[Mjones13]

Deferred before-pair instrumentation stopped observing when the helper entered launch, losing the LaunchServices reply and any subsequent validation result. Retain the existing quiet-state comparison and capture two exclusive, bounded, hash-linked records: the LaunchServices return and the helper's launch identity or finite unproved category. The reply survives later validation failure. Duplicate observations or post-effect recording failures leave failure evidence without replacing the helper's result or exception. No launch request, environment, options, signalling or product helper source changes.

readLaunchObservation() validates transaction/protocol/source bindings, the protocol-3 continuation and dispatch claims, quiet-state and pre-launch links, ordering, exact reply paths/PID, and returned birth identity. It rejects missing, conflicting, illtyped, unsupported or subsequently mutated evidence and returns immutable observations. assertNoRelaunch() also requires all new records absent. Direct-intent instrumentation remains compatible; this additional capture/read path is deferred before-pair only.

This is the accepted receipt-only fallback. The existing external observer cannot acquire custody of a launchd-born tree before effects. No deferred successful exercise mode is added to packaged-desktop-pair.mjs, and neither its storage observer nor NativeFixtureOwnership changes. Every new observation reports activationAllowed: false, externalDescendantSettlementRequired: true, and no matrix pass.

Held integration capsule: before enabling a real relaunch, a native observer must register the original app's kernel exit watch and establish creating-layer, root-owned custody before LaunchServices effects. It must bind the exact helper, original-app exit, reply and new kernel birth, cover the entire external born tree including additional helpers/backends, and retain every hold on missing/unknown births, callback failure, cancellation or incomplete closure. Release requires proved app/helper/tree closure and complete group/port/label/mount/process settlement. A returned PID, helper process group, launch identity, NewInstance option, port scan or custom userData directory supplies none of that proof. Native isolation and protected-store authority remain held; this source slice does not resolve them.

Validation:

• Cheap failing-before at base d68c5fcd65a4249b93a742fe5af1c96cd776d3fa: after a synthetic launch-validation exception, reading launch-services.json fails ENOENT. Passing-after retains its reply and a finite launch-validation-unproved result while preserving the original exception.
• Final serial affected union: 67 passed, zero skipped across packaged-desktop-helper-fault.node-test.mjs, packaged-desktop-pair.node-test.mjs, native-fixture-support.node-test.mjs, and native-startup-fixture.node-test.mjs. Includes existing test(updates): preserve custody during normal Install refusal #944 protocol-3 binding and root-owned scratch-custody regressions. New controls cover successful returns, service exceptions/refusals/unavailability, duplicate observations, recording failure, absent records, malformed/stale/path/birth/order relationships, later mutation, and no-relaunch absence.
• Strict Jones boundary validation: zero violations, existing 12 source-bound unsupported dispositions retained. Pinned TypeScript 6.0.3 parser used through an external temporary resolver.
• Pinned oxfmt 0.74.0 and git diff --check pass. Standalone checks use the verified real Node 24.22.1 executable and existing portable Python controls; repository dependencies/full app build/Node 26.12.1 toolchain were not installed or run.
• Fresh same-host CPU/RAM admission before each producer/check; serial tests only. Tiny synthetic fixtures are reaped before exact-root removal and verify absence. External check tooling uses cleanup-owned disk scratch with a 512 MiB peak budget and 30 GiB reserve.

No macOS app, LaunchServices, registration, native relaunch, installed service, real profile, keychain, signing, permission or protected-store operation was executed. Native acceptance remains unexecuted. Coordination, independent review, CI watching and any qualifying merge belong to the root; this implementation child does not watch or merge.

Implemented by gpt-6.1-sol (high reasoning, default tier, no Fast) through the Jones Code Codex harness as a prompt-only implementation sub-agent; no enforced-profile claim.

Delivery: required Check passed at ff5d7ecb4dd28b42de02d47dd62d3986a9c91a95 in run 43215149880, attempt 1. One scoped Sol/max independent source review completed with no findings; no GitHub review was submitted. Normal expected-head merge completed as 48fa5f83c1601f9f2144882819520c205006acef; both parents and canonical main/tree were directly verified. The base advanced through unrelated settings UI changes before merge; the merge contract was unchanged. Native acceptance, protected-store isolation and pre-launch external custody remain held.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}