[rmcdaniel]

Command-key acceptance still needs fail-closed ambiguity/case controls and real committed-response loss through the installed Rust SDK. Add separately labeled cells to the accepted bounded runner, building on the state extension in #261. The repository runs normal PR checks only against main, so this draft targets main and includes those unchanged state-extension bytes. No SDK/runtime/package behavior changes.

The three accepted ambiguity shapes validate409 markers, exact retry key and absence of any selected receipt across concurrent raw and high-level calls, with full zero-write snapshots. The SQLite case control separates exact legacy retries from differently cased fresh admissions and preserves old command rows without claiming those fresh admissions are zero-write.

The loss cell executes only the exact accepted shared proxy117118c8/SHA256bd1e8ccb source bytes. It proves complete upstream success followed by client transport loss, reads the committed command/update identity before the first retry, and verifies four explicit same-key SDK retries plus integer→boolean typed intent conflict. Full rows/schema and history remain unchanged across retries. It retains metadata/body hashes only and performs no legacy transform, physical upgrade or worker execution. Existing artifact/build/held-executable/exact-peer/cleanup guards remain.

Validation: all34 inert controls and9 advisory-check controls pass, including selected-receipt rejection, exact original-row joins, timestamp precision/zone rules and changed-fixture refusal before execution. Credential/private-path scan and diff checks pass. Actual installed cells will use registry Rust4.16 and qualified native3.9.2; source/CI and observed-cell evidence remain separate gates. Physical3.8 upgrade and the full216 cohort remain independently owned.

[rmcdaniel]

The first two-rows attempt at9e9d7f3 is runner NONPASS, with owned cleanup confirmed. It stopped because the harness required body.request_id on an ambiguity refusal. The accepted manifest's ambiguity_expected does not require that field, and exact published Server3.9.2 rust/src/runtime/command_intent.rs::ambiguous_key deliberately refuses without exposing either key. Rust Error::request_id() likewise documents that refusals without an echoed key return None. This is a runner contract-assumption error, not a product failure.

Corrected only the optional echo assertion: if a key is echoed it must equal the caller key, and the SDK accessor must equal the body's actual optional echo. Required409 reason, strict retained/unverified/nonretryable booleans, no selected command/run/update/receipt, concurrent calls and full zero-write comparison are unchanged. A control now accepts the permitted missing echo while still refusing a wrong echoed key. All34 controls pass.

Final source for counter-review is 0ef86f227f584eaa9254572a592269fd8d718d01, tree 573c262180fc450a6e82ecdf3496313b9cc5e70d. Its tree is identical to2652a6f; the final commit only refreshes onto accepted #261 main11167b3. #262 now targets main because normal CI intentionally runs only for main-target PRs. Normal exact-head checks are running after the actual source push. No blank trigger commit, skipped check or workflow-policy change was used.

Next sdk-rust action is a fresh named repeat of all four ambiguity/case cells and the separate accepted-proxy loss cell against the unchanged registry4.16/qualified native3.9.2 tuple, then terminal receipts and Security counter-review. Earlier failed runner output remains NONPASS and other cells were not executed by that stopped batch.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Observed installed cells PASS at exact public source 0ef86f227f584eaa9254572a592269fd8d718d01, tree 573c262180fc450a6e82ecdf3496313b9cc5e70d: three ambiguity shapes, SQLite case distinction and a separately labeled committed-response-loss cell. Security source/cell counter-review and exact-head normal checks still gate merge. The earlier9e9 attempt remains runner NONPASS.

Exact tuple is registry Rust4.16.0 / archive 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc / source afc2b2ff8960ac2e080ffec765c66f59200cd544; qualified native3.9.2 / source 5614274d2629d03f92932a07dfee0fb10349ddd9 / index sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9 / Linux amd64 child sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128, SQLite. Producer immutable qualification and recorded registry consumer build bind these artifacts independently.

All cells execute the same held binary 5ec0e654c5678adcf7d92387602ec19d5f4dbec3e9e87c3e0bd625d0c474f172, private build receipt e0c10c79c2c97a5c252ee28fccffbbb7fae95c57ffb9624579cb03a05a8f2b32, unchanged committed lock/adapter/recipe inputs and source guards. Runner SHA 555300de4b4cdf6e1331e7781206f35702203146c3ad925f7acece358b37a0f5; loss adapter SHA efb7ab7864e5129972afabd309ddcde05c303df751b56539fe57bdee15a02aa1. Common helper SHA 6fc6054ce087c136a86d7b6b222daeefaa87c58fa0b613b155a5df39e6a26fad and producer manifest accepted atServerd66/SHA da1990000c611d7377690c7526487d6415fa4f9cb42d299f59585a7c2eebf769 are unchanged.

Each ambiguity shape performs four concurrent calls per command type plus high-level SDK calls, requires409 request_id_ambiguous, strict retained/unverified/nonretryable flags and no selected receipt. An absent request-key echo stays absent/None; a present wrong echo still refuses. The exact transformed or unchanged modern snapshot equals the restart baseline before readbacks and the complete final snapshot.

Cell	UTC start → finish	Transforms	Complete zero-write digest
two-rows	2026-11-13T16:12:30.990124+00:00 → 2026-11-13T16:12:34.929358+00:00	2	535b2444478a9d1c9688eb077f4160d8a30f77d9855f71470854760253d8a6ca
legacy-token	2026-11-13T16:12:35.058017+00:00 → 2026-11-13T16:12:37.508129+00:00	2	ad46f04073e0b0a2d76926835bda3100e1de449023c61e038ba572480d022e08
modern-raw	2026-11-13T16:12:37.645917+00:00 → 2026-11-13T16:12:40.055645+00:00	0	e716137cf4c22cd89f1a261c17338fff3b61c3d41725b65cecffdb532bb58e57
case-only	2026-11-13T16:12:40.216405+00:00 → 2026-11-13T16:12:44.454845+00:00	2	0eb2b492f74de58a0c47f7cbcdbad008c983dcc52a93af617cea708335cf1af3

The modern-raw case deliberately has zero transforms. The case-only zero-write digest applies to exact-byte legacy readbacks/conflicts before distinct admissions. SQLite then accepts the differently cased key as a new202 command, preserving every preexisting command row. These admissions are not zero-write, and no other-backend result is inferred.

Type	Existing exact-case command	New case-distinct command	Run
signal	01M7ATXF4S0TFCZNGMPYD4VYCA	01M7ATXHZ1H3FY62Y2DVTZPWJQ	01M7ATXF2NPMDCBQS4BRDG0W3S
update	01M7ATXF6QNWD5XWZG5NP9C02H	01M7ATXJ19B6SV93FRZBX0SQAB	01M7ATXF2NPMDCBQS4BRDG0W3S

The postcommit-response-loss-only cell ran 2026-11-13T16:12:44.608952+00:00 → 2026-11-13T16:12:48.855742+00:00. It binds accepted shared fixture 117118c83093822469b3824ba9587ff4068ed29f / SHA bd1e8ccbbf76f63fc2eafa278a023eb181d405b68d9c30016392e395a1eff725. The original command/update identity was read from the complete committed database snapshot before the first retry. The proxy consumed complete202 responses and then closed each client socket; the SDK observed transport errors. Four explicit retries per command type preserve identity and verified intent. Integer→boolean changes produce typed409 intent conflicts carrying the exact caller key. Durable history and every logical database row/schema remain unchanged across retries/conflict. No transform, physical upgrade or Worker runs in this cell.

Type	Original and returned command/run	Original and returned update/accepted time	Complete zero-write digest
signal	01M7ATXKD9HTWEZ9A8ZWTPR2H8 / 01M7ATXKAXX998W5W4NSK48610	n/a	e1e8f963404bd026f2e4fe212fa326dc2158aec15b1f7509b14554439b7fe2f1
update	01M7ATXKSMHD8ADESVFN5XCMJW / 01M7ATXKAXX998W5W4NSK48610	01M7ATXKSMHD8ADESVFN5XCMJX / 2026-11-13T16:12:45.748Z (same UTC precision as committed SQLite row)	2a99000442e223138cef56339fc8be495c41340ad708fb48f1c37a17ecf9aa85

Bounded proxy metadata (no payload/header retention):

Type	Request bytes / SHA-256	Complete202 response bytes / SHA-256	Intentional drop
signal	93 / c25da17cd34c34211641138a35138f8138779a766065e26208091dda884262b2	1991 / 7a9529b20816196dd136782bac649e6ed8144db903c47737919922f782100da7	true
update	116 / 3f11fcbf6bc361b6c6da5f9279ad41c6dc9154acc281e38fae37c3db84d1eced	2699 / 970d32bac239dcd523ca8e90e824d068e2cb71f10fd01ab85b2cd5dfb67e5bf8	true

All full private snapshots, their mode0600 and digests were independently rechecked after terminal completion. Executable identity still matches its recorded build. Exact owned runtime/volumes/database/env/proxy cleanup is verified; no sdk-rust container remains. Owned disk-backed diagnostics/build/snapshots have seven-day retention. All34 inert controls and9 advisory-check controls pass; exact-head CI and Security are separate pending gates. Actual3.8 physical-upgrade/installed readbacks, direct Unicode repeat and full216 remain separate. Earlier runner failures remain NONPASS.

[rmcdaniel]

Security exact-head review: PASS for Rust #262 at 0ef86f227f584eaa9254572a592269fd8d718d01 / tree 573c262180fc450a6e82ecdf3496313b9cc5e70d.

I reviewed the complete five-file delta from accepted #261 main. The shared installed consumer, registry lock, builder/build receipt, held-executable guard, stopped-copy helper, and accepted producer manifest are unchanged.

The three ambiguity scenarios are closed and correctly separated:

• two-rows admits two genuine commands and transforms only the second into the original raw key;
• legacy-token applies only the accepted literal stored-token shape;
• modern-raw performs no transform and explicitly records zero transforms.

Each is open-state only, requires four concurrent raw calls plus the high-level SDK call for both signal and update, enforces 409 request_id_ambiguous with retained/unverified/nonretryable markers, refuses every selected receipt field, and compares the complete logical database snapshot before/after. The final optional-echo correction is faithful to the frozen producer contract: an absent request-key echo remains absent/None, while any present wrong echo still refuses.

The SQLite case-only cell first proves exact-byte legacy readbacks/conflicts are zero-write, then admits the differently cased key as a distinct command for each type. Its receipt explicitly excludes those later admissions from the zero-write claim, retains a third private snapshot, and requires every preexisting command row unchanged. It makes no MySQL/MariaDB/PostgreSQL claim.

The response-loss adapter also preserves the required authority boundary:

• I independently fetched accepted fixture commit 117118c8…; its exact source hashes bd1e8ccbbf76f63fc2eafa278a023eb181d405b68d9c30016392e395a1eff725 as pinned. The adapter executes only that verified source buffer and rejects changed/symlinked/hardlinked inputs before runtime effects.
• The accepted proxy is numeric-loopback-only, bounded, forwards no proxy authorization, consumes the complete upstream response, records only bounded sizes/hashes/status, and intentionally drops only the armed successful response.
• Before the first retry, the runner joins the exact committed token to one command and, for updates, one update identity. It also requires one durable history event.
• Four explicit same-key retries retain the original identity and verified intent. Integer-to-boolean changed intent must produce a typed 409 conflict with the exact caller key. Complete history and logical rows/schema must remain unchanged.
• Proxy, owned runtime/database/env, held executable, and private snapshot cleanup are bounded and checked; no worker, transform, or physical upgrade is used in this cell.

Independent exact-head checks:

• git diff --check 11167b3d...0ef86f22 — PASS;
• all 34 command-key acceptance controls — PASS;
• all 9 advisory-registration controls — PASS;
• runner/adapter/helper hashes independently match the installed receipt: 555300de…, efb7ab78…, and 6fc6054c…;
• all 19 current hosted checks are terminal green (two unrelated qualification jobs intentionally skipped).

I reviewed the fresh exact-head five-cell receipt at issue comment 6858477655; the registry Rust 4.16 / qualified native 3.9.2 identities, original/returned IDs, proxy complete-202/drop metadata, transform counts, complete zero-write digests, case exclusion, held-binary identity, private snapshot modes, and cleanup are consistent with this source.

This verdict qualifies only these three ambiguity cells, the SQLite case-only cell, and the separately labeled post-commit response-loss cell. It does not qualify a real 3.8 physical upgrade, other backend case behavior, Unicode correction, publication/adoption, or full #216 closure.

[rmcdaniel]

Merged through GitHub at dd7b6b802817e72a9a717ed5ddc56ca4db572c57 after all19 exact-head gates and independent Security source/five-cell PASS. The accepted runner/adapter/helper bytes match reviewed0ef86f22 exactly. Remote topic head is deleted and fresh404 absence is verified.

The five installed receipts remain bound to their exact public4.16/qualified3.9.2 tuple, source, executable/build identities and independent cleanup. Earlier9e9 runner failure stays NONPASS. No SDK/runtime/package release was needed.

Repository inventory is now zero open issues and zero open PRs. Shared216 continues: sdk-rust owns the unchanged public direct/Unicode registry-consumer repeat and then consumer-specific readback of Server's actual physical3.8 upgrade handoff. Server's producer physical receipt is independently scoped to keyed updates and unkeyed-signal compatibility. The owner has been asked for the retained baseline/receipt identities and canonical consumer staging invocation. No full216 acceptance is inferred.