Source-admission ADR: held materialization and dedicated no-loss journal v1
Selected durable decision for #1633, pending independent entire review/develop landing. The normative reference completes SPEC002 AC-4CF.1 and SPEC006 AC-6E, CA01..CA08. Use a dedicated versioned source-only journal/capsule/outbox, explicitly authorized native initial storage creation and real persistent provider/key identity. Atomic accepted generation consumes confirmation and binds key-HMAC/operation/full capsule before target writes. Required premutation Audit is durably verified first; fixed-ID exact-payload pending accepted/outcome/reconciliation events survive crash, are idempotently flush/readback verified, then acknowledged in later generations. Current appendFile/raw confirmation/released-registration storage is only an adaptation substrate, not durable evidence.
Retain trusted middleware/workspace authority and native held exclusive same-volume materialization/full75 readback. Version exact catalog path eligibility SLTP-CATALOG-PATH-1 without changing SLTP-ZIP-1 framing/header/methods/CRC/transport modes/digest grammar. Dot/case/@ are exact catalog paths only. Use actual six-field owner provenance; all locked source/workflow bytes remain immutable. Preserve existing nested HTTP projections and actor-expiry/replay precedence, safe before-response503 versus after202 durable unknown, finite retained-resource admission and no destructive recovery.
The complete CLI native READ/PLAN v3 contract lives in CLI ADR-002/#37; fixed two-role prospective register paths coordinate Core PR1631 and CLI PR36. No third consumer, new publication asset, privileged broker, generic shared event platform or fixture key/catalog grant. Host flush/atomic replacement/cross-process locking/materializer capability and immutable tuple/provider authority remain unproved; endpoints fail closed until real capabilities and original released Windows/Linux direct journey are qualified. Historical NO-GO and failed evidence are retained; agent-added no-atime/all-physical-descendants/arbitrary-kernel completion promises are explicitly retired, logical deadlines retain actual IO until completion. Rollback retains all state and denies incompatible versions; migration/archival needs a separately reviewed no-loss authorization. This decision is documentation, not implementation/runtime/GA acceptance.
Current integration authority (2026-10-04)
Core PR1631 and CLI PR36 are landed dependencies, integrated through current develop Core33e19ea24aaaff62e5dbfbb8d57001576fb2fb16 and CLIcf95d4577b5d9e4bb37c02807e738b512dec8be9. The landed four-repository errata/register takes precedence over historical CLI inner-ZIP blocker wording: CLI protected/portable authoring uses native TAR; Core #1534 staged-service and outer-release Windows ZIP remains required. Original TUI five actions and same published tool bytes in Core/npm remain required. Historical pending/review text above records earlier checkpoints, not current ownership or a reopened dependency.
Complete inventory means every file in the independently admitted owner tuple, with its exact path, mode, bytes or explicitly typed difference, policy self-member and generated provenance. Template PR25 owns the new prospective source tuple (reviewed source d3f9c86fc55f3bb4a31f0d127c2b3d5bad291885; 83 inventory members plus policy =84 source files) and its publication/source binding; generated provenance is derived separately. This contract grants it no admission and never makes84 a permanent inventory count. Historical 73+policy+provenance=75 tables and their size/quota arithmetic are informational bindings to the old frozen tuple only, never a 75-file cap or a grant for a newer tuple. All normative full75/all75/expected75 references above mean the complete inventory of the separately admitted tuple; no current or future file may be truncated to fit that historical example. Current owner quotas must be independently validated and all retained-copy/frame/parser/native limits met before enablement; an incompatible newer tuple fails closed pending an explicit reviewed limit amendment, never silently drops members or inherits old hashes/quotas. Native v3 HMAC/one-use session, full held readback, TC01..TC12/CA01..CA08, upload/stage/preflight/confirm/commit/poll and journal/key/fixed-ID exact-payload durable Audit no-loss outbox remain complete and unchanged. Missing immutable publication, catalog/provider/native capabilities and direct Windows/Linux released journey remain unmet.
This integration is source-only documentation. Different fresh ENTIRE final-source review is required for both complete integrated contracts before governed landing. Product source authorship, imports/parsers/build/npm/tests/native execution, new API decisions, publication and deployment are outside this integration unit.