[trissim]

Useful critical-path checkpoint

Refs #224, #206 and OpenHCSDev/PolyStore#16. Paired dependency OpenHCSDev/PolyStore#17, exact committed gitlink c16b8fc99a07f17e92e5fbf46f312d73cc9c46d7. Parent source head bf9aae462 on current main 213439a04 (merged218 included). Owner explicitly authorized extracting the already-owned cache/progress implementation into a small pair so unresolved broad source/ROI controls do not block the critical user path. Original206/16 remain intact; no competing mechanism or compatibility path.

• Existing InspectPlatePathCapability declares heartbeat5s and worker-safe offload. Existing generic binding owns progress/thread dispatch; synchronous cold inspection no longer blocks unrelated MCP reads. Truthful optional Fiji cache/download/Java side effects require mutating=True; plate contents remain read-only.
• Existing OpenHCSProcessEnvironment projects the PolyStore distribution/download-policy owners' keys through the existing McpDevServerSpec.environment path. No copied environment/default registry or full-cache sharing.
• Existing PolyStore distribution materializer keeps verified release/digest/overlay/atomic locking authority. New first-class policy prohibition allows warm reuse but rejects cold preparation before filesystem/network effects. No caller subclass/symlink/monkeypatch is required.

Usable bootstrap

Set before Python/application/MCP startup:

export POLYSTORE_IMAGEJ_CACHE_ROOT=/home/ts/.cache/polystore/imagej
export POLYSTORE_IMAGEJ_ALLOW_DOWNLOAD=false

The cache root is the parent, not the hashed Fiji subdirectory. Independent per-run XDG_CACHE_HOME and log roots remain independent. Unset cache root/download permission preserves existing defaults; invalid explicit values fail. The bundle already exists here; no copy/archive/download is required.

Actual evidence

36 passed in5.14s,2 unused-plugin-config warnings, peak RSS277712KiB, RAM14.4GiB before/13.96GiB after.14 dependency cache/policy cases +17 existing distribution cases +5 parent launch/progress/binding cases. Exact source paths verified; OpenHCS bootstrap precedes collection, existing interpreter and explicit worktree/eight-submodule src PYTHONPATH, no pip/install.

Real in-process FastMCP binding keeps canonical capability discovery responsive while controlled sync inspection remains pending on a different thread. Existing heartbeat helper terminal success/error checks pass. This is not real stdio cold Java acceptance.

Two fresh native processes, different XDG roots, actual shared859MiB bundle, production allow_download=false, identical actual Fiji/Java paths, zero new cache entries, jpype reports no JVM. No override/fixture/copy/archive/download in that proof. Reproducer: scripts/verify_existing_imagej_bundle.py. Guard had only historical swap warning; no heavyweight slot, foreign process, frozen source or science receipt touched.

Ruff passes touched child source/tests and parent tests/native proof. Both diff checks pass. Whole environment.py has pre-existing S110/BLE001 in unrelated headless exception handling, not modified. Detailed source recipe, native paths, results, resource bounds and owner review: docs/plans/imagej_cache_progress_checkpoint_20260929.md.

Essential ownership review

BOUND-1/2/6: distribution/cache and download-policy owners decode external config once into canonical constructor values. New root input is one owner decision and zero BioFormats/viewer changes. MEMB-2/3: launch projection derives dependency key spellings; no new filename/cache/default registry. IMPL-6/12/13: declaration selects the existing generic progress worker; no string-key dispatch, duplicate job/progress store, runtime fork or timeout inflation. Another suitable sync capability requires its declaration only. Strict true/false external decoding is boundary validation, not a new runtime family. Focused changed-source/catalog review, no full NRA/global proof.

Remaining live gates; preserved failures

Parent owns paired review/merge/install, then real installed stdio plate inspection + concurrent discovery/heartbeat against the existing bundle with downloads forbidden. No JVM or installation by this worker and no claim of installed readiness/Closes. Native bundle proof is not installed MCP.

Original206/16 broader result 141 passed/26 failed37.12s remains unresolved; source-supported import/bootstrap-order candidate cause is not proved repaired. The after-ROI profile did not run. Source-selection, Java lifecycle, ROI fidelity/profile and associated real Java/CZI gates remain in those drafts, not this small pair. No metadata-init semantics changed here and no scientific/uncertain call replay. Normal integration only; no rebase/reset/force-push.