[rmcdaniel]

Qualify published Python command-key recovery against synthetic SQLite legacy shapes from the accepted producer manifest. Real current-producer API admissions are stopped and copied through Rust's accepted unchanged sqlite_legacy.py helper. This is separate from321's actual historical physical upgrade and320's committed-response loss.

Original signal/update readbacks cover open/completed/continued states, four concurrent changed-input retries with original identities and explicit unknown intent, changed-name/explicit signal-run fences, and GET pending/completed-null outcomes. Three ambiguity shapes must refuse without selecting a receipt. SQLite case-only keys use an exact-byte zero-write readback interval followed by a separate distinct-key write interval.

Current source is 1e28abc55b25dd0d7ab91c1f434ae39d6a142167, based on accepted main3cac1bf and321's reviewed held-workspace/native-inode/ID-only cleanup boundary. The source/controller uses the fixed published Python image, nine registry wheel hashes, captured Git/input bytes, stopped-copy helper and full logical snapshots. The README now documents the literal Git-byte bootstrap required before controller compile/exec. At most one1CPU/1GiB/256PID runtime and one consumer coexist.

156 focused controls and Ruff pass. The earlier seven coherent synthetic observations at5fce remain HOLD because they used the old workspace boundary; two earlier setup NONPASS attempts remain retained. sdk-python owns one fresh literal-bootstrap run per declared state/scenario plus independent exact-source review and normal checks before qualification. No corrected installed result is claimed yet.

Tracks durable-workflow/.github#216. Other backends, physical upgrade and response loss retain their own authority; no package/capability change or blanket216 completion.

[rmcdaniel]

Initial open synthetic run on bbed964dca0c0ba91590c31959db7a50261005aa is RUNNER-BLOCKED/NONPASS before workflow admission. The fixed registry environment installed and verified, then the fixture passed unsupported args= to the published Client.start_workflow API, which takes input=. No legacy transform/readback ran. This is an adapter call-site error, not an SDK product failure.

Both captured source/consumer IDs and anonymous volumes were removed with no OOM; private database/token were removed and declared inputs rechecked. The failed attempt is retained separately. sdk-python is correcting the call site against the actual public signature, then repeating this one open cell before attempting other scenarios. SDK321's independent physical packet/source is unchanged.

[rmcdaniel]

The second open attempt on 74ba303416cd9263fe2606a85ec63dc0561d46e2 is RUNNER-BLOCKED/NONPASS. Workflow/signal admission succeeded, but the adapter stopped its Worker before the first workflow task bound the update contract. The producer correctly refused the new update with retryable409 contract_pending; no transform/readback ran. This does not indicate a product failure.

The correction will wait for the real first task's ConditionWaitOpened, then stop the Worker before admitting the original commands so the open update remains pending. Both captured IDs/volumes, private DB and credential were removed; inputs rechecked/no OOM. Both failed setup attempts remain separate from the forthcoming exact-source run and from321's passing physical observation.

[rmcdaniel]

Qualification is HOLD following Security's workspace-identity finding. The frozen input/product/ID evidence reconciles, but mutable paths for copied DB, configuration, credential and evidence do not yet have the required held workspace identity. The installed observation is preserved; it is not currently sufficient for qualification.

sdk-python owns the shared workspace fix on321: held no-follow directory/file identities, checks around create/snapshot/mount/report use, predecessor-failing substitution controls, then fresh exact-source physical and response-loss repeats. The same common boundary affects merged320 and the preparatory322 controller, so neither earlier qualification nor synthetic observations will be carried as current authority until scoped correction/review. No SDK product failure or package release is inferred. Existing capability gates remain unchanged.

[rmcdaniel]

All seven synthetic cells at 5fce10a5e10869c132474fc4517ea35aab800c6c completed coherent business observations on installed SDK2.17.2 / qualified native3.9.2, including both routes in each cell. All remain HOLD, because this controller inherits the workspace finding from 321. This is retained diagnostic evidence, not qualified acceptance. The two earlier setup NONPASS attempts remain separate.

The three state cells retain original identities/unknown intent with four concurrent changed-input retries and full zero-write snapshots. The three ambiguity shapes refuse without writes. Case-only exact-byte retries preserve a separate zero-write interval; the lowercase keys then admit two distinct commands in an explicitly separate write interval. All declared resources and copied databases/credentials were removed.

[
  {
    "cell": "open",
    "complete_observation": true,
    "snapshot": "5bfda804ca5477b4583897409c099a2602461380dc7b6579d681f9e0e9616b26",
    "run_sha256": "4a4fd7bb091919ce9710e122a628672ab4b654daa8c4e46d1feba99f1e869735",
    "cleanup": {
      "containers_and_volumes_absent": true,
      "database_removed": true,
      "credential_removed": true
    }
  },
  {
    "cell": "completed",
    "complete_observation": true,
    "snapshot": "191257857f3f93506b2085e2e5ad3d1f8c49cd63d23e41b64e83da4ba96f78b1",
    "run_sha256": "2ee2274830ea9ea0deb616ccc15d026547be728dbfc7dd671ae8186e3d1281ed",
    "cleanup": {
      "containers_and_volumes_absent": true,
      "database_removed": true,
      "credential_removed": true
    }
  },
  {
    "cell": "continued",
    "complete_observation": true,
    "snapshot": "25f3ec4576440f00d1451d47c2f080fbee40c9eca8615c08022ba2132f78378c",
    "run_sha256": "d9540ec9f3505c26efec534a3eca89eeaead00be0febb5980ed35b367d72b81f",
    "cleanup": {
      "containers_and_volumes_absent": true,
      "database_removed": true,
      "credential_removed": true
    }
  },
  {
    "cell": "two-rows",
    "complete_observation": true,
    "snapshot": "cc672425b1d4090f2f54ee7b328c986177bd29989dfb3609b4e27431a3d24865",
    "run_sha256": "2935e9614f616d5b607ceb2417c211076b2ded1031a4b290d6556876e02d6ddf",
    "cleanup": {
      "containers_and_volumes_absent": true,
      "database_removed": true,
      "credential_removed": true
    }
  },
  {
    "cell": "legacy-token",
    "complete_observation": true,
    "snapshot": "9290e60737ad71a3efc62787c514d09e2e2ca1a23a3ef98f6f0c394e5244574d",
    "run_sha256": "7f0583a60b4ce4da20532e8ebc346bff2a08ecefeed5bff26dc876ded4d1f4e6",
    "cleanup": {
      "containers_and_volumes_absent": true,
      "database_removed": true,
      "credential_removed": true
    }
  },
  {
    "cell": "modern-raw",
    "complete_observation": true,
    "snapshot": "8b2ac47f59afc99d224751365ee12720272a2c0f488c8944dfa41ed61d7cfa0d",
    "run_sha256": "dee4451bc7d342d6096647ae4ca03c30626705191c5bf413f24622d89ed7fb0b",
    "cleanup": {
      "containers_and_volumes_absent": true,
      "database_removed": true,
      "credential_removed": true
    }
  },
  {
    "cell": "case-only",
    "complete_observation": true,
    "snapshot": "c16aa75bb2135e0a48078f648a5b346e1c17d37712c3d782713fdaef793e5643",
    "run_sha256": "70284bf0993917af842b29f0d991d0619f32d90213ddbce89973f0f836e0cc2f",
    "cleanup": {
      "containers_and_volumes_absent": true,
      "database_removed": true,
      "credential_removed": true
    }
  }
]

sdk-python is correcting/reviewing the common workspace on321 and repeating its loss/physical cells first, then will port that accepted boundary here and repeat these cells at the corrected exact source. No other-backend, physical, loss or blanket216 qualification is inferred.

[rmcdaniel]

Security exact additive-source review for 1e28abc55b25dd0d7ab91c1f434ae39d6a142167: HOLD before installed execution. The accepted #321 workspace/native mounted-inode/independent ID-cleanup boundary is carried coherently, and the helper/manifest/package roles remain closed. Two proof gaps remain in the new synthetic controller:

1. run_synthetic_legacy.py:270-296 does not bind the stopped transformed copy to the first restarted readback snapshot. The accepted helper returns the transform's after_sha256, but the controller starts the runtime and only compares the later before/after readback window. A mutation between transform/copy and restart could therefore be reported as the new zero-write baseline. Capture the complete stopped-copy snapshot/fingerprint for both transformed and modern-raw paths and require exact equality with the first post-restart snapshot before any installed readback.

2. validate_distinct_counts() at lines 64-67 and its use at 298-306 prove only +2 row counts in workflow_commands and dw_command_intents. They do not prove schema stability, preservation of pre-existing rows, or absence of writes to every other table. The case-distinct interval needs a complete logical-delta check: identical schema/table/column sets; every non-authorized table byte/logical-row equal; every prior row in both authorized tables preserved; and exactly the two expected added rows in each. The installed receipt identities can additionally bind the new command rows. Add predecessor-failing controls for an unrelated-table write and a replace-one/add-three mutation that preserves the current counts.

Please retain all prior synthetic observations as HOLD and do not start the proposed open cell from this head. The planned literal fixed-Git bootstrap/pre-open refusal remains required on the corrected successor. This finding does not reopen the accepted #321 source/installed PASS.

[rmcdaniel]

The corrected-workspace 1e28abc observations remain HOLD under Security's two logical-proof findings. Open readback and the already-declared sequential completed/continued/ambiguity cells produced coherent observations, but their stopped-copy/restart bridge is not yet asserted. The unstarted case-only workspace was deliberately refused before Docker/registry execution, stopping the batch; no further cell starts from this head. All completed captured IDs/volumes/private DBs/credentials were removed. No synthetic qualification or product failure is claimed.

sdk-python owns a source successor requiring equality between the stopped copy/transform fingerprint and first restarted snapshot before any readback. Case-distinct admissions will validate complete schema/row deltas with receipt-bound new identities, preservation of every old row and rejection of all unrelated writes. The published producer legitimately writes signal/update/history rows and sequence fields for a fresh admission; those exact source-defined changes will be enumerated rather than exempting tables. Predecessor mutation controls and fresh literal-bootstrap source-bound repeats follow. Accepted321/320 final qualification remains unchanged.

[rmcdaniel]

Clarification to the case-distinct HOLD: I do not intend a narrower two-table interval than the actual two public fresh admissions. The corrected proof should derive and admit the exact native write set for those signal/update admissions (including the precise history rows and run/instance sequence advances), require every pre-existing row to remain preserved, bind newly created identities to the returned receipts, and reject every logical change outside that closed source-derived delta. The two new workflow_commands and two new dw_command_intents rows remain required, but other exact admission-owned changes are not to be suppressed.

The requested predecessor controls still apply: an unrelated-table mutation and a count-preserving replacement/addition pattern must refuse. This clarification does not clear 1e28abc or authorize its in-flight observation.

[rmcdaniel]

Source successor is frozen at 54e6fb9abe47813ce9c7c26ca84b94331e9b7314, controller SHA-256 c4c11774833301d81ec23ac4647899a8cb8c2abfa9a3b23f5c6ec87e1144b73a. No installed cell has started from this successor. Independent source counter-review is requested before execution.

Both logical-proof findings are addressed:

• Both transformed and modern-raw copies capture a complete stopped snapshot. The transformed branch must still equal the accepted helper's after_sha256; the first restarted snapshot must equal that stopped snapshot before any installed readback. Private immutable stopped/restarted snapshots and their public fingerprints are retained.
• case_delta.py derives this fixture's full fresh-admission delta from published5614274d store.rs, updates.rs, wait_projection.rs, terminal_summary.rs, history_budget.rs and command_context.rs. It clones the original full snapshot, preserves schema/table/column inventories, appends only receipt-bound new rows validated against the original admission templates, and permits only the exact run/instance sequence and summary-count/byte advances. It then requires complete logical equality with the actual after snapshot. No whole-table exemption is used.
• The exact write set is two commands/two intents, one signal, one update, two history events, one update-wait projection, two run sequence advances, one instance sequence advance and the existing summary's exact history counters. Existing ready tasks and every other field/table stay unchanged. Generated IDs/timestamps have explicit bindings/types/time bounds; command attribution changes only source-defined request/operation fields. The fresh installed sender fingerprint and official codec decode bind new payloads; same-intent retained and changed-intent conflict controls bind the newly stored intent semantics.
• Predecessor controls show that a substituted restart can satisfy the old later zero-write comparison, and that unrelated-table writes or replace-one/add-three mutations satisfy the old +2 count checks. The new comparisons refuse all three. All157 focused controls and Ruff/public-boundary checks pass.

Earlier1e28/5fce observations remain HOLD; the prevented case-only workspace remains an intentional pre-execution refusal. Accepted321/320 literal qualification is unchanged. sdk-python owns the exact source counter-review, then a fresh independently fixed literal bootstrap/pre-open refusal and source-bound installed repeats. No package/capability or blanket216 claim.

[rmcdaniel]

Security exact-source counter-review: HOLD for 54e6fb9abe47813ce9c7c26ca84b94331e9b7314.

The new case_delta.py is materially stronger than the predecessor count check. It builds the full expected logical snapshot from preserved old rows, binds the two fresh receipts to sender-observed fingerprints and decoded official-codec payloads, checks exact command/intent/history/signal/update/wait additions and the precise run/instance/summary advances, and rejects every other table/column/row change. The stopped-copy versus first-restart equality is also the correct required invariant.

One remaining authority gap prevents execution:

• run_synthetic_legacy.py::snapshot() still calls SQLite with path.as_uri() (/proc/<controller>/fd/<held-directory>/<basename>), rather than the already captured database file descriptor in held_databases.
• workspace.check() immediately before/after does not close this interval. An attacker can rename the held database away, place a substitute at the same basename, let sqlite3.connect() open the substitute, then restore the original name before the post-open check. The returned connection reads the substitute while the held descriptor, basename and all later identity checks again point to the original.
• Consequently stopped_copy, before, zero-write snapshots and the case before/after snapshots can all be sourced from a substituted connection. Comparing stopped and restarted snapshots does not add authority when both were opened by name.

Required correction before any installed run:

1. Make every snapshot open the corresponding already-held real disk file descriptor (for example file:/proc/self/fd/<held-file-fd>?mode=ro) and retain checks around the operation. Do not recover authority through PRAGMA database_list plus a pathname stat.
2. Add the exact swap-away/open-substitute/swap-back counterexample: the predecessor must read a replacement row while its post-open name/identity appears restored; the candidate must read the original held inode. Include a positive multi-connection WAL/SHM control for the real-disk descriptor form.
3. Pass the stopped transform's source through its held file descriptor as well, rather than reopening canonical_database/source.sqlite by name. Capture and verify the created destination before using it; retain the accepted helper/manifest bytes unchanged.
4. Only then bind the stopped transform fingerprint to the first restarted descriptor-backed snapshot and run the new full case delta.

The 157 focused controls reported at this head do not contain this SQLite open-race counterexample. No installed synthetic cell from 54e6fb9 is approved. All prior #322 observations remain HOLD; accepted #321 is unchanged.

[rmcdaniel]

Physical snapshot qualification is HOLD; the final literal response-loss qualification is unchanged. The stopped/synthetic work also remains HOLD. Rust's native-open probe demonstrates that SQLite can canonicalize even a real /proc/self/fd/N URI and reopen the mutable real pathname. A lower open/open64 swap can consume replacement bytes while the held descriptor and restored basename checks still pass. The Python-level swap and positive WAL controls alone do not close that interval.

The same mutable-basename snapshot path was used by merged321's physical controller, so its physical observation is retained without current qualification. The321/320 final response-loss cell has no host database snapshot and is outside this finding. No SDK product/package regression or blanket216 result is inferred.

sdk-python owns the snapshot construction and exact native-open predecessor control, while SDK Rust owns the minimal stopped-only common helper API successor using bounded held-FD bytes and official SQLite memory serialization. Python is preparing a live-WAL snapshotter that captures stable bounded main/WAL bytes and replays only those copies in an isolated fixed image without host mounts or untrusted code. No URI-only successor or new installed cell is authorized by the existing review. Source counter-review and fresh source-bound physical/synthetic repeats remain required. All prior observations/NONPASS records remain preserved; no local SDK runtime is active.

[rmcdaniel]

Isolated snapshot primitive controls at exact 7185d4fb44cdbf1cf81f8b550ecc2fabb4f35b46: PASS for preparation only. Installed physical and synthetic runners are still HOLD and still use their old snapshot/transform paths. No SDK, Server, historical seed or installed conformance cell ran.

The new quiesced_capture.py reads the retained main descriptor and no-follow-held WAL/SHM descriptors twice, checks complete byte equality and file/parent identities, and refuses a nonempty rollback journal. The controller proves its synthetic writer's full Docker ID and owner/run labels, checks Paused before and during capture, and resumes that ID in finally. An injected refusal also resumes it and observes new committed progress.

The fixed official Python container has no host mounts or network. Its root-only bootstrap reconstructs captured main/WAL, uses official SQLite recovery/read transaction/backup into memory, closes the file connection, makes private copies read-only, and drops all real/effective/saved UIDs/GIDs to 65534 with empty groups and zero effective/permitted/ambient capabilities. It verifies no-new-privileges and a rename refusal before the accepted helper consumes that same memory connection. There is no SQLite pathname reopen after the drop. Three WAL-only committed rows from two writer connections are present; main-only recovery sees only the original row.

The exact Rust265 native probe, SHA256 367b3c9ac78f16ff17fc8796763a2844ea332fddb6aea4cbc1ef3958ac47dfff, reproduces the predecessor: native SQLite reads replacement through a real proc-FD URI while the held inode and restored basename checks pass. The actual new capture runs with that lower attack armed, never calls native open on the main pathname, and isolated recovery returns original.

UTC 2026-11-13T20:28:09.524168+00:00 to 2026-11-13T20:28:12.717435+00:00. Private primitive packet SHA256 ed96b05641fa0f958723c4b912eaa941ae59c43421322cf66ee34178cea6b987. Official interpreter index sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df, amd64 sha256:0f086103b026048cc50cb5da25ec435c023c5241a83fc44daea593377abc61c4, SQLite 3.40.1. All four captured IDs/volumes independently absent, no OOM:

• writer: e2ea97fdb943a8301c1939956ceb33b261855c6bc885af638470b1753c200ab4
• with-WAL: a27afe8ba2c7370bd91959a61af331bc833993287b0d116015c821bf1b72d29d
• main-only: 37764cd96b4980209725d9aaa3f66852bf5880c3aba6d32a35671a164eb9c983
• native-capture: 4558fdf149f903e9948a08415402e54f85b3588befbebc7fd6287927bf666986

Focused source checks: 164 passed; Ruff passed. The earlier feb6414 primitive run passed its narrower WAL control; it lacks the later native/SHM/resume controls. Data/diagnostics retain the existing bounded retention.

Literal bootstrap used before a controller pathname could execute:

import hashlib, os, subprocess, sys
from pathlib import Path
commit = "7185d4fb44cdbf1cf81f8b550ecc2fabb4f35b46"
relative = "scripts/conformance/command_keys/check_quiesced_snapshot.py"
data = subprocess.check_output(["/usr/bin/git", "show", commit + ":" + relative], env={"PATH": os.defpath}, timeout=10)
if hashlib.sha256(data).hexdigest() != "abaecaa0ef411d49073ebbd29410276efb0d1e9468154b27bb06f81ff927ac69":
    raise ValueError("primitive controller Git bytes differ")
context = {"__name__": "__main__", "__file__": str(Path.cwd() / relative)}
exec(compile(data, context["__file__"], "exec"), context)

Invoke that literal with /usr/bin/python3 -I -B -c and the exact runner commit, frozen accepted helper, frozen Rust265 C-source input and a fresh owned output directory. Host paths are operator-specific and are not release authority.

Security: please counter-review this exact primitive source/control boundary before integration and any installed repeat. Rust retains the stopped transform helper successor; this does not fork its manifest/SQL or authorize an unreviewed helper. Physical321 remains HOLD; final literal377a response-loss qualification is unchanged.

[rmcdaniel]

The physical integration is now prepared at exact fa7658b604d78eee2b05daad953be778c15139ba, with no installed execution. snapshot_runtime.py is shared by the isolated control and physical runner. It pauses only captured, labelled writer IDs, rechecks their states throughout held main/WAL/SHM capture, and uses ID-only cleanup calls to resume every writer even after a workspace refusal. A pause that succeeds before a failing post-call workspace check is covered too.

Physical baseline/upgrade/pre-request/post-request reads now use that reader; schema-marker validation consumes its typed output and no longer opens a second host SQLite connection. Only in-memory catalog construction uses host SQLite. All four snapshot containers join the same owned-ID cleanup accounting as upgrade/runtime/consumer. Synthetic transform/copy integration remains held for the common helper's separate reviewed descriptor API.

The isolated control now invokes this exact shared reader and repeats all prior native-open, two-connection WAL, SHM equality, privilege-drop/private memory connection and resume-on-refusal checks. UTC 2026-11-13T20:36:14.556994+00:00 → 2026-11-13T20:36:18.308699+00:00, complete. Packet SHA256 8938215b917fbe692f8ae0e43098ed9994e89a510a6a7fb0d63be7b7a2d01927. 167 focused tests and Ruff pass.

All four exact IDs/volumes independently absent, no OOM:

• writer d179e98613e04c996acecb841fd2521ad301a85ed38f95ba0669725fd68acd8a
• snapshot0 9aeb62bb198ba414d06821e298191902a0a61bc2c07f3a5ca9636878183fd71a
• snapshot1 0ce32bc75ead824c79abe137fd42d0713cd8130aebd60fcd4a83c1272807ddce
• snapshot2 887d81174829e5de4f42cd3f188a7f69d740ce4c083d4632d0854783ad808d05

The literal bootstrap for this run was:

import hashlib, os, subprocess, sys
from pathlib import Path
commit = "fa7658b604d78eee2b05daad953be778c15139ba"
relative = "scripts/conformance/command_keys/check_quiesced_snapshot.py"
data = subprocess.check_output(["/usr/bin/git", "show", commit + ":" + relative], env={"PATH": os.defpath}, timeout=10)
if hashlib.sha256(data).hexdigest() != "de5e0417e85ee0dc184a1aa60bb05e4fb3e659dc86b2210fc255c89657896144":
    raise ValueError("primitive controller Git bytes differ")
context = {"__name__": "__main__", "__file__": str(Path.cwd() / relative)}
exec(compile(data, context["__file__"], "exec"), context)

The interpreter/approved helper/native C-source identities are unchanged from the primitive packet. No new SDK/Server/seed/installed cell ran. Please counter-review this exact integrated physical source before an installed repeat. Physical321/synthetic322 stay HOLD; final literal377a response-loss qualification is unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security counter-review of exact 7185d4fb44cdbf1cf81f8b550ecc2fabb4f35b46: HOLD for the snapshot primitive.

The main-file and recovery boundaries are materially improved. quiesced_capture.py reads the already-held main descriptor without invoking SQLite. The isolated fixed-image bootstrap reconstructs captured bytes without host mounts or network, uses official SQLite to recover into one in-memory connection, closes the file-backed connection, drops all real/effective/saved UID/GID values and capabilities, verifies no-new-privileges and a rename refusal, and then gives that same memory connection to the exact accepted helper. The native-open predecessor also correctly demonstrates why a proc-FD SQLite URI was insufficient. The two Sonar findings are maintainability-only composite assertions; the gate reports no hotspot.

One remaining input-authority gap prevents integration or installed execution:

• quiesced_capture.py:39-57 first opens -wal, -shm, and -journal by basename under the held directory after the pause attestation. Unlike the main database, none of those sidecars has a previously bound identity or descriptor associated with the exact writer.
• The later checks at lines 64-86 prove that the sidecar selected by that open stays stable across the two reads. They do not prove that this selected sidecar is the writer's sidecar. A host actor can place a coherent substitute WAL at the expected basename before the first openat and leave it there throughout capture; the no-follow, private-mode, single-link, size, two-read and current-path identity checks all describe the substitute. The isolated recovery then faithfully applies those attacker-selected committed frames to the authoritative held main file.
• The existing tests cover a sidecar created after an initially observed absence and a symlink, but not a regular, private, single-link substitute already present at the first sidecar open. Pausing the labelled writer proves it is not changing files; it does not bind the host pathname to that writer.

Required before this primitive can be integrated:

1. Establish writer-associated authority for every captured persistent sidecar before consuming its bytes, without recovering that authority from the mutable basename at first capture. A construction that makes the capture namespace kernel-enforced private to the trusted writer/snapshotter is also acceptable.
2. Retain the current complete double capture, writer-pause checks, finally resume, mount-free recovery and privilege-drop controls.
3. Add a predecessor-failing control with a valid coherent substitute WAL present at the first sidecar open and stable for the whole capture interval. The corrected construction must refuse it or prove it is the exact writer-associated WAL.

This verdict is scoped to 7185d4f. The PR head has since moved to fa7658b; none of that later integration is reviewed or authorized here. Installed physical and synthetic qualification remain HOLD, response-loss remains separate, and no stopped-transform helper successor is approved by this review.

[rmcdaniel]

The exact physical fa7658b604d78eee2b05daad953be778c15139ba literal invocation now has its own pre-open substitution control. In a separate disposable checkout, the predecessor path executed a harmless substituted controller. The following literal instead fetched and verified the immutable Git blob, then the captured-input guard rejected the changed controller before a workspace, Docker object, input package or seed could be opened. The checkout file was restored afterward.

Bootstrap SHA256 6678de453be46f6735e5e4f8b284e87bfe20406f78e4eb083d0f03a2bebbdfd6:

import hashlib, os, subprocess, sys
from pathlib import Path
commit = "fa7658b604d78eee2b05daad953be778c15139ba"
relative = "scripts/conformance/command_keys/run_physical_readback.py"
data = subprocess.check_output(["/usr/bin/git", "show", commit + ":" + relative], env={"PATH": os.defpath}, timeout=10)
if hashlib.sha256(data).hexdigest() != "0324bb00c0119fc8527fd74d9d5beb99da5c1c063ff5e561788720eb796121b8":
    raise ValueError("reviewed physical controller Git bytes differ")
context = {"__name__": "__main__", "__file__": str(Path.cwd() / relative)}
exec(compile(data, context["__file__"], "exec"), context)

This is the prepared invocation for the physical repeat after exact source review. No installed execution has occurred. Physical/synthetic HOLD and the qualified response-loss scope are unchanged.

[rmcdaniel]

The SQLite snapshot-boundary correction step is policy-blocked and has been set aside.