[Mjones13]

Current delivery qualification: M Jones has released the source-only merge hold. Exact head b66ae31e624a881867b94c8564a534dbe8a370df / tree 03fc757b5041ab798d86469aef444375625dfb0b passes required CI Check (run 43071049149, job 130705007495), with no required reviews or unresolved review threads. The Server parallel qualification failures remain advisory and tracked in #853; broader concept P1/AC2/host qualification remains open. Historical hold statements below describe prior checkpoints and are superseded for source delivery only.

Canonical main includes Ubuntu dependency transport repair 64948bedab2b665716378752f13eb5a0d004dd05 through merge 00c7b7bee204739a6a45e25aa153f97130614e6d (#935). No feature-head update or duplicate repair is needed: normal merge composes that main fix with this already-green source slice. No new local tests ran during delivery; the disk reserve prevents local fetch/integration. This does not establish live producer absence, AC2, installed-runtime or host qualification.

Delivery performed by gpt-6.1-sol/high through the Codex harness in Jones Code, captured Blended Frontier Max rev11; no children.

Finite server builds now persist exact self and spawn ownership before allocation, and reconcile allocation duties without inventing an unobserved native terminal. This implements PRD-A1 producer-resolution CORE from storage-workspace-lifecycle §5.2b at V3 1754f24cc91bcef0e91cb176ecef344239dae632; it does not close AC-2 or claim host qualification.

• Add versioned holders, record revisions, guarded admission closure and allocation-only resolution to workspace-output-obligation/v1. Every metadata mutation uses an owning queue, a real reservation transaction, binding checks and revision comparison. In-flight failure/cancellation remains held; observed native status, finished_at, proof, sidecars and unrelated reasons survive reconciliation.
• Record a durable intent before each build child spawn. Capture the original detached child PID as its SID, with no post-exit PID adoption. Uncertain/non-detached capture and bounded holder overflow stay open. Preserve the existing inner child scope and native command result, independently of optional completion capture.
• Reconcile at exact producer/root-set admission, target-scoped Runtime evaluation, and node scripts/jones/direct-producers/resolve.ts --worktree <path> --json. The CLI reports exact blocking records and returns nonzero for blocked legacy active records too. Only .git lstat ENOENT permits an unowned distribution build.
• Recover capacity with bounded opendir iteration (10,065th name stops before deletion), at most 16 discovery candidates per pass, exact successor revalidation, and an advancing advisory cursor outside the reader directory. Preserve open legacy, unsupported, malformed and mismatched records. At the 10,000 bound, a new successor requires an already validated exact candidate. Keep the reader's 10,000-record and 64-KiB limits.

Behavioral validation on predecessor 62503cd7f6c18d4734135283c4dd694572c69c83: 30 distinct supplemental Node oracles passed across the affected runs on this Apple Silicon laptop using existing Node v24.22.1, real private Git/SQLite/filesystems and the existing sequential Effect interpreter seam. The expanded 28-case run passed 26 and refused its last two fixtures at the storage-admission gate; a fresh admitted 4-case selection then passed both capacity cases and affected observer/self cases. Subsequent focused selections passed 3/3 (including the actual standalone CLI exit) and 2/2 (malformed-filename cursor progress and 10,001 crash recovery). All runs were serial, with fresh CPU below 85%, private 0700 roots, a 512-MiB peak allowance and 2-GiB reserve. Every created fixture root was removed; no fixture root or unknown process custody is retained. The real fast-exit child and exited-self/CLI fixtures completed and were awaited. Node syntax checks on all changed TypeScript sources/tests and git diff --check passed.

CI repair at c3c829e863952cc39499f401e52de3e2ccc0956a (tree a3f8dfd46b52a1c9e5758f07dab38348b90fc5cd): remove the two redundant resolver ownership declarations from fragments/direct-producer-completion.json; inventory.json already owns scripts/jones/. Keep both resolver classifications and all feature/test mappings. Apply only the nine in-cone formatter changes from artifact 13869749988 (run 43056818136, Lint job 130648365773, predecessor 62503cd7). Verified repository/run/head/job provenance, the single safe patch member, all preimages/postimages and archive SHA-256 e0ca37432139582b802a93778c67a73cd394c0681143c58b7532b658f488b38b. Token/comment/literal comparison plus inspection of the formatter's punctuation changes found no behavior change. All-fragment metadata ownership has zero overlaps; both resolver files have exactly one owner. Nine Node syntax checks and git diff --check passed. Full strict boundary/lint are for natural CI. No behavioral oracle reruns, dependencies, compiler, broad formatter, gate changes or manual CI reruns. The parent-reported Typecheck PASS applies to predecessor 62503cd7, not this new head.

Overflow fixture correction 332abaa104359a2ef13fe202be956bf9ef0ec447: the predecessor's Linux Server8 failure (run 43056818136, job 130648749308, source 62503cd7) came from assuming 55,000 padding bytes would cross the actual 56,000-byte canonical spawn watermark. The unchanged predecessor oracle passed locally at 56,092 canonical bytes, demonstrating the host-dependent fixture construction. The fixture now measures the production canonical serialization and pads to exactly 56,001 bytes before calling actual admission. It retains the null/overflow, same-boot hold, host-mismatch hold, different-boot discharge and sub-60,000-byte assertions, and additionally proves persisted overflow and an unchanged single outstanding intent. The production 56,000 watermark, 60,000 record bound and 64-KiB reader bound are unchanged.

Lint follow-up 4d73ea94c9b6761caa3e14a8145646f7ea1d4551 (tree fab3552e6371384d2ee190bfd3af155fa65e5847): fix c3c829e Lint run 43058827693/job 130655820428 by using namespace imports and a typed mutable alias to the same NodeFS.promises object, preserving ESM synchronization and finally restoration, with exact reference assertions afterward. Shorten the Linux host-gate comment to three lines; all executable observation tokens and literals are unchanged. Artifact 13872093059 was only inspected as metadata (162 bytes); no formatting patch was inferred or reapplied. The corrected overflow oracle passed separately, then both affected overflow/prune-failure oracles passed together (2/2), serially through existing Node 24.22.1 and the supplemental sequential interpreter with real private Git/SQLite/filesystems. This does not prove configured Effect scheduling/interruption or the Linux Node 26 result. Fresh final-run admission: CPU 19.75%, one core 8.33%, normal pressure, swap 0.062 MiB/s; storage met the unchanged fixture floor. Storage-refused attempts started no fixtures; an initial short-path ownership probe failed before producer work and cleaned its exact root. Every created fixture and private parent was removed. Node syntax, namespace-import shape, executable-token preservation and diff checks passed; full lint/type/boundary verification remains natural CI. No unaffected oracle group was rerun.

Separate predecessor CI evidence: artifact 13871961515 from server-parallel source-evidence run 43056817975 has verified archive SHA-256 b03807d807a0807302bf27f12239026464087e77f53f1e75b0e4dd340fd73c4a. Only its small reports and bounded native tails were inspected; the 59/86-MB observation members were not extracted or fully parsed. Both profiles failed productiveOverlap, normalTargets, writerP95Target, loopComparison, resourcesComplete, and churnThroughput; laptop additionally failed writerTarget. Both report cleanupProved=true individually, while aggregate qualification has cleanupProved=false and scopedCleanupProved=true. aggregateResourceBudget and childRssWithinBudget remain unknown; native phase completeness is unavailable. Snapshot outcome/activation are unknown, offload and contiguous-encode trigger false, with decode/projection attribution required. These summaries establish no in-cone producer defect or infrastructure/product-regression attribution. Parent owns separate qualification judgment; its gates and deferred findings are unchanged.

The corresponding c3c829e server-parallel artifact 13872946984 (run 43058827551, job 130655717925) was independently bound to source c3c829e863952cc39499f401e52de3e2ccc0956a/tree a3f8dfd46b52a1c9e5758f07dab38348b90fc5cd; archive 5,940,828 bytes, SHA-256 19356e64323a76daa6b9fbd12423a34a40271518045d51c3844fc02f5abf8254, 29 members. Only small JSON reports and 64-KiB native tails were read; 59/86-MB observations were not extracted or fully parsed. Aggregate and laptop failed/unknown predicates match the predecessor exactly. VPS no longer lists normalTargets as failed; its other failed/unknown predicates match. Both individual cleanups remain proved, aggregate cleanup remains false, scoped cleanup remains true, and snapshot activation remains unknown with decode/projection attribution required. The parent-reported 20 files/232 tests passing does not turn this subsequent failed source-evidence qualification into a pass. No in-cone producer defect or regression/infrastructure attribution follows from these summaries; no server-parallel gates or code changed.

Local limits: there is no node_modules closure here. No dependencies, compiler, toolchain or other checkout's modules were installed or borrowed. Configured Node 26.12.1/pnpm 12.14.0 Effect scheduling/interruption tests, the Runtime/CLI configured oracles and full static gates rely on natural CI; no local result is claimed for those gates. The configured Git hooks path .vite-hooks/_ is absent; hooks/configuration were preserved and staged-hook verification is not claimed. No app build, provider execution, real retirement, external host execution, installed application update, restart or activation occurred.

Host limits: Darwin spawned-session absence returns darwin_unpublished_allocation_unproved in this slice. Linux uses a single bounded discovery snapshot with fresh /proc/stat fork brackets and last-parenthesis stat parsing, but no installed kernel/build, full visibility/no-hidepid and namespace combination is qualified, so a quiet snapshot remains unknown. Failed PID lookups, ENOENT, zombies and observation errors remain unknown; a successful different self incarnation or verified different boot is separate evidence. The 250-ms snapshot budget is cooperative I/O accounting, not a claimed hard syscall deadline. No injected production absence gate or assertion flag exists. The original three P1 findings from swl-ac2-resolution-concept-review-20261111-r1 remain open pending parent review, code/oracle disposition and host qualification. NativeDutyOwner's terminal gap and remaining producer integrations are untouched.

Selected C01 checkpoint 071d002f8698e97471d48cc2bc67dd157442752c (tree edb0e833e20fc42df7ec0404d1e341f6878f8454), bound to independent review PR934-CORE-4d73 / swl-producer-core-4d73-correctness-review-20261111-r1, original P1/high: a referenced predecessor which cannot load/validate now refuses pruning before any deletion, allowing bounded discovery and advisory cursor persistence to continue. The unlink/directory-sync error boundary is unchanged and still throws prune_not_confirmed; binding, revision, acquired transaction, supersession checks, enumeration limits and open-record protections are unchanged. This checkpoint changes only apps/server/src/jones/workspaceRetirement/ProducerFinalizer.ts and scripts/jones/direct-producers/finite-production.testkit.ts.

C01 reproduction: one unchanged regression places a binding-mismatched predecessor and supported successor in the first 16 names, followed by a valid recovery pair in the next window, at 10,001 names. It verifies first-window capacity refusal with saved cursor, preservation of refused predecessor/successor bytes and modes, progress beyond that window, and recovery before successful admission at 10,000 records. The test failed before on the exact 4d73ea94 production blob c02bb3816d14bab1805de78f831cdec57c50c8d5, with escaped identity_mismatch at prune():293 through capacity() instead of the expected bounded capacity refusal. The same test and invocation passed after; test SHA-256 aff2537d43899126aeed3d7749602fb4e241b0887294a23e80c739c4cc147351, candidate production blob 1be89bf03aef9b2b5b7f28a81b3478f1e29a82dd. Exact focused command: node --test --test-concurrency=1 --test-name-pattern='^referenced predecessor refusal advances the capacity cursor to recover 10001 records before admission$' scripts/jones/direct-producers/finite-production.node-test.mjs. The affected capacity/prune group then passed 6/6, including deletion refusal, 9,999/10,000 capacity, the 10,065 no-delete ceiling, existing malformed-discovery cursor progress, and 10,001 crash recovery/corrupt cursor. No unrelated suite ran. These used existing Node 24.22.1, real private Git/SQLite/filesystems and the supplemental sequential interpreter; configured Node 26/Effect/type/lint/boundary checks remain natural CI.

Fresh admission preceded each C01 fixture command; the final group sampled CPU 15.52%, one core 8.33%, warning pressure, zero swap MiB/s and 3,653,824,512 available bytes, with one serial test process. The task declared at most 128 MiB additional scratch plus a 2-GiB reserve and retained the fixture's stricter existing storage gate. All nine fixture roots across red/green/group runs were removed with exact ENOENT readback. Node syntax and diff checks passed. C01 implementation evidence does not independently dispose the finding: root owns repair confirmation and disposition. C02/C03 remain excluded deferred P2s; their ledger was not read or edited. All three original concept P1 bindings and OPEN qualification effects remain. Root's merge hold remains; no child watch, bot, manual CI rerun, merge, runtime change or external-host test occurred.

C01 fixture timestamp typing repair 3f027d1878e9eec37ca263fedafec4e1b55b9cba (tree 882146928cd27686dcfe3ba3c855ebeb643e9a41): address the single effect(globalDate) TS377068 diagnostic from predecessor 071d002f, run 43066143550 / job 130681748729, by replacing new Date(...).toISOString() with the repository-supported DateTime.formatIso(DateTime.makeUnsafe(...)) in scripts/jones/direct-producers/finite-production.testkit.ts. The input remains predecessor epoch milliseconds plus exactly one; static comparison proves the namespace import and constructor expression are the entire delta, with all mismatch/cursor/bytes/modes/capacity/deletion-uncertainty assertions unchanged. No suppression or rule change was added. Production source blob remains 1be89bf03aef9b2b5b7f28a81b3478f1e29a82dd.

The one affected capacity regression passed 1/1 using existing Node 24.22.1, real private Git/SQLite/filesystems and the existing supplemental interpreter. Its DateTime stub lacks makeUnsafe, so a temporary in-memory loader supplied only the numeric UTC constructor for this check; that conversion was exercised once. Repository wrappers were unchanged. This does not claim configured Effect diagnostics or type safety passed locally; natural current-head CI owns those checks. Node syntax and diff checks passed. Fresh admission sampled CPU 19.80%, one core 8.33%, warning pressure, swap 1.244 MiB/s and 3,914,813,440 available bytes; one serial fixture ran within the declared 128-MiB additional allowance plus 2-GiB reserve and the existing stricter fixture storage gate. Its exact private root was removed and verified absent. No broad group was repeated.

Root supplied independent C01 SOURCE-REPAIRED confirmation at 071d002f8698e97471d48cc2bc67dd157442752c, task swl934-c01-071-independent-confirmation-20261111-r1, with no new bounded-delta findings; original PR934-CORE-4d73 / C01 P1/high/source-review binding is preserved. This fixture-only typing delta leaves that production source unchanged. Original broader concept P1s and host qualification gates remain open; C02/C03 and other deferred P2–P4 findings remain excluded. Root retains configured CI/readiness and the merge hold. No child watcher, bot, manual rerun, merge, installed-runtime or host action occurred.

Shipped supplemental DateTime harness repair b66ae31e624a881867b94c8564a534dbe8a370df (tree 03fc757b5041ab798d86469aef444375625dfb0b): predecessor 3f027d required Test job 130688914256 failed because finite-production.node-test.mjs inherited a shared DateTime stub exporting only nowUnsafe, toEpochMillis and formatIso, while the type-correct C01 fixture now calls makeUnsafe. The previous temporary verification loader did not repair that shipped CI path. This checkpoint adds the four needed UTC DateTime operations to the existing local module override map in scripts/jones/direct-producers/finite-production.node-test.mjs, including constructor validation. It changes only that harness file (10 added lines); the shared EffectSeam is untouched. C01 testkit SHA-256 remains 35d92ebd567f8bfc4af90731838f792d42e18b28fd9034c5aa901e83fe044e86, preserving prior-plus-one-millisecond timestamps and every assertion. Production blob remains 1be89bf03aef9b2b5b7f28a81b3478f1e29a82dd; independent C01 production confirmation is unchanged.

Actual shipped-path red/green: on the unchanged 3f027d harness, node --test --test-concurrency=1 --test-name-pattern='^referenced predecessor refusal advances the capacity cursor to recover 10001 records before admission$' scripts/jones/direct-producers/finite-production.node-test.mjs failed with native exit 1 and DateTime.makeUnsafe is not a function at testkit line 921. After the harness repair, the affected capacity/prune selection passed 6/6 in one invocation of the same shipped entry point, including the unchanged C01 case; its pattern was ^(referenced predecessor refusal|the advisory cursor advances|prune failure reports|9999 and 10000 records|10000 preserved files|10001 crash recovery). Neither invocation used --import or an external loader. The named passing case was deduplicated into the group. Final harness SHA-256: 5fb34cb7c0c5ff7713d70092273866dd42ef238df2665e9a9044573437bfefbd.

These checks used existing Node 24.22.1 and real private Git/SQLite/filesystems. The local shim represents only needed date operations; supplemental evidence does not qualify configured Effect semantics, scheduling, interruption, diagnostics or type safety. Syntax and diff checks passed. Fresh final-group admission: CPU 13.27%, one core 8.33%, warning pressure, zero swap, 2,782,109,696 available bytes; one serial process, 128-MiB additional allowance plus 2-GiB reserve, with the stricter existing fixture gate preserved. All eight red/group fixture roots were removed and verified absent. No assertions, timestamps, skips, retries, production, shared shim, boundary, CI or deferred-finding changes occurred. Natural new-head CI remains root-owned; predecessor Typecheck/Lint/Build/server passes are not claimed as new-head qualification. Original concept P1/host AC2 gates and root's merge hold remain open.

File map (16 task paths):

• Core: apps/server/src/jones/workspaceRetirement/ProducerFinalizer.ts, new ProducerSessionObservation.ts, new ProducerFinalizer.resolution.test.ts, and the one target reconcile call plus resolver nextAction in Runtime.ts.
• Adapter: scripts/jones/direct-producers/finite-production.ts, .test.ts, .testkit.ts, .node-test.mjs; new resolve.ts and resolve.test.ts; only build/build-exe adapter/spawner wiring in apps/server/scripts/cli.ts.
• Discovery: one relative include in scripts/tsconfig.json; additive coordination in scripts/jones/boundary/inventory.json, features.json, checks.json, and fragments/direct-producer-completion.json. Other open PR overlaps are shared-manifest coordination, not dependencies.

Source base ad37e66bf347c3ac2006471c869d4831f1fa5637 (tree 1a3df3fa7e4a24bf4e944b1ddcad55b26de87150); head b66ae31e624a881867b94c8564a534dbe8a370df; tree 03fc757b5041ab798d86469aef444375625dfb0b. Continued the assigned linked worktree and branch with the approved fast-forward only. No scratch, plans, lockfiles or generated outputs are committed. Parent owns CI, review, readiness and integration; this child does not watch, rerun CI, invoke bots or merge.

Implemented by the Sol/high/default implementation sub-agent in Jones Code through the Codex harness (gpt-6.1-sol), captured Blended Frontier Max preference rev11. codex-v3-builder TOML is generic guidance, not native role enforcement. Native task/thread: thread:delegated-task:command%3Amcp%3A45c89499-4a9b-4a79-9df2-f94ac3fef653%3Adelegate-task%3Aswl-ac2-producer-core-implementation-20261111-r1. No children were started.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}