[schlessera]

Closes #1935

Change

A concurrent read of the native child app's JSONL can end inside a valid append. The hosted proof now consumes only newline-committed records, validating every complete record before a predicate or count can use it. Unterminated live data stays pending; malformed complete JSON/UTF-8/events fail immediately, and any tail after child exit fails. The first pending and first failing observations retain exact bytes, SHA-256, record boundaries, phase and file state. Shutdown cannot overwrite the first failure.

Every live app-event parser and substring counter uses the same reader. Closed-stream provider-entry and alias-scan checks prevent pending evidence from hiding a violation that commits later. Original admission, health, Stop/cancellation, refresh, authority, cleanup, deadline and backend/UID assertions remain. The native proof README documents the framing and artifacts.

This changes four root harness/test/doc files. No shipped package, dependency or public contract changes; no changeset is needed. Upstream release/descendant observations, tracing, descriptor/cwd controls and the transient-reference release test are preserved.

Causal and mutation proof

The controlled same-API appendFileSync writer/readFileSync reader reproduction captured a 65,536-byte unterminated string (SHA-256 513f0946eee6adab5ba5be2b6c9b094c4d3c35edaa6308e751814a7541a3635c). The child exited 0; all 100,000 final records parsed, and the failing bytes were an exact prefix of that final file. This proves an incomplete live-observation class. Historical failing reads were not captured, so their exact bytes and low-level interleaving remain unknown.

Failing-first controls failed on partial-decimal parsing and exact first-failure-byte retention, then passed after correction. Six separate restored mutations fail the intended named assertions: NATIVE_EVENT_FRAME_BOUNDARY, NATIVE_EVENT_MALFORMED_COMPLETE, NATIVE_EVENT_FINAL_TAIL, NATIVE_EVENT_UTF8_COMPLETE, NATIVE_EVENT_PENDING_EVIDENCE, and NATIVE_EVENT_FIRST_FAILURE. A real Pi UID 1000 native mutation adds a forbidden final provider event: FINAL_CANCELLED_ADMISSION_NEVER_ENTERED_PROVIDER fails Expected 3 / Received 4; restored proof passes all 67 assertions and owned cleanup. These controls precede the relevant main refreshes; reader and unit-test blobs are unchanged.

Final qualification

Candidate 72656bb136d8026047733df8a17ed72d7f62b7e7, main d9ac37b82700d7b45406ba47c0850ae46251fa9b, tree b3766e858f3780f12106b48fe498772fec53114a.

• Frozen install, rebuild, strict types and refreshed bun run check:pr --base origin/main pass: 852 tests / 5459 assertions. The focused observer suite has 15 tests / 51 assertions, including actual child append barriers and split UTF-8.
• Automatic ready CI 38793661631, attempt 1: all 14 selected jobs and aggregate pass. All 13 execution checkout logs independently match 05c62ba1eb0ed53a4b3635996b1e941cb2819377; immutable API and local Git confirm parents main/candidate above and the same tree. The head-only contract gate passes separately.
• Browser shards: 4580 and 4228 passes, with the four/six existing pointer exclusions. Layout shards: 622 and 428 passes. All four unit shards pass; shard 3 passes all 15 observer cases. No new exclusions or failed-test retries.
• Native runtime passes four healthy Claude/Pi × UID 1000/0 cells with AppArmor enforced. Downloaded artifacts confirm first/warm phases without timeout, three provider entries, no alias scans, finished refresh ordinals 1/2, newline-complete final data, preserved authority, exit 0 without forced cleanup and no owned mount/loop/backing residue or cleanup errors. The new transient-reference release test passes. The separate namespace fault control verifies its exact intended failure, same-root recovery and cleanup with qualification: false; it is not a fifth healthy cell. Healthy cells produced no pending/failure snapshot; the controlled reproductions prove that boundary.

#1915's correction is delivered by #1979. The original failed browser run and two later complete green runs remain separately attributed in the qualification history; relevant WebSocket, tracing and release changes were integrated and requalified. Earlier evidence is not relabelled as this final tree. Issue and PR retain release milestone 0.44.0.

[schlessera]

Completed first resumed qualification

Automatic ready run 38785789263, attempt 1, passes all 14 jobs and aggregate. All 13 selected execution checkout logs independently agree on a51005f, parents cbf2bb8 / 22686e1, tree 824e93fc5282e92f474e58ae7203d2fc6443175b; immutable API and local Git agree. Contract run 38785423426 independently passes the head-only gate. Draft runs 38785397812 / 38785604388 intentionally skipped behavior and are not qualification. The draft scheduling race was resolved by a settled draft/ready transition before this full automatic run; no failed test was retried.

Browser shards pass 4580/four existing exclusions and 4228/six existing exclusions; layouts pass 622/428. All four unit shards pass, including all 15 observer cases in shard 4. Native artifact 11998507722 confirms four healthy Claude/Pi × UID 1000/0 AppArmor cells, both first/warm phases without timeout, exactly three provider entries, zero alias scans, completed post-warm refresh, newline-complete final events, preserved authority and clean shutdown/owned cleanup. The separate expected-failure namespace control validates exact original failure, same-root recovery and full cleanup; qualification remains false for that constructed negative control. No natural pending/failure snapshot occurred in these healthy cells; deterministic and same-API controls prove that class.

Main advanced during this run. #1992 changes only architecture documentation. Later #1968 changes WebSocket reconnect/history paths used by the native fixture and #1991 changes the runtime workflow/tracing inputs, so the completed first qualification is preserved separately and those relevant changes are merged before a fresh selected run. It is not relabelled as proof for the later combined candidate.

Current candidate: 3e367cc, refreshed main 74d48ea, tree 57d6b645f06f60e838837fcf1748322e4435a3d4. Build, strict types and refreshed preflight (852 tests / 5459 assertions) pass. Reader and focused tests are byte-identical to the prior qualified candidate; main-relative scope remains four files. Fresh selected hosted qualification is pending.

Completed second resumed qualification

Automatic ready run 38789821682, attempt 1, passes all 14 selected jobs and aggregate. Every one of the 13 actual execution checkout logs independently matches 0b08954, parents 74d48ea / 3e367cc, tree 57d6b645f06f60e838837fcf1748322e4435a3d4. Immutable API and local Git agree. Head-only contract run 38789823332 passes. Both browser shards again pass 4580/four existing exclusions and 4228/six; layouts pass 622/428; all unit shards pass, including all 15 observer cases in shard 3. Fresh native artifacts independently confirm all four healthy AppArmor cells, complete events/refreshes and clean teardown; the expected-failure namespace control separately verifies its exact failure and recovery/cleanup.

Main advanced with #1994 during qualification. It changes the native manager's checkpoint-release reclamation wake and adds a real transient-reference fixture assertion plus updated negative-control verification. Those are directly relevant native inputs, so this full green run remains attributed to its recorded tree and another refresh integrates that delivered correction. The merge is clean, retains all app event-log reads, and adds no event-reader source change. Fresh build/types/preflight and selected hosted proof are required for the resulting candidate.

Latest candidate 72656bb incorporates main d9ac37b, tree b3766e858f3780f12106b48fe498772fec53114a. Clean merge, unchanged four-file repair; rebuild, strict types and refreshed preflight (852 tests / 5459 assertions) pass. Automatic ready run 38793661631 is pending.