the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/FINAL-PROPOSAL.md

Verify the installed f599 runtime after the stopped R2 attempt

Stable proposal REINAH-WP-0008-T07-install-f599-r1, revision 3 of the same trial. Pending root review and fresh exact founder approval. The R2 approval was consumed by its stopped failed/partial attempt. No R3 native mutation or launcher execution has occurred. The canonical existing owner task is HARNESS-WP-0008-T07; the proposal's earlier spelling remains its stable ID.

R2 installed f599 once (reused=false), verified complete extracted/installed digests, then failed during offline rehearsal with phase_receipt_unavailable. Its watchdog reported leader_left_descendants, subsequently proved quiescence and removed staging. The inactive installed artifact remains. R2's immutable actual receipt is the outcome; this proposal does not relabel it a success.

Exact R2 source has a demonstrated zombie-classification bug: a normally exiting leader that leaves only an already-dead adopted zombie returns 125. R2 counts the zombie as a leftover, then reaps it during failure cleanup. The reproducible local counterexample records the child's actual PID/start/UID/state=Z. This does not establish the native failure's cause: R2 removed its process trace, so a genuinely live native leftover cannot now be ruled out from that receipt. R3 repairs the demonstrated source bug and retains facts needed to distinguish those cases on a separately approved verification attempt.

Exact new action

Only after root retains this exact revision/digest and fresh founder disposition:

python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/execute-verify.py --apply

Default/--dry-run performs read-only checks, including the complete native installed digest. Any local prior execution receipt refuses automatic replay. The helper has no installer, archive builder, extraction or artifact transfer path. This verifies the existing destination; it cannot reinstall or overwrite it.

Binding	Exact value
Host/account	railiance01, Ready node at 92.205.62.239; tegwick UID/GID1000
Existing store	/home/tegwick/.helixforge-factory/runtimes, mode0700, device2049, inode4751222
Already installed runtime	/home/tegwick/.helixforge-factory/runtimes/f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d
Complete required digest	sha256:f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d
New temporary staging	/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017
New retained public receipt	/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017.receipt.json, exclusively created0600
Three transferred public helpers	runtime.py, verify-installed.py, process_supervision.py; no runtime archive
Native binaries	/usr/bin/python3, /usr/local/bin/kubectl, /usr/bin/bwrap (0.9.0)

The exact owner API is unchanged f599 owner_rehearsal.rehearse(runtime, run=bounded_run, bwrap_bin='/usr/bin/bwrap'), source SHA256 192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3. Its normal profile/owner/spend admission path is untouched. The existing public credential-free rehearsal API supplies three fixed commands:

1. /opt/sandboxer/runtime/bin/rein-aharness --help
2. /opt/sandboxer/runtime/bin/glas-harness --help
3. /opt/sandboxer/runtime/bin/claude --version

All run through the original empty-root, cleared-environment, network-unshared bwrap argv with readonly runtime/system binds and only temporary HOME/state. The R2-added supported --die-with-parent flag remains. Exact arrays are in frozen-native-argv.json; the helper refuses any missing frozen system bind. All three zero exits and complete installed digest equality before/after remain required. Failure does not narrow acceptance to fewer launchers.

R3 supervision and retained evidence

The existing private one-action subreaper/watchdog still owns every phase and nested launcher, starts distinct sessions, monitors root/caller pidfds, arms PR_SET_PDEATHSIG before exec, and terminates/waits actual owned descendants on outer timeout or parent loss. Unknown UID/start mapping remains failed cleanup, with no broad kill/delete. The final waited watchdog must positively prove no live or waitable descendants before staging can be removed.

The semantic repair reaps only already-dead adopted direct-child zombies which are not Popen-managed job leaders. It preserves each leader's wait status, rescans the actual descendant tree, and still refuses a live or other remaining leftover. It does not ignore zombies or infer quiescence from a leader's exit. The local live-leftover fixture confirms refusal and actual stopping/reaping.

Each job now has a fixed public label and bounded PID/start/UID/PPID/session/ process-state facts, exit status and disposition. Aborts retain the observed leftover facts; successful orphan reaps retain state=Z and waited exit code. No argv/environment/command output/private stderr is copied into the public journal. At most16 job, orphan and leftover records are retained per category. Phase stdout is bounded64KiB and application stderr remains discarded.

After waiting for the watchdog, the controller assembles all three launcher statuses, available phase result, full-digest flags, and bounded public process journal. Before any staging deletion, it exclusively creates and fsyncs the named0600 public receipt and fsyncs its parent directory. This immutable precleanup checkpoint is never overwritten/truncated later. It explicitly records cleanup pending. If it cannot be persisted, staging remains. The final local execution receipt carries the subsequent actual cleanup outcome; an SSH loss requires read-only reconciliation against the native checkpoint and paths. A dead controller cannot clean staging; its surviving watchdog records its cleanup proof beneath staging, which remains for attended review.

Read-only checks and local proof

The final read-only candidate preflight at 2026-10-17 08:41:54 UTC verified the complete existing native f599 digest; expected protected store, account, node; absent R3 staging/receipt; bwrap parent-death support and supervision primitives. It passed fresh headroom gates: 123,064,221,696 free disk bytes, 7,668,154,368 available memory bytes, four CPUs, one-minute load0.4268 and one-second CPU busy fraction0.2216. These are observations, not reservations; the same gates repeat before any approved write/launch. Thresholds remain CPU<=85%, load<=2 per CPU, available memory>=1GiB and disk>=2GiB.

Ten focused local cases passed: bounded success, session-escaped descendant timeout, hard controller SIGKILL, outer phase timeout with nested runner, uncertain mapping refusal, dead orphan-zombie reap, genuine live-orphan refusal, three nested launcher receipts with normal zombie reaps, actual controller receipt-before-cleanup ordering, and retention on durable receipt write failure. An unrelated sibling stays alive in process fixtures. No fixture launches bwrap, the runtime, a provider, SSH or any native owner interface. The two controller IO cases explicitly stub native admission/launch inputs and use disposable local paths; they prove cleanup ordering, not native compatibility.

One initial fixture expected immediate leftover refusal but inherited captured stdout held EOF open, producing the correct timeout refusal instead. That failed expectation/refinement is retained. The live-leftover classification fixture now discards stdout as the actual native launcher contract does.

Execution, cleanup and rollback boundaries

1. Recheck helper hashes, exact installed full digest, target identity/modes, absence of staging/receipt, supported bwrap/primitives and headroom. Refuse drift without polling, credential routing, provider call or any native write.
2. Save local one-attempt intent; exclusively create only the exact0700 staging, recording device/inode before SCP of the three pinned public files. The SSH bootstrap checks identity, exact inventory and all hashes, chmods only those payloads0600, and execs the public verifier in a cleared application environment.
3. Lower priority to nice19 before spawning the private watchdog. Recheck native guardrails and full f599; execute the unchanged complete three-launcher proof. Each launcher is bounded60 seconds; inner phase alarm240, supervised outer phase260. TERM grace0.5 seconds, KILL/reap3 seconds, watchdog wait8 seconds; SSH bound600 seconds does not itself prove remote termination.
4. Wait/prove process quiescence and save the durable public checkpoint before deletion. Remove only the exact recorded staging inode/device/owner/mode with known inventory. Keep the0600 native checkpoint as review evidence. Preserve the dormant installed artifact and every older artifact in all outcomes.
5. Local execution-receipt.json records the final actual outcome and cleanup. A phase failure records executed/not-started launcher statuses; no blind replay, artifact replacement/deletion, profile activation or paid attempt follows.

A transfer failure proven before remote execution may use only the separately reviewed conditional cleanup helper:

python3 -I -B /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-r3/cleanup-upload-staging.py --apply

It accepts only this proposal's revision3 staging_created/before_transfer local receipt and exact stage identity, and only the three regular upload files. It refuses extracted/runtime/supervision state and every later execution phase. After remote exec starts, any lost response, uncertain mapping, unexpected object or missing quiescence proof retains evidence for root recovery review; no general post-execution cleanup command is authorized. Native checkpoint cleanup is not automatic and is not included in this action.

Expected success is installed_runtime_offline_rehearsal_verified with all three explicit zero exits, actual public process dispositions, full before/after digest and verified owned-stage removal. It is native offline startup verification only. No real model/workload/tool/canary acceptance, profile readiness, T07 completion, Custodian assignment migration or TSA-06 denominator claim follows. Spend memo acceptance, owner renewal, Secrets catalog pins and future native/model approvals remain separate existing owner gates.

Provider spend requested is USD0 and no new paid resource is created. Incremental shared-host infrastructure/energy/operator EUR cost and credible loss EUR remain UNKNOWN, requiring explicit supervised exposure approval; they are not zero or an autopilot grant. Transferred public source/receipts are small; actual known launcher startup CPU/IO on the shared single-node host remains the relevant risk. Rollback stops owned processes, verifies quiescence and removes only verified owned temporary staging after durable evidence. The installed inactive artifact and immutable precleanup receipt remain, with no configuration to restore.

Frozen evidence

• r2-baseline.json: complete R2 file fingerprints including actual partial receipt; R1/R2 bytes are never changed by this preparation.
• reproduce-r2.py / r2-zombie-counterexample.json: exact frozen R2 counterexample, actual public zombie facts and explicit native-cause uncertainty.
• process_supervision.py and r2-to-r3-supervisor.patch: exact semantic/trace repair.
• test_process_supervision.py / test_receipt_cleanup.py / local-fixture-results.json: ten focused checks and clearly bounded claims; retained-fixture-refinement.json preserves the earlier failed expectation.
• frozen-native-argv.json, action-inputs.json: exact unchanged owner launch arrays, helper/source pins, paths, time/output bounds and cost/authority limits.
• final-readonly-dry-run.json: actual R3 source preflight, full native hash, zero writes.
• artifact-manifest.json: binds this reviewable revision; root retains its digest, failed R2 outcome and fresh exact supervisor disposition in the same trial.