the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md

# Verify the installed f599 runtime after the stopped R2 attempt

Stable proposal **REINAH-WP-0008-T07-install-f599-r1**, revision **3** of the
same trial. **Pending root review and fresh exact founder approval.** The R2
approval was consumed by its stopped failed/partial attempt. No R3 native
mutation or launcher execution has occurred. The canonical existing owner task
is HARNESS-WP-0008-T07; the proposal's earlier spelling remains its stable ID.

R2 installed f599 once (`reused=false`), verified complete extracted/installed
digests, then failed during offline rehearsal with `phase_receipt_unavailable`.
Its watchdog reported `leader_left_descendants`, subsequently proved quiescence
and removed staging. The inactive installed artifact remains. R2's immutable
actual receipt is the outcome; this proposal does not relabel it a success.

Exact R2 source has a demonstrated zombie-classification bug: a normally exiting
leader that leaves only an already-dead adopted zombie returns 125. R2 counts
the zombie as a leftover, then reaps it during failure cleanup. The reproducible
local counterexample records the child's actual PID/start/UID/state=Z. This
**does not establish the native failure's cause**: R2 removed its process trace,
so a genuinely live native leftover cannot now be ruled out from that receipt.
R3 repairs the demonstrated source bug and retains facts needed to distinguish
those cases on a separately approved verification attempt.

## Exact new action

Only after root retains this exact revision/digest and fresh founder disposition:

```bash
python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py --apply
```

Default/`--dry-run` performs read-only checks, including the complete native
installed digest. Any local prior execution receipt refuses automatic replay.
The helper has no installer, archive builder, extraction or artifact transfer
path. This verifies the existing destination; it cannot reinstall or overwrite it.

| Binding | Exact value |
|---|---|
| Host/account | railiance01, Ready node at 92.205.62.239; tegwick UID/GID1000 |
| Existing store | /home/tegwick/.helixforge-factory/runtimes, mode0700, device2049, inode4751222 |
| Already installed runtime | /home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
| Complete required digest | sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d |
| New temporary staging | /home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017 |
| New retained public receipt | /home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017.receipt.json, exclusively created0600 |
| Three transferred public helpers | runtime.py, verify-installed.py, process_supervision.py; no runtime archive |
| Native binaries | /usr/bin/python3, /usr/local/bin/kubectl, /usr/bin/bwrap (0.9.0) |

The exact owner API is unchanged f599 `owner_rehearsal.rehearse(runtime,
run=bounded_run, bwrap_bin='/usr/bin/bwrap')`, source SHA256
192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3.
Its normal profile/owner/spend admission path is untouched. The existing public
credential-free rehearsal API supplies three fixed commands:

1. /opt/sandboxer/runtime/bin/rein-aharness --help
2. /opt/sandboxer/runtime/bin/glas-harness --help
3. /opt/sandboxer/runtime/bin/claude --version

All run through the original empty-root, cleared-environment, network-unshared
bwrap argv with readonly runtime/system binds and only temporary HOME/state.
The R2-added supported --die-with-parent flag remains. Exact arrays are in
frozen-native-argv.json; the helper refuses any missing frozen system bind.
All three zero exits and complete installed digest equality before/after remain
required. Failure does not narrow acceptance to fewer launchers.

## R3 supervision and retained evidence

The existing private one-action subreaper/watchdog still owns every phase and
nested launcher, starts distinct sessions, monitors root/caller pidfds, arms
PR_SET_PDEATHSIG before exec, and terminates/waits actual owned descendants on
outer timeout or parent loss. Unknown UID/start mapping remains failed cleanup,
with no broad kill/delete. The final waited watchdog must positively prove no
live or waitable descendants before staging can be removed.

The semantic repair reaps only already-dead adopted **direct-child zombies**
which are not Popen-managed job leaders. It preserves each leader's wait status,
rescans the actual descendant tree, and still refuses a live or other remaining
leftover. It does not ignore zombies or infer quiescence from a leader's exit.
The local live-leftover fixture confirms refusal and actual stopping/reaping.

Each job now has a fixed public label and bounded PID/start/UID/PPID/session/
process-state facts, exit status and disposition. Aborts retain the observed
leftover facts; successful orphan reaps retain state=Z and waited exit code.
No argv/environment/command output/private stderr is copied into the public
journal. At most16 job, orphan and leftover records are retained per category.
Phase stdout is bounded64KiB and application stderr remains discarded.

After waiting for the watchdog, the controller assembles all three launcher
statuses, available phase result, full-digest flags, and bounded public process
journal. Before any staging deletion, it exclusively creates and fsyncs the
named0600 public receipt and fsyncs its parent directory. This **immutable
precleanup checkpoint is never overwritten/truncated later**. It explicitly
records cleanup pending. If it cannot be persisted, staging remains. The final
local execution receipt carries the subsequent actual cleanup outcome; an SSH
loss requires read-only reconciliation against the native checkpoint and paths.
A dead controller cannot clean staging; its surviving watchdog records its
cleanup proof beneath staging, which remains for attended review.

## Read-only checks and local proof

The final read-only candidate preflight at 2026-10-17 08:41:54 UTC verified the
complete existing native f599 digest; expected protected store, account, node;
absent R3 staging/receipt; bwrap parent-death support and supervision primitives.
It passed fresh headroom gates: 123,064,221,696 free disk bytes, 7,668,154,368
available memory bytes, four CPUs, one-minute load0.4268 and one-second CPU busy
fraction0.2216. These are observations, not reservations; the same gates repeat
before any approved write/launch. Thresholds remain CPU<=85%, load<=2 per CPU,
available memory>=1GiB and disk>=2GiB.

Ten focused local cases passed: bounded success, session-escaped descendant
timeout, hard controller SIGKILL, outer phase timeout with nested runner,
uncertain mapping refusal, dead orphan-zombie reap, genuine live-orphan refusal,
three nested launcher receipts with normal zombie reaps, actual controller
receipt-before-cleanup ordering, and retention on durable receipt write failure.
An unrelated sibling stays alive in process fixtures. No fixture launches bwrap,
the runtime, a provider, SSH or any native owner interface. The two controller
IO cases explicitly stub native admission/launch inputs and use disposable
local paths; they prove cleanup ordering, not native compatibility.

One initial fixture expected immediate leftover refusal but inherited captured
stdout held EOF open, producing the correct timeout refusal instead. That
failed expectation/refinement is retained. The live-leftover classification
fixture now discards stdout as the actual native launcher contract does.

## Execution, cleanup and rollback boundaries

1. Recheck helper hashes, exact installed full digest, target identity/modes,
   absence of staging/receipt, supported bwrap/primitives and headroom. Refuse
   drift without polling, credential routing, provider call or any native write.
2. Save local one-attempt intent; exclusively create only the exact0700 staging,
   recording device/inode before SCP of the three pinned public files. The SSH
   bootstrap checks identity, exact inventory and all hashes, chmods only those
   payloads0600, and execs the public verifier in a cleared application environment.
3. Lower priority to nice19 before spawning the private watchdog. Recheck native
   guardrails and full f599; execute the unchanged complete three-launcher proof.
   Each launcher is bounded60 seconds; inner phase alarm240, supervised outer
   phase260. TERM grace0.5 seconds, KILL/reap3 seconds, watchdog wait8 seconds;
   SSH bound600 seconds does not itself prove remote termination.
4. Wait/prove process quiescence and save the durable public checkpoint before
   deletion. Remove only the exact recorded staging inode/device/owner/mode with
   known inventory. Keep the0600 native checkpoint as review evidence. Preserve
   the dormant installed artifact and every older artifact in all outcomes.
5. Local execution-receipt.json records the final actual outcome and cleanup.
   A phase failure records executed/not-started launcher statuses; no blind
   replay, artifact replacement/deletion, profile activation or paid attempt follows.

A transfer failure proven before remote execution may use only the separately
reviewed conditional cleanup helper:

```bash
python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/cleanup-upload-staging.py --apply
```

It accepts only this proposal's revision3 staging_created/before_transfer local
receipt and exact stage identity, and only the three regular upload files. It
refuses extracted/runtime/supervision state and every later execution phase.
After remote exec starts, any lost response, uncertain mapping, unexpected
object or missing quiescence proof retains evidence for root recovery review;
no general post-execution cleanup command is authorized. Native checkpoint
cleanup is not automatic and is not included in this action.

Expected success is `installed_runtime_offline_rehearsal_verified` with all three
explicit zero exits, actual public process dispositions, full before/after digest
and verified owned-stage removal. It is native offline startup verification only.
No real model/workload/tool/canary acceptance, profile readiness, T07 completion,
Custodian assignment migration or TSA-06 denominator claim follows. Spend memo
acceptance, owner renewal, Secrets catalog pins and future native/model approvals
remain separate existing owner gates.

Provider spend requested is USD0 and no new paid resource is created. Incremental
shared-host infrastructure/energy/operator EUR cost and credible loss EUR remain
**UNKNOWN**, requiring explicit supervised exposure approval; they are not zero
or an autopilot grant. Transferred public source/receipts are small; actual known
launcher startup CPU/IO on the shared single-node host remains the relevant risk.
Rollback stops owned processes, verifies quiescence and removes only verified
owned temporary staging after durable evidence. The installed inactive artifact
and immutable precleanup receipt remain, with no configuration to restore.

## Frozen evidence

- r2-baseline.json: complete R2 file fingerprints including actual partial receipt;
  R1/R2 bytes are never changed by this preparation.
- reproduce-r2.py / r2-zombie-counterexample.json: exact frozen R2 counterexample,
  actual public zombie facts and explicit native-cause uncertainty.
- process_supervision.py and r2-to-r3-supervisor.patch: exact semantic/trace repair.
- test_process_supervision.py / test_receipt_cleanup.py / local-fixture-results.json:
  ten focused checks and clearly bounded claims; retained-fixture-refinement.json
  preserves the earlier failed expectation.
- frozen-native-argv.json, action-inputs.json: exact unchanged owner launch arrays,
  helper/source pins, paths, time/output bounds and cost/authority limits.
- final-readonly-dry-run.json: actual R3 source preflight, full native hash, zero writes.
- artifact-manifest.json: binds this reviewable revision; root retains its digest,
  failed R2 outcome and fresh exact supervisor disposition in the same trial.