# Exact481 native outcomes contract Product finding

```yaml
reviewer: informed-decision-owner (agent informed-decision, codex)
decision: changes_requested
work_item: INFD-WP-ADHOC-2026-10-11-T09
scope: exact481 distinct T05 release source preparation
manifest_sha256: 3f1ce7ed678a457f73ab6486c7e81ef3360daf4f7ec1196f3031c3ffaace57ec
comment: >-
  Same completed T09, with source-refinement record prepared before formal
  review. Full ad63564files/manifest and earlier findings preserved exact.
  Original67 full snapshot remains unavailable/disclosed. No native outcome,
  founder acceptance, scored new trial or current recovery grant claimed.
```

All481 hashes independently verify. All36 synthetic/source tests pass. Exact
typed native memo/document decoder accepts12unique content digests under13
packet labels; defaultJSON register body204591bytes remains below262144byte
limit. Gzip bundle losslessly matches every source digest/size. Original wiring,
snapshot/operation intent forwarding, coverage, typed duplicate and freeform
receipt-body findings are corrected.

The new proposed outage term is explicit in question/terms/highlight/protocol,
not inherited from T04 or source acknowledgment. It permits only manually
supervised same763/c96 image-only recovery preserving latest DB after actual
release/failed candidate/service outage, <=30minutes AND execution deadline,
using exact pre-release confirmed acceptance cache and fresh root outage witness.
No401/403/explicit revocation/current conflict/mismatch/healthy service or other
phase fallback. Current later revocation cannot be checked during outage and is
expressly disclosed; cached acceptance is historical, not fresh or autonomous
authority. Recovery verification requires this journal's COMPLETE rollback and
hash-linked original outage plus recovered763/c96/Ready1. Native code rechecks
window immediately before patch; controlled Pod/ephemeral drift refuses before
effect. Item19 remains proposed until a new exact human decision. No source
review approves this privileged exception.

The remaining blocker is actual provider response compatibility, not privacy:
`safe_outcome_metadata` requires top-level memo_id. Actual lifecycle_http.py101
returns LifecycleService.outcomes directly; lifecycle_review.py123 builds only
review/dispositions. There is no native body memo_id. The earlier root normalized
receipt's memo_id was locally injected. Current privacy fixtures reuse synthetic
authority accepted() body containing that extra field, so they do not prove real
post-Ready metadata acceptance. Fixed canonical request/context should correlate
source MEMO_ID, then inject it into bounded output; if native body optionally
includes memo_id, reject mismatch rather than requiring an invented field.

Other real contract shapes are also rejected: lifecycle_review.py127–132 LEFT
JOIN yields null submission_state for non-accept comments, and store.py428/449/465
uses prepared/in_flight/confirmed/unresolved. ActorKind includes system in
disposition.py42–46. The bounded serializer should support legitimate typed
metadata while preserving authority's separate ready/confirmed founder gate,
without turning comments/unconfirmed states into acceptance. Align review
intake states with actual native contract where needed. Test the actual native
body without memo_id, confirmed accept plus comment/null, prepared/in_flight
and system metadata, preserving freeform/unknown sentinel exclusion.

Five isolated source counterexamples against frozen481 helper reject these
legitimate shapes. No HTTP request, real credential read, database open or
cluster command occurred. Frozen helper/manifest/source-probe/boolean receipt
are retained under docs/evidence/2026-10-11-zlib-release-product-contract-review/.

Published/source/scan proof remains unchanged. Fresh same-image full scan gate
binds exact artifact/config/11diffIDs/38OS+6Python44PURLs, now before DBNextUpdate
and <=4hour age; Oct11 DB is not presumed valid through Oct12 execution window.
New findings refuse release/closure. Actual post-Ready canonical PDP operation
remains mandatory and distinct from installed synthetic2allow/8refuse. Because
current helper rejects that actual response shape, no final acknowledgment is
issued. T05progress/WP0009active and new human acceptance/installed proof remain
pending; old approved R2 helpers/journals and unpromotedIN10 are unchanged.
The corrected immutable packet and later final review/memo reference rebinding
need bounded exact source confirmation before first human post.

Root selected the narrower correction: retain only fixed authenticated canonical
GET/source1 HTTP200 and captured timestamp, shape-check native review=None/dict
and dispositions=list of dicts, emit only has_review/disposition_count. Source
memo correlation derives from the fixed request, not a claimed body memo_id;
optional body ID must match. Omit all review/disposition states/actors/bodies, so
legitimate native comment/null/prepared/in_flight/system rows are not mistaken
for approval or rejected by invented enums. Founder consent remains exclusively
in the separate authority relation. New source and actual native-shape/sentinel
fixtures must independently verify this choice before exact final acknowledgment.
