production bundle, disabled ambient Node CLI/NodeOptions loaders/debug variables, no native addons/global search paths/ESM loader/inspector, and all ordinary Core API/auth/config/lifecycle sources and dependencies. O1 preserves that selection exactly. The CLI user's 8MiB whole Node library objection is not authority to amend Core runtime flags or add JIT. No runtime behavior/feature reduction, V8 source patch or new executable-generation privilege is selected here. Unqualified executable mappings deny the native admission association while the full selected Core remains the required product. Missing authentic owner/image/source/clock resources remain activation gaps; unfinished ledger/hook/allocator/codec algorithms remain source gaps.
Original attempt carrier and native call geometry
NativeOriginalObservationAttempt is move-only, privately constructed by named source-owned syscall adapters. Its internal state is Reserved -> InFlight -> Observed -> ArchivePending -> Archived -> BorrowersEnded -> Retired, or RetainedUnresolved from any state. Allocation/control/nativeIO ownership is established before Reserved. Adapters record actual current performer process/thread/birth and original source lease, exact operation arguments, preoperation original object and related parent/object leases, original clock samples/end, requested buffer extent/offset, actual API return/error, returned byte extent, postoperation original identity and native IO terminal state. Only the adapter assigns observed outcome from original return/error semantics. Checked decoding never upgrades an unobserved result.
Only selected nonsecret call input/output byte extents are captureable. Blueprint111 excludes raw ResolveKey/idempotency-provider body bytes AND key-derived digests from rows/archive/public/private proof; auth/confirmation tokens and secret keys likewise never enter capture. Record actual native framing/length/owner/IO/error custody with an explicit source-owned noncapturable extent classification; do not hash redacted secret bytes or claim full-byte equality for that exception. Capture selection is fixed by source operation/field geometry, never caller-supplied redaction. Nonsecret call input bytes and output bytes are distinct owned views. An original write borrower survives until actual native write ends and archive equality/readback ends. An original read borrower includes the actual allocated nonzero destination extent even when returned count is zero. A count-zero request cannot yield an EOF observation. EOF is only a successful original nonzero-size read returning zero, with original same-object/offset/expected-length context; hash(empty) is projection of that original zero-length view, never an empty queue, END frame, counter or closure flag. Early EOF at an expected nonterminal offset is retained failure, not completed stream.
Windows raw results retain actual FILE_ATTRIBUTE_TAG_INFO, FILE_ID_INFO (64-bit VolumeSerialNumber and complete128-bit FileId), FILE_STANDARD_INFO, original TOKEN_USER buffer/SID, GetProcessTimes FILETIMEs, pipe peer PID return, actual NtCreateFile NTSTATUS and IO_STATUS_BLOCK, ReadFile/WriteFile BOOL/DWORD and immediate GetLastError on failed call, original requested buffer extent, SetFilePointerEx result/location, security descriptor/ACL bytes used by actual AccessCheck, GENERIC_MAPPING/PRIVILEGE_SET return extents and token ModifiedId, directory query buffers and every original NextEntryOffset chain, rename FILE_RENAME_INFO original bytes/return, FlushFileBuffers return, wait/GetExitCodeProcess returns and CloseHandle return. SDK padding and uninitialized tails are never serialized or hashed as observed bytes. Raw native storage is initialized, actual valid field extents are encoded explicitly, and full returned opaque SID/security/directory bytes are retained where defined. Keys/tokens/auth secrets are excluded from capture; key-provider idempotency/ResolveKey payloads and key-derived digests are noncapturable under Blueprint111; other domain frames retain only specifically selected nonsecret bytes and original object/source scope, never raw key storage/auth/confirmation.
Linux raw results retain actual stat fields/type/device/inode/uid/mode/size, ucred plus returned socklen, pidfd acquisition syscall return, original /proc stat birth bytes and held proc/source objects, pread/pwrite request offset/extent and ssize_t/errno per syscall (including EACH partial write/EINTR attempt), fsync return/error, openat/mkdirat/fchmod returns, renameat2 flags/return and original old/new held bindings, original directory enumeration result buffers/entries and true terminal enumeration result, flock/unlock returns, waitid(P_PIDFD) siginfo and syscall result, poll revents separately, and close return/errno. Existing readdir implementation must either retain each original libc/kernel observation under the source-approved libc dependency or be coherently replaced with source-defined getdents capture; a decoded sorted name vector is not raw directory-query proof. This choice changes no linux.getdents public primitive vocabulary.
Linux close EINTR invalidates the original descriptor once and is unresolved; never retry a possibly reused FD. Windows failed CloseHandle retains the original handle. Destructors are conservative final fallback only and cannot mint a close row or physical FREE. A true naturally successful child exit requires the original parent relationship plus waitid SIGINFO/CLD_EXITED/status0, or original processHANDLE wait/GetExitCodeProcess exit0. pidfd poll alone establishes readiness, not exit status. Nonparent observer cannot silently gain wait rights; it correlates the genuine parent wait attempt with its independent original peer/stream custody.
Original source, executable pages and generated-code lifetime
ProcessSourceClosure/profile/CE1 authenticated original Q/S/owner authority is the only eligible source association. AdmittedImageObject strings remain correlation data; no arbitrary SHA or own captured file read admits a source. Retain original executable/dependency file identities and actual raw bytes/true EOF; independently verify native page geometry and current bytes, rather than equating file SHA with loaded pages.
For static Windows image mappings, record original VirtualQueryEx MEMORY_BASIC_INFORMATION and module/image association for every committed executable page; read actual page bytes through existing PROCESS_VM_READ and preserve exact partial/failed returns. QueryWorkingSetEx after actual residency records original Valid/Shared/page attributes. MEM_IMAGE alone does not detect COW: the official API documents that COW image pages keep that type. A nonresident, unreadable, privately changed, unknown relocation, changed geometry or mismatched original process/source epoch remains unresolved. Source-built loader correlation must compare expected mapped bytes including actual PE section geometry, zero-fill and validated relocation/import fixups; a blanket file-page equality or stripping unknown byte ranges is forbidden. Auxiliary raw API bodies stay private under existing identity/read source observations, not invented primitive enums.
For Linux, retain complete original maps/map_files/fstat/birth associations and actual selected loaded-byte reads. process_vm_readv is non-atomic and PTRACE_MODE_ATTACH_REALCREDS-gated; snapshots cannot prove an interval or supply rights. Partial page reads, credentials/permission failures, namespace/source replacement, executable anonymous mappings without source-owned generation lineage and unknown loader relocation remain unqualified. No ptrace attach, process suspension, CAP_SYS_PTRACE/CAP_SYS_ADMIN, Yama change, setns or new Windows process rights are selected. Native loader/kernel byte association and access must receive actual original qualification.
For the selected static/builtins runtime, retain actual isolate/runtime/source bundle/image/dependency objects and complete mapped executable inventory. Source-selected jitless alone is not a trusted peer claim: the genuine original build/runtime/flag/source association and all startup-generated executable mappings must be verified from the original complete source and native qualification. Immutable builtins/snapshot mapping must resolve actual source-built backing, offsets, relocation and original page bytes; no anonymous page is exempt because Node created it. Source-proved immutable executable mapping owners persist through the owning effect and independent original observations; changed geometry/bytes or unproved writable aliases retain unresolved. Loader/native runtime startup and mapping/protection transitions require complete independently admitted source plus real native custody, not a string flag check. Exact Node22.23.2 commit aa4c77582be995286fc6e00aaf530dc7ade102a9/treecee5f56eb6b8b6b8e300419196dc90e8c7abd64b is current CE2 reference context, not a qualified final Core build supplied by this candidate.
Nonselected JIT alternative counterevidence is retained separately: original deps/v8/src/common/code-memory-access.h, code-memory-access.cc and code-memory-access-inl.h exposes ThreadIsolation/WritableJitAllocation write and unregister paths; deps/v8/src/objects/instruction-stream.cc Relocate performs byte changes then FlushInstructionCache. RwxMemoryWriteScope is a no-op on unsupported configurations and PKU does not retract executable permission. JitPage destructor/UnregisterAllocation TODOs about memory still in use mean map erasure is not retirement. A future explicitly selected generated-code runtime would need original source-owned publication/write/relocation epochs, real thread/execution/GC/compiler/observer borrowers, complete code-construction provenance and native page correlation across those transitions; original snapshots cannot establish lifetime integrity. This is preserved counterevidence and a material future whole decision, not an O1 dependency or a request to patch V8/disable more features. O1 must establish the actual selected static-runtime predicate and its real mapped byte/lifetime proof without silently switching runtime selections.
Private archive codec, ownership and correlation
Proposed archive is source-private original-observer-archive.v1, binary rather than trusted JSON. Every integer is explicit U8/U32BE/U64BE, every variable body has a checked U32 length, all digests exactly32, no native pointers/SDK padding. Signed native values use fixed-width two's-complement I32BE/I64BE, never JSON numeric conversion. Header is fixed magic eight ASCII bytes SLORAW01 plus U32 version1. Each attempt envelope is U64 sequence, U8 platform(0linux/1win32), U8 PRIVATE adapter tag from the table below, U8 primitive projection presence, and when present U8 existing primitive-kind ordinal/U32 source-owned operation ordinal within the exact existing vocabulary; then B32 performer source-image association digest, B32 original performer identity association, B32 original clock-domain association, U64 original start/end tick, U64 original absolute authority end, U64 frequency, B32 original object association, B32 related association, U8 outcome(success/failure/unresolved), U64 requested offset, U32 requested extent, U32 actual native raw-result length/raw result body, original input view, original output view, U32 association-table length/exact association bytes. Each view is U8 presence(0unobserved/1observed-nonsecret/2source-selected-noncapturable); only presence1 is followed by U32 length/exact original bytes. A genuine observed zero-length view has presence1/length0. Presence2 NEVER carries byte hash/raw contents and cannot project a primitive success byte observation. Raw error status is recorded in the operation-specific native-result body, never inferred from outcome. Terminal envelope includes actual ended IO state, archive write/flush/readback attempts and borrower disposition; it cannot declare a future close.
Native-result bodies are source-built closed platform/operation types with exact field encoders matching the native geometry above. The reader requires the exact operation's complete raw type and returned extent; unknown tags, duplicates, trailing data, invented fields and inconsistent native status/byte extents reject. Adapter source plus original compiler/SDK/kernel/dependency association defines field interpretation. A portable guessed struct dump is forbidden. The whole architecture review must assess this new codec and all defined encoders before positive carriers are implemented.
Private raw adapter tags and exact bodies are proposed as follows. SDK field widths are encoded explicitly with original source/ABI association. blob is U32 length plus actual initialized valid bytes; ref is B32 referencing a held original association entry, never an address or path grant. Every native call gets a separate envelope; a composite API helper never discards a failed/partial constituent. A tag's absent/unobserved output has presence0, not invented zero fields. This is a NEW private archive codec requiring whole selection, not expansion of the eleven-key primitive enum.
| Tag | Exact raw result body |
|---|---|
| 1 Linux fstat | I32 syscallResult,I32 errno,U64 dev,U64 ino,U32 uid,U32 gid,U32 mode,I64 size,U64 nlink; native nanosecond times as I64 sec/I64 nsec for atime/mtime/ctime, original sizeof(stat) U32/ABI ref. Result fields after errno exist only syscallResult0. |
| 2 Linux openat/mkdirat/fchmod | U8 subop(0open/1mkdir/2chmod),I32 result,I32 errno,U32 flagsOrMode,ref originalParent,blob source-owned leaf bytes; actual FD number is I32 correlation only and ref holds genuine object. |
| 3 Linux pread/pwrite | U8 direction(0read/1write),I64 syscallResult,I32 errno,U64 requestedOffset,U32 requestedCount; original views in envelope. Each EINTR/partial attempt preserved independently. |
| 4 Linux fsync | I32 result,I32 errno,ref originalFileOrDirectory. |
| 5 Linux renameat2 | I32 result,I32 errno,U32 flags,ref oldDirectory,blob oldLeaf,ref newDirectory,blob newLeaf,ref heldChildBefore,ref heldChildAfter; after absent on failed/unobserved call. |
| 6 Linux getdents/readdir | U8 selectedSource(0getdents/1source-admitted-libc-readdir),I64 result,I32 errno,U32 requestedExtent,blob actual initialized returned kernel/libc entry data; exact libc dependency/ABI ref where applicable. Terminal readdir null requires original errno0 and original native stream custody, not decoded empty list. |
| 7 Linux SO_PEERCRED | I32 result,I32 errno,U32 inputSocklen,U32 outputSocklen,I32 pid,U32 uid,U32 gid,ref originalSocket. Credential fields present only successful complete result. |
| 8 Linux pidfd_open/poll | U8 subop(0pidfd/1poll),I32 result,I32 errno,I32 originalPid,I32 events,I32 revents,ref originalProcess. Poll alone never projects naturalzero exit. |
| 9 Linux waitid | I32 result,I32 errno,I32 idtype,U32 options,I32 siSigno,I32 siCode,I32 siPid,U32 siUid,I32 siStatus,ref originalParent,ref originalProcess. siginfo fields present only successful actual returned body. |
| 10 Linux close/flock | U8 subop(0close/1lock/2unlock),I32 result,I32 errno,ref originalObject,U32 originalFlags. |
| 11 Linux process/raw-source read | U8 sourceKind(0stat/1maps/2mapFiles/3loadedBytes/4namespace),I64 result,I32 errno,U32 requestedCount,ref originalProcess,ref originalHeldSource; complete returned nonsecret data is original output view. |
| 12 Linux namespace/clock | U8 subop(0NS_GET_NSTYPE/1clock_gettime/2getpid/3gettid),I64 result,I32 errno,ref originalSamplingThread,ref originalNamespace; actual CLOCK_MONOTONIC body adds I64 sec/I64 nsec on successful subop1. |
| 64 Windows disk identity | U8 subop(0GetFileType/1tag/2fileId/3standard),U32 result,U32 immediateError,U32 returnedExtent; success tag U32 attributes/U32 reparseTag; success fileId U64 volume/exact16 identifier bytes; success standard I64 allocationSize/I64 endOfFile/U32 numberOfLinks/U8 deletePending/U8 directory. |
| 65 Windows NtCreateFile | I32 NTSTATUS,I32 IO_STATUS_BLOCK.Status,U64 Information,U32 desiredAccess,U32 share,U32 disposition,U32 options,ref originalParent,blob original UTF16 leaf bytes,ref actually returned object. The IO_STATUS_BLOCK Pointer union arm is never serialized; only actual NTSTATUS status under original source ABI is encoded. |
| 66 Windows ReadFile/WriteFile/SetFilePointerEx | U8 subop(0read/1write/2seek),U8 BOOL result,U32 immediateError,U32 requestedCount,U32 returnedCount,I64 requestedOffset,I64 actualNewLocation; actualNewLocation only observed on successful seek, returnedCount only actual initialized API output. |
| 67 Windows flush/rename | U8 subop(0FlushFileBuffers/1SetFileInformationByHandleRename),U8 BOOL result,U32 immediateError,ref originalObject,ref originalParent,blob exact initialized FILE_RENAME_INFO fields (U8 replace,U32 UTF16 byteLength/bytes); no SDK padding/pointer serialization. |
| 68 Windows native mode/security | U8 subop(0GetSecurityInfo/1SetSecurityInfo/2AccessCheck/3descriptorControl),U32 result,U32 immediateError,U32 requestedInformation,blob actual self-relative descriptor/ACL/SID extent,ref effectiveToken,ref checkedToken; actual AccessCheck appends U32 genericRead/genericWrite/genericExecute/genericAll/U32 desired/U32 granted/U8 accessStatus/blob returned valid PRIVILEGE_SET; token LUID ModifiedIds encoded U32 low/I32 high. |
| 69 Windows process/token/peer | U8 subop(0pipeClient/1pipeServer/2GetProcessTimes/3TokenUser/4TokenStatistics/5QueryImageName/6EnumModules/7ModuleName),U8 result,U32 immediateError,U32 requestedExtent,U32 returnedExtent,ref process,ref originalTokenOrPipe; success birth four U64 FILETIME; TokenUser actual valid SID blob; statistics actual selected LUID/tokenId/authenticationId/type/impersonation fields; image/module original initialized UTF16/HMODULE enumeration scalar correspondence in output view, never pointer authority. |
| 70 Windows directory query | U8 restart,U8 BOOL result,U32 immediateError,U32 requestedExtent,blob full initialized native query body through checked actual last entry; complete FileNameLength/NextEntryOffset/FileId/type fields retained; unknown tail bytes excluded with original geometry refs. |
| 71 Windows process wait/close | U8 subop(0wait/1GetExitCodeProcess/2CloseHandle),U32 returnValue,U32 immediateError,U32 returnedExitCode,ref originalParent,ref originalProcessOrObject; exitCode present only actual successful exit query. |
| 72 Windows mapped page | U8 subop(0VirtualQueryEx/1ReadProcessMemory/2QueryWorkingSetEx),U64 result,U32 immediateError,U64 requestedAddress,U32 requestedExtent,U64 returnedExtent,ref originalProcess,ref originalMapping; success query explicit U64 base/allocationBase/regionSize,U32 allocationProtect/state/protect/type; working set U64 raw flags with SDK source/ABI ref. Read bytes use original nonsecret output view. |
| 73 Windows clock | U8 subop(0QPF/1QPC/2currentProcess/3currentThread),U8 result,U32 immediateError,I64 counterOrFrequency,U64 processId,U64 threadId,ref originalSamplingThread. |
| 128 Source ledger association | U8 existingLedgerOperationOrdinal,U64 generation,ref originalBefore,ref originalAfter,ref exactNativeAttemptSequence; no synthetic successful syscall body. A row requires complete actual write/read/flush/selector/EOF conjunction. |
Projection presence is0 for auxiliary native results that do not meet an existing primitive kind/API combination. A successful open alone cannot invent a read byte observation: linux.openat_read/win32.nt_open_read may project only a complete original open-plus-actual-read association with genuine observed view. Clock/mapped-page/security auxiliaries bind existing original identity/read records through real association refs; they do not introduce public primitive names. Primitive sourceImageSha256 names the original performer source, while independent observer source is retained separately. The archive stores every raw attempt, including auxiliaries without projected rows.
Association table is U32 entryCount followed by sorted unique entries U8 kind(0object/1peer/2source/3clock/4allocation/5IO/6borrower/7archive/8generation),B32 associationId,U32 originalBodyLength/originalBody. Bodies are complete original native carriers or source/ROOT members under authenticated CE1 custody; every referenced ID must resolve an original admitted held entry, and byte equality never creates authority. No arbitrary historical entry cap: count/length derives from actual original finite reservation and existing raw/capsule/parser bounds; duplicate/unresolved/foreign/trailing entries reject before positive use. Each body must have its own source-owned codec selected in the whole source packet, not a generic JSON authority body.
Archive control uses a held already-admitted original private observer directory and exclusive newly created native objects; no request pathname or new storage grant. Append a complete attempt only after precharging its actual raw/control extent. Retain original input/output borrowers while writing exact bytes, flushing, same-handle rereading to true native EOF, native identity before/after and containing-directory durability. Original archive sequence/generation binds source/run/attempt/actor/native identity and all predecessor associations. Publication cannot hash its future final proof or own containing source commit. Sealed generation n is immutable source-owned original association; later terminal/client-parent records are generation n+1 with explicit predecessor, not inserted into n. Full final proof manifest binds both original generations and actual provider artifact ZIP/raw consumed proof equality.
Immutable here means no mutating source-owned handle/control route remains after seal, plus actual source-selected independently qualified native custody. File ACL/hash/read-only name is not owner-immutable authority. If original native rights permit replacement or the independent archive realm is unavailable, archive readback is a real observation but the positive immutable-archive conjunction is unavailable. O1 never silently creates an ACL/provider/retention realm.
To preserve full64MiB capacity, stream original captures in bounded charged extents into the existing raw/capsule retention domains. Repeated identical payload extents may reference an earlier held immutable archive blob ONLY after actual complete byte equality against the original current borrower and actual same held blob reread; hash equality alone never deduplicates. Every distinct syscall's raw metadata/outcome/borrower/source/clock extent remains separately recorded. All raw file/archive reservation bytes and capsule retention count under existing167772160 raw /1073741824 capsule caps; parser/stream copies remain134217728 perCore instance. There is no second parser pool, separate uncharged observer cap, truncated history or unbounded global retainedStorageWrites equivalent. Capacity exhaustion retains failures and denies BEFORE an owning effect, rather than discarding original observations after the effect.
The SAME CE1 owner includes actual bootstrap/runtime/stack/lease/parser/copy/capture/IO/source/control/native metadata under the original128MiB native admission clause; original ordinary runtime/image/prebootstrap owner domains must be resolved from exact source and overlap, not a whole-RSS inference or exemption. An archive disk byte is not automatically a resident allocation. Source objects can be streamed but resident V8/ICU/TLS/code pages/stacks/index/control/allocator rounding/pending borrowers require finite actual owners. No8MiB whole Node runtime assumption is introduced. Qualified allocators precharge complete rounded backing/control/native bookkeeping before growth, preserve actual owners on failure, and retire only after ended IO plus last actual borrower. Budget currently tracks counts and Bytes vectors; it is not physical arena proof.
Positive receipt constructor and complete effect joins
NativeOriginalReceipt has a private constructor callable ONLY by NativeOriginalCorrelator after original performer/API/object/source/clock/owner/capture/archive/readback/closure conjunctions. It retains the real NativeOriginalObservationAttempt and NativeOriginalArchiveReadback owners. Accessors expose immutable bounded existing receipt reference/digest/count/phase/generation; they do not grant source approval or a runtime resource. Constructor admission consumes an original one-use attempt/generation association; stale/foreign/replayed receipt cannot mint a new effect. Failure receipts preserve observed versus null/unobserved fields and original retained state.
| Owning source/effect | Required original join before positive result |
|---|---|
| platform identity/openChild/reopen/readAt/writeAt/flush/enumerate/rename/close | Capture every actual native attempt before local result/SDK/buffer retirement; correlate original held parent/object/source/clock. Rename requires pre/post same object and independently observed namespace, not status alone. |
| HeldStorageDirectory/check + publishHeldBytes | Original exclusive creation, each write and partial attempt, flush, complete same-handle readback/realEOF, rename, directory flush, reopen/readback, handles and exact failedAt. Replace may retain old objects; never infer FREE. |
| RESERVE_STAGE/WRITE_STAGE | Durable immutable six-field declaration/reserved generation, actual stage writes/raw equality/flush/full read/finish original EOF, original HTTP EOF and matching rawSHA, then persisted nativeWriteReceiptRef. Original HTTP EOF is not manufactured by native final flag. |
| LOOKUP_STAGE/READ_STAGE/RELEASE_STAGE_READ | Original reopened held object, exact sequential read and true final EOF/SHA, retained NativeStageReadObservation ownership through encoding/worker borrower/archived capture, then real nativeIO/object/borrower closure or truthful retained state. |
| PREFLIGHT/CAPSULE_CHUNK/CAPSULE_SEAL | Same actual admitted catalogue/four originals/full semantic namespace, accepted raw authored bytes, original stage receipt, capsule writes/provider-sign/terminal MAC/full read/EOF/flush; semantic approval is separate from receipt. |
| NativeJournalStore/selector/publishNext | Original lock/census/current selector and slot MAC/full schema/EOF, actual current-slot reauthentication, both generations/scratch peaks/provider single-use signatures/publication/selector commit/reread/release. Capture before locally scoped EOF/results are destroyed. |
| PREACCEPT_INTENT/AUDIT_ENSURE/ACCEPT | Exact17-key fixed-ID payload and canonical cap, two distinct original sign/readback provider transactions, full original Audit chain/index/source/UTC/raw custody and archive receipt; durable ACK/accepted generation joins original capsule/confirmation/key/reservations. Pending A1 index/time choice is not selected by O1. |
| WRITE_INTENT | Genuine target absence under original held roots with complete native namespace observation, durable next generation and original source/capsule/Audit association before any materializer effect. No existence/path precheck suffices. |
| MATERIALIZE/DISCOVER | Original candidate/root/parent/file creation, complete source-owned capsule bytes/mode/security/token proof, each original write/flush/full read/realEOF, full directory inventories, same-volume no-replace rename, final original reopen/mode/full read/census; latest DRIFT mode checks retained. |
| OUTCOME_PENDING/AUDIT_ACK | Exact original result/discovery/evidence plus persisted no-loss fixed-ID/payload outbox, original durable Audit/index readback before acknowledgment/completed projection. |
| RECOVER | Only original verified retained journal/outbox/capsule/evidence; no requested roots, arbitrary scan, fresh effect, newest-slot fallback or uncertain absence retry. Replay exact retained versions before expiry/use. |
| CLOSE/abandoned/finalization | Complete original all handles/buffers/parser/copies/source/control/code/runtime/nativeIO/borrowers/archive generation disposition. Actual native close and original parent exit/EOF where required precede closure; unresolved owners/failed native close retain charge. Finalizers never ACK/FREE. |
READ_ASSETS/OPEN/READ_OPERATION/LOOKUP_PREFLIGHT/RESOLVE_KEY and every ordinary effect remain required, even where current engine has declarations. All constructor/producer/caller/store hooks are part of complete source delivery after architecture selection; this table is not implementation evidence.
Exact existing proof projections and original timing
Primitive rows remain EXACT11 kind/platform/objectIdentityDigest/monotonicTick/operation/outcome/bytesSha256/byteCount/mode/relatedIdentityDigest/sourceImageSha256. Success byte rows require genuinely observed bytes; null pairs for unobserved failure; actual zero read EOF projects count0/SHA(empty). Identity/birth/flush/exit/close byte fields remain null. Mode0644/0755 only actually observed linux.fstat/win32.security_info. Positive canonical uint64 decimal tick, finite byteCount JSON-safe bound and nonzero identity/source digests remain unchanged. ledger.* existing enum is preserved; historical unselected core.* operations are not resurrected.
Audit remains EXACT17 correlationId/action/actorId/clientId/stageId/preflightId/operationId/template/serviceId/admissionFingerprint/candidateRevision/stagedDigest/materializationDigest/inventoryCount/outcome/replayed/errorCode, payload16384/provider16528/16560; native audit-frame.hpp original scalar/null/action/outcome/template/digest/replay equality remains unchanged. Core proof stays exact21 fields; shared CLI exact18; closure exact10 primary/sea/writer/channels/inputs/io/ledger/closeIntent/finalization/launch; launch exact11 requestRef/inputRouteRef/inspectionRouteRef/clientIdentityRef/sourceTupleRef/observerBirthRef/primaryBirthRef/streamBindingRef/prebindRef/resultDeliveryRef/outcome; inspection exact13 runIdentity/readReceipt/catalogIdentity/recordDigest/entryCount/totalBytes/seaRecordRef/primaryForwardRef/serviceForwardRef/facadeReceiveRef/libraryCopiesRef/ownershipRef/outcome. Every reference resolves original full raw bytes/source/run/object associations and complete provider ZIP equality. Library success requires real inspection route, complete BEGIN/chunk/END equality and source-owned repeated copies; initial archive cannot include future result/parent exit. Missing final control archive blocks full proof despite prior public result. Failure nullability/type/reference rules are preserved, never invented private success shape.
D1 original preauth one-use HTTP10s/40s native authority remains original through authorization, queues, source/image authentication, archive/native IO/provider work and closure; companion80/provider64 unchanged. Every original sample/end/frequency/process/thread/domain observation is retained by actual clock producer. O1 borrows the existing original absolute end and cannot produce renewed now+40s, accept JS duration or reuse a consumed token. Partial256-slot clock prototype is not the complete64MiB history/domain producer. Administrative CE2 original time origin/preentry owner is unresolved and cannot borrow a later HTTP token. Genuine failed observations after expiry remain retained; no timeout implies ended IO.
Prospective meaningful regressions and whole review gates
Unexecuted real-native cases must exercise original adapters/callers, not validate author-invented success rows: partial native writes/reads with exact per-attempt errors; zero-size request versus genuine nonzero-request zero EOF; unexpected early EOF; flush failure after write; rename success then directory flush/readback failure; replacement of original related root/object; complete short/extra directory-query body; Windows full FILE_ID128 collision/FI64 fallback rejection and token/ACL drift; Linux close EINTR plus FD reuse without second close; Windows failed CloseHandle retained original; pidfd readiness without child status versus genuine parent naturalzero wait; observer/performer swap; stale/wrong source/clock/run/generation; vanished raw member; coherently resealed fabricated JSON/hash/receipt; archive partial/failed write/flush/EOF/readback; owner replacement of sealed archive; last borrower and liveIO under cancellation; crash before/after every generation/Audit/materializer boundary; true retained failure capacity and full64MiB route without second parser arena.
Selected-runtime cases require actual full source-built Core Node execution: real closed bundle/builtin/snapshot source association, genuine selected startup flags, complete dependencies, loaded-page relocation equality, privately changed static page/COW, unknown executable mapping, non-atomic remote observations, writable alias, changed mappings, unmapping while real runtime/code/observer borrowers remain, and source replacement. The nonselected JIT alternative requires a new whole decision; its tests are not silently added to current Core acceptance. An instrumented ledger fixture alone is surrogate contract coverage, never loaded-page/lifetime/physical ownership proof.
The different entire architecture reviewer must assess the complete private codec/call geometry/authority/source/lifetime/allocator/JIT publication decisions, all owning callsites, actual full selected Node/V8/static-runtime source and complete historical current inputs. It may reject unresolved publication/quiescence/retirement/source-native rights or static-runtime/physical-domain choices; source-only byte custody does not resolve them. After architecture selection, this same whole source owner completes all four headers plus meaningful fixtures and coordinates primary integration. Then a DIFFERENT entire cumulative finished-source review and NEW complete actual execution-input ROOT precede imports/parser/compiler/Node/npm/native/build/tests. Natural exact-head CI, genuine native Windows/Linux/operator/product qualification, protected development publication and identical published-byte Core integration remain independent gates. Original failures/private state are retained; macOS applicability follows current owner governance, never fabricated PASS. No GA, promotion, deployment, retry/settings change or cleanup is authorized by this candidate.