Audit final native SHA-256 review fixes and full CI

Written 2026-10-09 07:30 UTC. RE-VERIFY: Query https://github.com/CodexCoder21Organization/kompile-core/pull/385 for state, draft, head and checks; query the two Actions runs and git ls-remote before acting. This is a write-time snapshot.

Mission and remaining work

The fix385f implementation is complete. The orchestrator must review head 3949011080a063411dfd8793d09174b147426b44, watch the single full four-shard run and fat-JAR companion, then perform the final raw-XML and relative-to-main audit. Keep the PR draft; no merge, enqueue, ready, publication or deployment action was authorized. The larger prior-round findings in the historical snapshot below remain for that audit; this lane took only the brief’s two first-attempt failures and three review findings.

What was found and done

The startup-ratio test was explicitly removed by the orchestrator’s decision because its ratio of loaded child startup times was not a behavior contract. The deterministic unused-scope test remains and passed its first attempt.

Source-root’s saved first failure reached Kotlin JRT enumeration during BuildscriptCache.compileAndPublishOneScript. Its unchanged body compiled two invariant scripts on every fresh attempt. The test now declares the existing prepared source-kind artifact, verifies exact source bytes, seeds compiler state only, and asserts zero timed compilations. It retains BrokenLink → DirectoryLink → BrokenLink, all real builds, all outputs and exactly two rule calls. Its budget is the outer runner’s default 30,000 ms at src/Workspace.kt:6719, passed at line4767.

RPC’s newer saved first failure reached resolveChildNativeSha256Artifact with an active downloader at32.8s; its retry still compiled for10.603s and resolved stdlib for2.338s. A blocking external-HTTPS probe fails3/3 on the original body; local routing alone still reports one consumer compilation3/3. The declared artifact now prepares the exact unchanged inner consumer; the test uses a fresh local Maven repository and seeds only compiledTestScripts. One preparation event and zero compilation batches are required. All original6MiB bytes, [0,1,1] sends, exactly one lost response, extracted payload digest and successful child execution remain. @Timeout(30), memory512MiB and polling limits are unchanged.

Both original tests create fresh private caches every attempt and delete them in finally. Source embeds a fresh absolute path in its compilation key. This refutes assuming retry reuses compiler/test-result state. The XML does not identify the OS page-cache or origin/CDN state behind the8–14s timing difference; no such attribution is claimed. The deterministic work counters demonstrate removal of the repeated compilation independently of timing.

Loaded gate: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37896897631 — both targets10/10 first attempts,90/90 executions across nine shard-companion scripts and ten rounds, no histories or duplicates, normal tests/ directory runner with four workers. RPC12.253–13.394s; source12.886–14.354s. Raw round XML, audit script and source SHA are on the evidence branch. Counter-only cache-removal control: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37896904373 — source0expected/2actual andRPC0expected/1actual fail3/3 each, no timeouts. Focused run https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37896823990 passes3/3 first attempts including unused scope. Independent test and code review passes found no blocking issues; review artifact is linked below.

Duplicate finding: main reference runs prepared.equivalence.testPreparedValue once in shard1; prior PR head runs it in shards1and3. scripts/ci-test-shards.bash discovery already excludes the nested support script. The generator’s support copy materializes its family in another shard, where recursive runner discovery executes it. Preserving generator inputs requires a runner filter or relocation, more than the permitted one-line sharding repair; recorded for a separate PR under the explicit brief exception. Duplicate rows receive no first-attempt credit.

Rebase was a no-op on main3e5dd82b73b3c13cc9fe800cbc2fb52354d4fd0b, so incoming hunks were empty and exact tested head was retained. OPEN/DRAFT verified before source push; PR body unchanged by others, then patched only using API -F body=@file. Exact readback preserves the why-first opening and footer. Automatic CI started once: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37898794739 (four test shards) and https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37898794831 (fat JAR). Both were in progress at write time on3949011080a063411dfd8793d09174b147426b44. PR remains OPEN/DRAFT/unmerged, mergeStateStatus BLOCKED while checks run. No local watcher remains; orchestrator owns the watch.

Relevant PRs and refs

PR: https://github.com/CodexCoder21Organization/kompile-core/pull/385 . All branch heads below were verified with git ls-remote.

Branch in CodexCoder21Organization/kompile-core	Remote head	PR	Contents and state
fix/c1-native-sha256-child-jvms	3949011080a063411dfd8793d09174b147426b44	https://github.com/CodexCoder21Organization/kompile-core/pull/385	Exact tested fix; draft, full CI pending
wip/sol-fix385f	3949011080a063411dfd8793d09174b147426b44	no separate PR	Same tested source checkpoint
wip/sol-fix385f-evidence	5564fb3510332fd1c82eaa33a40b9e167b10be0d	no PR	Raw XML, audit scripts, findings, review, body and report; evidence only
wip/sol-fix385f-red	aeebc49dd4b138ea59a3b9cabd23fc45d41800bc	no PR	Original source zero-compile probe and RPC external-request probe; deterministic red
wip/sol-fix385f-rpc-red	aac972a9c5f47efc230c19b0d507a9e494af6176	no PR	RPC local routing plus counter, without prepared consumer; deterministic red
wip/sol-fix385f-mutation	73be7a15a17fbcd74c95e31cb751a135eb9819d3	no PR	Final code minus cache seeds only; deterministic red

Evidence directory: https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385f-evidence/handoff-artifacts/fix385f . Findings include the complete plan and brief ledger; review file records documents actually read. No jars, dependency caches or credentials were committed. This lane ran no publication/deployment/restart command, so no new live unmerged version exists from this lane. Prior published/deployed rows remain in the historical record below.

Next steps and reproduction

1. Watch the two full-CI runs above on the exact head; download all four raw XML artifacts and audit first attempts, with duplicate rows receiving zero credit.
2. Compare with main reference XML and the prior round’s wider findings; the ten-round gate is scoped to this brief’s two targets and is not a full-suite acceptance statement.
3. Review the source and evidence, retaining draft and the original no-merge/no-publication restrictions until the orchestrator decides further work.

For the loaded gate, recover fix385f-loaded-gha-run.sh and fix385f-audit-loaded.py from the evidence branch. The recorded command selected nine neighboring shard scripts through --test tests, not individual serial selectors; each of ten rounds created fresh children/private fixture caches. To reproduce controls, checkout their linked red/mutation branches and use the recorded targeted runner script. Launcher defaults to three attempts; all red evidence includes all three, and positive credit requires no attempt-history. The unsupported --max-test-attempts option used in the early probe was removed from later commands and contributes no single-attempt claim.

Local ownership: only workspace/fix385f-7b93, fix385f-evidence-7b93 and fix385f-mutation-7b93 belonged to this lane; all three paths were verified absent after cleanup at 07:30:39 UTC. No local build ran; their exact corresponding local cache paths are also absent. All bounded targeted watchers completed and all review invocations finished. The lane claim was released successfully; the broader handoff stays active for orchestrator review and final CI audit.

Prior snapshot retained as dated history

---

id: hf-2026-10-08-finish-native-sha-256-review-fixes-and-final-verification url: url://handoff/handoffs/hf-2026-10-08-finish-native-sha-256-review-fixes-and-final-verification title: Finish first-attempt regressions and B1 comparison for the native SHA-256 draft summary: Audit the remaining two full-suite shards and resolve seven saved failure causes plus B1 duration findings. The open draft at4aab0f002 has611full-suite first-attempt passes with no histories, three12-test first-attempt gates and8native contract passes. Source/evidence are pushed and owned cleanup is complete; keep draft and do not merge or publish. created: 2026-10-08T22:12:13.619Z completed: null dependencies:

Finish first-attempt regressions and the B1 comparison for the native SHA-256 draft

Written: 2026-10-09T05:04:30.351414+00:00

RE-VERIFY: Query https://github.com/CodexCoder21Organization/kompile-core/pull/385 for OPEN/DRAFT/head; query the Actions runs below and remote branch SHAs before acting. The Round e execution is stopping at its85-minute limit; the owned watcher has been stopped. Acceptance remains incomplete; this is a checkpoint, not a completion record.

Mission and remaining work

Carry out briefs/fix385e.md: compare first attempts against main, diagnose and fix the eight saved failures at cause, prove three first attempts, update the draft body, and audit four-shard CI. Keep DRAFT; no ready, enqueue, merge, publish or deploy. Seven saved full-shard causes and the wider B1 duration findings remain unresolved. No user answer or approval is needed for the remaining diagnosis.

Verified current state

PR https://github.com/CodexCoder21Organization/kompile-core/pull/385 is OPEN/DRAFT at 4aab0f0028c4944732bcf3f5d89b167fff192c40. Source was rebased on main 3e5dd82b immediately before pushing. No source changes followed the targeted gates. Fat-JAR CI https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37884311978 succeeded. The four-shard run is https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37884311977 has completed shards2and4 with611first-attempt passes, zero histories. Their600shared tests have19over20%,581within20%;11new. Raw XML and partial B1 are on evidence. Shards1and3are still running. The aggregate bld-all-tests check is emitted after the shards; a watcher warning about its absence while all shards are running is not proof of a lost dispatch.

Baseline first-attempt comparison: PR22b run https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37875304611 has1221 XML records,1220 unique identities,14retry-only. Main7de0729d reference https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37331069611 has1202 unique identities,8retry-only. Among1202shared tests,341first attempts exceed main by20%,861are within20%. Half-limit table112rows:30over,81within,1new absentmain. The complete table is quoted in the PR body. Corrected brief premise:7existing pass→retry regressions plus1new streamed retry-only test, not8existing regressions. Main successes provide durations without stack/console, so there is no main stack comparison to invent.

Proven causes and changes

1. Collision fixture: stable repository lacks the Conscrypt POM/classifier when initialized in isolation. Clean-worker original test fails all3default attempts (first2.153s): https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37881275202. Added scenario helper artifact and seed nativeSha256RepositoryFiles under the existing lock even when.complete exists. All assertions/limits preserved. Three isolated fresh-worker first attempts pass: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37881777375 , https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37881777848 , https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37881777110 .
2. Native initialization: NativeSha256Scope.open eagerly created the complete Conscrypt provider before any digest request. Public paired startup contract failed all3attempts (example0.628s without agent vs0.828s with it); empty-classifier unused-scope test also fails all3against old code. Initialization now occurs at first factory call under the same monitor as close. Registration, aliases, ownership, retained engines and exact closed rejection remain intact; first-use initialization errors remain visible. Paired startup flips to0.617s vs0.698s (+13%). Added public unused-scope, paired startup, initialization-failure and32unprimed-factory/close tests.
3. Native build input: Java-only edits reused the old cached embedded agent. buildBootstrapResourcesJar now declares nativeSources File input and passes it into the Java builder. A warm-cache proof changed only Java provider metadata and its public assertion while build.kts stayed unchanged; the embedded archive exposed the exact new metadata. The experimental patch was restored, and its XML/patch remain on the evidence branch.

All8requested selectors plus4new tests pass3separate clean-worker partitions,12/12 first attempts each, no histories: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37883348039 , https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37883349759 , https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37883351637 . Native contracts pass8/8first attempts: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37883352225 . Independent review found the first-use/close coverage gap; the new unprimed race test closes it. No runtime defect was identified by the two review passes.

Seven unresolved saved failure paths

• operation count: nested20s plain-Java helper bound; cold15.570s plus warm launches exhausted it. That helper has no agent/C1 arguments.
• source-link: BuildscriptCache.compileAndPublishOneScript inside the test body.
• RPC: submit worker actively compiling selected Kotlin test scripts while main waits for completion.
• regular source creation and corrupt output: waiting for build children; prepared zero-definition/command-compile assertions retained.
• compiled dependency: captureClasspathEntry/canonicalize0.
• streamed input: outer120s, not30s;64fresh scopes,16rounds,4functions,256MiB streaming,128engine cycles,32MiBheap; unchanged workload and bounds.

These classify observed paths, not established causes. The brief's nearly-all32second-premain premise is refuted by the saved stacks. Unchanged7-test baseline https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37881135595 passes7/7first attempts. That does not explain full-shard failures or establish contention.

Gate shape matters: separate file selectors execute serially through the legacy per-spec loop; directory execution defaults to4workers on both reference main and PR. Thus36targeted first-attempt passes do not prove full-directory acceptance. First directory experiments https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37885693798 and https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37885694271 executed zero tests because .gha-run/selected-tests was rejected as an unmatched selector. Corrected worker-only staging moves top-level unselected scripts aside after helper build, puts the7selected scripts back under tests/, and selects --test tests: old https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37886140028 , new https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37886141080 . Both corrected runs were cancelled at their7minute deadlines without complete XML; no cause or test verdict is established. Cancelled logs are preserved. Check raw XML actual counts: two nested test.kts fixtures remain in the tree and may also be selected. Do not treat zero tests or cancelled experiments as test successes.

Relevant PRs and refs

Repo	Remote branch	Verified head	PR / state	Contents
kompile-core	https://github.com/CodexCoder21Organization/kompile-core/tree/fix/c1-native-sha256-child-jvms	4aab0f0028c4944732bcf3f5d89b167fff192c40	https://github.com/CodexCoder21Organization/kompile-core/pull/385 OPEN/DRAFT	combined source,36targeted+8native first-attempt passes; full4shards pending
kompile-core	https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385e	4aab0f0028c4944732bcf3f5d89b167fff192c40	same draft	source checkpoint, same code as PR
kompile-core	https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385e-evidence	7cc62dcd933bb4df2091fa3fa5d5eed97b0bd1f9	no PR; evidence only	B1 script/table/numbered findings/retry sets, first stacks, raw targeted XML, local red/green proofs, review, challenge, helper scripts
kompile-core	https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385e-collision	9e3b0e7e15f8a88764b29a4776456441a179cd0f	integrated into draft	isolated collision fix and gates

Nothing was deployed or published. Work log contains only source changes, test experiments, read-only GitHub checks, checkpoint pushes and draft-body updates. No ready/enqueue/merge command was issued.

Next steps, in order

1. Audit the remaining Actions runs from raw XML, including every attempt-history. Download artifacts from full run37884311977 with gh run download --repo CodexCoder21Organization/kompile-core into an owned directory. Do not rely on green final results.
2. Run evidence b1-table.py on final4shards vs reference main. If reference XML is unavailable, download all4artifacts from37331069611. The script is proven on the original local trees. Record final first-attempt counts and every >20% or pass→retry finding.
3. Diagnose the seven saved paths and any new failures using genuine public concurrent callers or deterministic exact-condition triggers. Preserve all limits, iterations, workloads and assertions. Do not infer contention just from concurrency or CPU ratios; no artificial load and no speculative timeout/fixture patch.
4. Fix only reproduced causes, then3fresh first-attempt gates and independent test/code review. For new native Java edits the declared input proof is already established; verify rather than repeat the cache diagnosis.
5. Before every build rebase latestmain; before every push read out/fix385e-decision.md and verify draft is stillOPEN. Source must stay draft. Body only via gh api PATCH -F body=@absolute-file and exact reread, why-first opening/footer preserved. Use tracked plain build-watchman with a hard deadline; stop owned local processes on exit.

Operational knowledge and durable evidence

Evidence is https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385e-evidence/handoff-artifacts/fix385e . Findings are incremental; use git add -f because repository ignore patterns otherwise omit findings files. No jars, build output or dependency caches are committed. Full original CI XML remains obtainable from linked Actions artifacts; extracted first failure stacks and detailed table are on evidence. Helpers use <=4concurrentActions partitions and bounded local mkdir slots. rg is unavailable; grep/find works. report-challenge CLI autoenqueues/merges, conflicting with no-enqueue/no-merge; the native-input challenge is stored on evidence instead of invoking that tool.

Fresh owned checkouts were source fix385e-20261009, evidence fix385e-evidence-20261009, delegate fix385e-collision-a7d31c, baseline fix385e-parallel-old-20261009. Cleanup must remove only these exact trees/caches after remote verification, with evidence worktree removed before parent source clone. No user approval is pending. One delegated invocation completed fixture work, independent review and first-factory/close test; no more work is expected from it.

Prior snapshot — historical

Finish the native SHA-256 review fixes and final verification

Written: 2026-10-08 UTC.

RE-VERIFY: This is an in-flight snapshot. Recheck https://github.com/CodexCoder21Organization/kompile-core/pull/385 with gh pr view --json state,isDraft,headRefOid,statusCheckRollup; recheck both remote branch SHAs with git ls-remote before acting. A fresh query wins over this document.

Mission

The user asked to carry out briefs/fix385.md: close B1/B2/S1–S6/N1 on the existing draft C1/native-SHA-256 pull request, finish targeted proof and final-head CI, and stop before ready/enqueue. The delegated session must stop new work at its 85-minute checkpoint and finish within 90 minutes. The task remains incomplete; no permission to ready, enqueue, merge, publish or deploy is implied.

What was found and done

1. Fresh checkout at the requested original PR head 3dde5d09a8ee2e22f31320cd485d68bae9701e29, rebased conflict-free onto main 3e5dd82b. The pin remains 0.0.112. Incoming main staging-parent changes did not change the native agent or generated runner.
2. Confirmed the exact B2 mechanism: generated TestRunner content participates in the test-script cache identity; 33 old runner JARs across 31 fixture families force compilation inside timed consumers. The ReadyClose zero-compilation assertion failed before regeneration in 23.208 s: Precompiled fixture in testPreparedBatchReadyCloseCancelsSiblingAdmission.kts caused 1 test-script compilation batch(es). Full trace is preserved in the evidence branch.
3. Added a durable generator with --check and manifests, corrected collision preparation, and added zero-compilation checks to all 41 precompiled-fixture consumers. Fresh staging passed in 28.817 s and installed 37 families. Independent scan found 45 runner JARs and zero missing the current childHashingProvider marker. This inventory scan does not substitute for the pending public GREEN checks.
4. Independent review caught two vacuous checks: legacy and closed-batch probes only prepared/closed, so deferred Work effects were never observed. Both now execute harmless public probes, assert exactly one Work event with zero compilation, and close workspace/batch resources. Existing closed-state/resource assertions remain intact. The complete follow-up audit found no third such consumer.
5. Drafted native repository, lifecycle, replacement/loader/factory/concurrent-close, startup collision, five-platform preparation, and streamed-scale tests. These native tests have not run. Scale now covers 64 legal independent child scopes over 16 fresh closed batches, retaining 256 MiB streaming under 32 MiB and fixed FD/thread checks. A second premain in one JVM is expected to reject under the one-scope-per-child contract; no same-process reinstall defect is claimed.
6. Product source changes remain unapplied. Full proposed patches for repository routing/fixture wiring, shared classifier table, rationale/comment, and temp-agent-JAR cleanup apply in an isolated preview; static application is not gate credit. Read the inventory, preview and resume notes before using them. Some committed fixture helpers require build-resource wiring that is still only drafted; this source branch is not verified as a whole.
7. Orchestrator S2 is refuted for normal build outputs: buildBootstrapResourcesJar hashes bootstrap entrypoint+fat runner+native agent bytes and extraction uses that combined hash. Changed agent bytes cannot keep the normal output's extraction identity. A hand-edited mismatched resource/hash bundle is not evidence for a product change.
8. Shared build slots consumed repeated waits. The latest generator --check and named trio state is recorded in the final report below; no slot was cleared or bypassed. No new PR-branch push or final-head CI run occurred during this partial session.

Relevant PRs / refs

Repository / purpose	Branch and verified checkpoint	PR
kompile-core source	https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385 — 2881f51505c010fbac4d6a16396a2552d68e32da	https://github.com/CodexCoder21Organization/kompile-core/pull/385 remains draft at original 3dde5d09a8ee2e22f31320cd485d68bae9701e29
Logs, drafts and resume material	https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385-evidence — prior verified checkpoint 03249fad3899211deb8c0b2dc9df62415e2e791b; branch HEAD receives this terminal report	No PR; evidence only

Nothing was deployed or published: the command/work log contains only source changes, local targeted test commands, read-only GitHub checks and WIP pushes. No deploy, publish, ready, queue or merge command was issued.

The existing PR head's CI run https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37833615163 passed 1207 tests: 1197 first-attempt and 10 retry-only. Main baseline https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37331069611 passed 1202 tests: 1194 first-attempt and 8 retry-only. These are historical heads, not new-WIP verification. Packaged measurements remain 1.372 s hashing / 10.354 s compilation with all 24 workers first-attempt in https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37804321182.

Remaining steps

Re-verify current state first. Then follow the exact ordered commands and caveats in the linked evidence branch's handoff-artifacts/fix385/out/fix385-resume-notes.md. Complete B2 --check and the exact three named consumer GREEN/timings before S1 RED. Continue S1 sealed resolution, S3 hostile-caller/mutation proof, S4 portability/scale measurements, S6 documentation/temp-file cleanup, independent reviews, one PR-branch push and bounded --all-checks watcher. Produce B1 from final green XML; correct any >20% existing-test first-attempt regression or new retry-only regression at cause. Update Validation only via the prescribed gh api body-file PATCH and reread length; leave draft.

Do not discard the original reliable RED or claim current-run results from stale prior log files. Unique labels and fresh XML timestamps matter. Do not invoke the unrelated challenge CLI's auto-merge flow under this lane's no-enqueue/no-merge rule. The current create-handoff service flow takes precedence over the older PlanRepository handoff README's legacy merge instructions.

Baseline flakes on main (separate work item kcflakes)

The brief expressly excludes these baseline first-attempt failures: testExplicitBuildFailureKeepsFailedTestInResultsAndXml 32.237 s; testExplicitDirectoryKilledAttemptRecovery 32.243 s (later 26.030 s); testResultIndexPreservesObservableWorkspacePath 32.510 s; testExplicitBuildPrimesTestDependencyResultCache 32.502 s. Recovery's first attempt is the same row, not a second logical test. No limits, iterations or these test bodies were changed.

Reusable knowledge

Each scripts/test.bash or build.bash command needs a prescribed shared slot, 30-second retry and 20-minute maximum wait; release the acquired slot immediately on exit. Keep commands tracked and bounded, and stop only owned processes. All source is on WIP; drafts/evidence are on a separate evidence branch so they need not enter the eventual PR diff. The next invocation should clone fresh under its own workspace path, restore the evidence files into its scratchpad, and adjust their embedded paths before use. README custom-repository and generator sections, Testing, Philosophy, Code Review and the linked original review evidence were read for this effort.

Terminal report

fix385 — TIMEBOX STOP, INCOMPLETE

Written 2026-10-08 22:12 UTC. Source checkpoint: 2881f51505c010fbac4d6a16396a2552d68e32da, https://github.com/CodexCoder21Organization/kompile-core/tree/wip/sol-fix385. All source changes are durable there, but this combined head is not verified. PR https://github.com/CodexCoder21Organization/kompile-core/pull/385 remains OPEN/DRAFT at 3dde5d09a8ee2e22f31320cd485d68bae9701e29; no PR push or body update occurred.

Finding	Disposition and evidence
S5 generator	Implemented durable generator, manifests, atomic installation and README recipe. Staging GREEN 1/1 in 28.817 s; installed 37 families. Consistency --check still UNRUN.
B2 stale runners	Public ReadyClose RED before regeneration, 23.208 s, full trace in fix385-ready-close-red.log/XML: Precompiled fixture in testPreparedBatchReadyCloseCancelsSiblingAdmission.kts caused 1 test-script compilation batch(es). Added public zero-compilation probes to 41 consumers; independent bytecode scan 45 runner JARs, zero stale. These are not consumer GREEN.
B2 final checks	Check-2 exit 124: PROBLEM: no build slot within twenty minutes; no build started and no XML verdict. Final retry stopped for timebox. Exact three consumer GREEN/timings remain pending: ReadyCloseCancelsSiblingAdmission, ReviewAdmissionPreservesLegacyStartEvents, ReviewRetryBatchBlockedAdmissionAllowsOtherWorkers.
S1 resolution/sealing	Public repository RED test drafted but UNRUN. Fixture additions committed, resource wiring and product resolution patch unapplied. No defect fix claimed.
Orchestrator S2	Refuted: resource hash already includes entrypoint, fat runner and native agent bytes; extraction uses combined identity. Changed agent bytes change normal extraction identity.
S3 ownership/lifecycle	Invariant table and public success/failure/interruption, replacement/loader/factory/concurrency/collision tests drafted, UNRUN. Failure-only omission and ownership mutations pending. Historical upfix3 all-finally omission RED is preserved, but does not prove narrower failure-only mutation.
S4 portability/scale	Five-platform local preparation test and shared-map patch drafted, UNRUN/unapplied. Scale test drafted: 64 independent child scopes, 256 MiB streaming under 32 MiB, fixed FD/thread bounds. No measured scale result. Same-JVM second installation is unsupported by existing one-scope-per-child contract.
S6/N1/temp-JAR nit	Comment/rationale/temp-file cleanup patch drafted and statically composed only. Final Validation rewrite pending final-head verification; original body unchanged.
B1	Final-head relative table unavailable: no final-head CI XML exists. Comparator draft and main baseline preserved. No claim that >20% regressions are resolved.

CI on the original PR head: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37833615163, 1207 passed, 1197 first attempt, 10 retry-only. Main baseline: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37331069611, 1202 passed, 1194 first attempt, 8 retry-only. These historical results do not verify the WIP head. Packaged historical measurements: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37804321182, hashing 1.372 s, compilation 10.354 s, 24/24 first attempt.

Baseline flakes on main (separate work item kcflakes)

Main first-attempt failures: testExplicitBuildFailureKeepsFailedTestInResultsAndXml 32.237 s; testExplicitDirectoryKilledAttemptRecovery 32.243 s (later 26.030 s); testResultIndexPreservesObservableWorkspacePath 32.510 s; testExplicitBuildPrimesTestDependencyResultCache 32.502 s. Recovery is one logical row. No limits or iterations were raised or reduced.

Resume from fix385-resume-notes.md and the handoff. Complete B2 check and exact three public GREEN gates first, then the remaining ordered task. Product scripts and combined patch are UNAPPLIED drafts; committed fixture helpers still need resource wiring. No ready, queue, merge, publish or deploy action occurred. No other lane's processes or build slots were changed.

Service handoff: url://handoff/handoffs/hf-2026-10-08-finish-native-sha-256-review-fixes-and-final-verification

Final cleanup: check-3 exited143 on owned-process termination before acquiring a slot; no build ran. The original owned checkout was removed at22:11:58; all source is remote. Evidence-only recovery checkout is removed after its push.

Final evidence checkpoint verified after terminal artifact push: 0a742fa044ed71278480da38a849456bf74ff332 — https://github.com/CodexCoder21Organization/kompile-core/commit/0a742fa044ed71278480da38a849456bf74ff332

Round e cleanup verified 2026-10-09T05:05:19.127957+00:00: all four owned checkouts and exact cache entries removed. Owned watcher stopped; experimental runs cancelled and throwaway refs deleted. No active delegate remains. Automatic PR CI continues. Final evidence checkpoint is7cc62dcd933bb4df2091fa3fa5d5eed97b0bd1f9.

fix385f checkpoint 2026-10-09 07:14 UTC

The focused fixed test run passed all three tests on first attempts, with no attempt-history: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37896823990. The cache-removal control fails both exact compile-count assertions on all three attempts, without timeouts: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37896904373. Ten-round loaded partition is still running: https://github.com/CodexCoder21Organization/kompile-core/actions/runs/37896897631. Independent test and code reviews found no blocking issues. PR source branch remains at the original head; checkpoint source is 3949011080a063411dfd8793d09174b147426b44.

Updated evidence branch: wip/sol-fix385f-evidence, remote head d8a78fe78 (full SHA available via ls-remote), includes raw control/focused XML, complete findings, review and draft body. Control source: wip/sol-fix385f-mutation, 73be7a15a17fbcd74c95e31cb751a135eb9819d3. Source fixes: wip/sol-fix385f, 3949011080a063411dfd8793d09174b147426b44.

Next: audit ten-round XML for first-attempt success, fetch/rebase, check OPEN/DRAFT, push tested head to existing PR and patch body through API; record one full 4-shard + fat-jar CI run, update this handoff, release lane claim and delete owned checkout/cache. Orchestrator watches and audits full CI. No publish/deploy/merge/queue/ready action.