[rmcdaniel]

VM setup can legitimately take more than 30 seconds, but the #210 proposal reused the host start time for a guest launcher that required a fresh start. A fresh full guest envelope instead extended the guest deadlines past the fixed parent deadlines.

For #191 and #192, use a fresh guest start G and the unchanged parent ceilings: guest_active = min(G+1740, mapped_parent_active-180) and guest_cleanup = guest_active+60. Require at least 600 active work seconds before setup allocation, VM create/start and guest work allocation. The resident guardian records paired host/guest boot, Unix and monotonic observations; command budgets and recovery use fixed monotonic cutoffs. Recovery, summary and independent guest/host audit all bind the same clock receipt. The guardian retains the produced digest in memory, refuses a changed receipt at finish, and carries the digest through cleanup into independent host audit; recomputed export hashes cannot replace the clock observation. Setup delays, UTC changes and later record reopening cannot renew the parent lease.

The outer source selects task R 86f65e1ca1b01baaa68f8d7256a7699dfda5f828, 13-member manifest 2b0cfb21bd1a051bf8222879a304dadb87e93a4873693eb6e6978671313ca715, and guardian SHA-256 006f6e0e9f7379a4593b2a73f4e77ff271da24b308ce497e3ca0aa54b210e603. The original df617fb/bdbb4d4 private packet remains frozen; this successor needs a separate source/input subject. The actual blocked review has not been retried, rerouted or claimed passed. This is General's selected ordinary source correction, not a lifecycle/native/guest/consumer/publication admission, and neither issue's installed criterion is closed.

Validation: 99 inert inner controls and 47 fake-native outer controls pass. Countercontrols exercise the actual predecessor's refusal after allowed 60-second setup and its acceptance of a fresh envelope beyond the parent, late setup/input inspection, fixed deadlines under UTC rollback and unequal clocks, bounded paired observations, and rebound-clock summary/audit refusals. Python parse, diff whitespace, public boundary and changed-file secret/private-path checks pass. No Docker, Cargo, VM or lifecycle operation ran locally. Normal hosted source CI follows this PR; no manual dispatch is requested. Changes stay under scripts/acceptance/, outside automatic docs publication paths; release is manual-only.

Refs #191, #192; follows #210 and the concrete clock/input gap. sdk-rust owns the source correction and normal green integration; specific policy-access, current-owner, fresh capability/capacity and effect gates remain with their existing owners.

[rmcdaniel]

Final source reconciliation found a concrete receipt-binding defect in the first clock draft: editing only the paired sample and recomputing summary/audit/export hashes could still pass its finish and host-audit checks. An inert control runs that actual cc359c0 predecessor and demonstrates both admissions.

Head a689a2f now selects inner R 86f65e1ca1b01baaa68f8d7256a7699dfda5f828, 13-member manifest 2b0cfb21bd1a051bf8222879a304dadb87e93a4873693eb6e6978671313ca715, guardian SHA-256 006f6e0e9f7379a4593b2a73f4e77ff271da24b308ce497e3ca0aa54b210e603. The resident guardian retains its produced clock digest in memory, checks it before accepting finish, and carries it in its cleanup receipt for independent host audit. The same altered-sample/recomputed-export case refuses at both stages. The previously returned Sonar exception-test finding was corrected without suppression.

All 99 inner +47 outer local controls pass. Fresh normal CI is running on this exact head; the preceding head's green results do not substitute for it. The old private packet and specific review refusal remain unchanged, and no operating action or review reroute has occurred. sdk-rust owns the current source/CI and the separately bound unexecuted next-input packet.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Ordinary source merge is complete: actual main 81e8ee7daa26fe20dddd555bee518a2a3599e546, exact tree 843a90d11dc1882fa135ad1c080d2b27c2dbc5ff, ordered parents [eb498a1, a689a2f], independently read back. Final PR qualification had 17 successful checks/two intended Server skips, 99 inner/47 outer controls, 715 unit +53 corpus tests on both Rust 1.86 and stable, and zero unresolved Sonar findings. No Security review PASS is attributed.

The original main run is NONPASSING, not silently retried: its condition-history job timed out the optimization guard's Python child after five seconds, before the expected diagnostic. It did not report a clock assertion failure. sdk-rust owns the narrow one-test correction in #215: isolated explicit optimized startup, a synthetic ambient-startup countercontrol and a bounded 20-second inert test-child timeout. All selected runtime bytes, R/M, outer/private source and real parent/guest deadlines stay unchanged. Remaining original main jobs continue to terminal results; no rerun/cancel was requested.

The merged #214 branch is removed locally/remotely; remote absence was verified with ls-remote --exit-code returning 2. Worktrees, predecessor branches and source history are preserved. No local Docker/VM/storage/consumer object was created. This change triggered ordinary source CI/Boundary/Sonar/CodeQL only; the latest protected docs run remains 41959739724 at 46cf3651, and no release workflow followed. The separate unexecuted successor packet is prepared; final source/main acceptance and its handoff will follow #215's normal qualification. #191/#192 and all specific operating/policy gates remain open.

[rmcdaniel]

The CI-control follow-up #215 is now normally integrated and actual main 933f5a2 is terminal green: 16 successful checks/two intended skips, 99 inner/47 outer controls and 715 unit/53 corpus on both Rust versions. The original #214 main NONPASS is retained unchanged. The selected 13 runtime members and real clock ceilings did not change in #215. Both merged branches are removed and no docs/release/runtime effect followed. The complete terminal receipt, sealed successor input identity and concrete remaining owners/gates are recorded on #215; #191/#192 remain open for their installed criteria.