[trissim]

Working source checkpoint for #251

Explicit typed owned-runtime bootstrap, same-handle observation and exact-owned
close through existing declaration-derived MCP/CLI, RuntimeServerService,
ExecutionConnectionSpec/config, launch-plan and native lifecycle owners.
Path admission precedes any native materialization/spawn. Resolved effective
transport is retained in the typed PID+creation-time handle. No implicit attach/
replacement, catalogue warmup or source dispatch in bootstrap; no replay.
First-use/custom guidance preserves QA and context bounds.

Paired ZMQRuntime PR9 at
112c240464df6e81c25b0f97d2b1376d43bbbbc8, production0ca331a. Recorded and
working child match; published child was verified BEFORE gitlink adoption.
Normally integrated OpenHCS main c42d9bf at5b330a7b3e; native contains
viewer main2aa6d21c/ACK3374 and parent viewer pin2c68. ArrayBridge409,
metaclass-registry448cdf0 noncreating cache projection, PolyStore1209068 and
remaining recorded dependencies unchanged. No installed package/skill change.
Parent owns merge/install/actual affected entrypoint acceptance.

New concrete source correction after account-switch resume

Ordinary TCP connect() could kill port owners after failed attachment BEFORE
checking pair startup reservations. Existing tests mocked occupancy false and
missed bind-before-ready. Fix reuses TransportEndpoint.has_live_startup_owner
under both held locks before takeover; healthy attachment stays allowed.
Original records/inodes, exact ProcessIdentity and post-spawn UNKNOWN remain.
Only native client.py/test_owned_startup.py changed; no ACK/config/transport/
message/viewer/waiter or parent PR215 production edits.

Six pre-fix intercepted-kill failures preserved (both reserved addresses,
live/unknown liveness, malformed records). Initial mis-cased submodule-path
assertion failure preserved, not counted as full path proof; corrected all-nine
source paths verified before reproducing the same six failures.

197 source cases PASS5.39s, zero skips/deselections; process6.20s/
264612KiB RSS/exit0 under30s bound. Existing Python3.12 -B, explicit own
root+eight child src paths, thread1, shared Fiji cache/downloadfalse. No
native/MCP/JVM/GUI/science/provider or validation-slot use. Original locks/
records are real; process/network boundaries and visualizers are controlled.
Original packaged native-root ratchet2aa6d21c->0ca331a: PASS188 metrics,
no positive deltas, client excess delta-1,4.79s/47992KiB/exit0. Existing debt
remains; not full NRA/R1/all-detector, global ZIP, performance or live proof.
Exact source checkpoint, tests and remaining gates.

Coherent production ownership already in this feature

• Both canonical address locks and pre-bind reservations; provisional no-child
  rollback only under both locks using exact original owner/inode. Partial,
  changed, child and post-spawn ownership never cleared as an assumed failure.
• Effective config-owned transport decoded once; admission/plan/start/observe/
  close derive the same nominal route. No copied global default or mode switch.
• Existing admitted launch plan owns materialization/process policy; existing
  bootstrap state derives observations. Replaced service/client procedures
  deleted, not forwarded into a new god-class/mixin/store.
• Exact-owned FORCE requires both reservations and incarnation-bound native
  admission before worker mutation. One request, original bounded TERM/KILL/wait;
  listener disappearance alone is not process exit. GRACEFUL clears workers and
  intentionally retains the server. Unknown outcomes retain the original handle.
• Existing endpoint owns pair/discovery; shutdown operation owns single dispatch
  and completion; transport mode owns close admission. No duplicate lifecycle.

Applicable catalog review IMPL-12/13, IDEN-8, BOUND-2 and AGENT-6 has concrete
owner/new-case witnesses in linked receipts. Original root5159-metric pass
7d0ce5->9cb7703 (-42 client, zero positive) remains at that exact source, not a
fresh c42d claim. Parent's earlier paired-native +142 failure remains retained;
introduced growth subsequently closed through existing owners, not waived.
Historical complete source/pattern evidence.

Actual native evidence is partial, NOT full acceptance

Attempt01 registered successfully then returned known immutable-input path-policy
refusal; no compile/execution submitted. Supported exact close terminal.
Attempt02 bootstrap0.052s, preparation92.206s job (ordinary10s observations),
registration0.257s, BioFormats artifact-plan6.568s and compile6.840s succeeded.
Execution FAILED at reduced fixture promising complete-stack lineage; no guard
weakened or product defect inferred. Exact close0.587s/PIDs absent, artifacts
retained. Correct projection fixture subsequently merged in test-only PR272.
Attempt03 interrupted during preparation on critical resource guard; ZERO
registration/compile/execution. Original exact close233ms/terminal proof retained.
No fourth attempt, original source-bearing call replay or installation.

Remaining: successful valid-volume full/reorder/reduced/singleton first/chained
compile/execute and strict durable image/label/CSV/all five source-address/ROI/
primary+named projection inventory; cross-process uncertainty; parent paired
integration/install and affected installed-entrypoint acceptance. Resource warning
and Fermat science-slot ownership prohibit a new worker runtime here. References
#251 and #257, not Closes. No hosted-CI waiting gate added.

Parent owns PR215 main-flow/primary_objects/diagnostics and ACK issue10;
no overlap. Broader sept2026refact author remains unknown; no agreement assumed.
R0/L0 landed but S1-S8 incomplete; BLOCKED S1 remains blocked. Original pause,
attempts/UNKNOWN and protected installed c42d/skill remain untouched.

[trissim]

Parent source review found a concrete pre-spawn reservation leak in pinned ZMQRuntime 9a93bbe. Controlled original-budget expiration immediately after both provisional invoker reservations gives TimeoutError with zero spawn calls, but both real fixture lock records still reserve the live invoker; a new independent startup then rejects the existing owner. Reproducer: /home/ts/wt/openhcs-issue-batch-20260929/REVIEW-256-PREBIND-REPRO-20260930.py; receipt pr256-prebind-review-20260930/receipt.json, source-only exit0/0.175s, no sockets/native/MCP/GUI/Java/OS signals. Existing implementation owner Lovelace has been assigned a fresh distinct source-only correction on the existing paired PRs. Required boundary: rollback only proved pre-spawn provisional ownership under the original held locks; preserve child/post-dispatch uncertainty and never unlink a flock inode or replay startup. Add expiry-after-reservation and second-publication-before-spawn controls. This is a review defect, not installed/live acceptance; frozen blind installation remains untouched.

[trissim]

Independent source review of exact head 9438985 found a concrete effective-transport mismatch (Lovelace remains implementation owner; no competing patch).

Reproducer against this worktree plus its eight recorded dependency src paths, existing Python 3.12/-B/thread limits1:

connection = ExecutionConnectionSpec(host="127.0.0.1", port=5968, transport_mode=None)
projected = connection.transport_endpoint()
client = connection.execution_client(OpenHCSZMQConfig(transport_mode=TransportMode.TCP))
assert projected == client.endpoint

Actual result: projected IPC, client TCP, equality false; exit1 in2.37s within15s shell bound. ZERO native/MCP/GUI/socket bind/connect/ping, launch-plan materialization, provider/install/scientific operations.

start_from_request checks locality against the platform-default projection but launches the configured client and preserves the unresolved connection in the handle. observe_bootstrap projects that unresolved connection again, so it can ping a different transport. Admission must also inspect the effective endpoint, since IPC and TCP locality contracts differ. This is a source-confirmed resolution mismatch, not a claim that a native unauthorized launch occurred.

Required destination (BOUND-2/TIME-7): resolve effective transport once through the existing nominal connection/configuration owner, preserve that exact identity in the handle, and derive admission/spawn/observe/close from it. No new registry/default mirror/mode switch/launcher. Add behavioral cases for omitted mode + nondefault configuration (TCP/IPC), explicit overrides, effective local admission before writes/spawn, and start/observe/close route sameness. Retain original incarnation/provenance guards. The current source tests exercise explicit modes and do not establish this omitted-mode contract.

Parent durable authoritative receipt: /home/ts/wt/openhcs-issue-batch-20260929/BOOTSTRAP-TRANSPORT-REVIEW-20260930.rst. Direct defect/ownership request delivered to Lovelace. Critical swap16.4GiB still prevents a new heavy/native blind allocation; no live acceptance claimed.

[trissim]

Parent independent correction review at82d120a29504e189ca054425b49bbf457f52c46f: source imports use this tree and its recorded ZMQ28d9ed6/metaclass448cdf0 pins. All48 actual focused bootstrap/endpoint-projection source checks independently PASS3.99s, zero skips/deselections, bounded15s; two warnings are disabled asyncio-plugin options. Startup, nested handle decode, configured-mode/locality and observe/close tests execute the real source owners with spawn/network/shutdown intercepted, not installed/native acceptance. Parent XML is retained in the persistent issue-batch ledger.

The original unchanged parent witness now passes actual observation and explicit IPC, but retains the no-config endpoint-comparison failure. That one compared canonical configuration projection with a different injected configuration never supplied to the first call. A separate parent-owned configured follow-up (check_bootstrap_effective_transport_configured.py) supplies the SAME original config, inherits the unchanged observation/explicit-override assertions, and covers all six configured/requested mode combinations plus exact data/control URLs and input immutability:3 testsPASS0.012s. No expected endpoint change, TCP-global override, hidden cached config or weak assertion was used. Original diagnostic and failure remain intact.

Existing OpenHCSZMQConfig.client_endpoint now owns default/override policy and typed produced handles retain resolved mode; this fixes the reviewed routing defect. It does not waive the reported own-PR structural remainder (+8 client/+15 service GodClassExcess), broader guard obligations, cross-process uncertainty or installed/live journey. Lovelace remains sole bootstrap implementation owner, with no parent runtime edit. Dirac ACK-private startup checkpoint PR11 has independently merged as ZMQ main3374aa8; issue10 delivery/live work remains OPEN, and this branch’s ZMQ9 pin is not changed by that merge. No optional hosted CI wait is imposed; remaining architecture/live boundaries are concrete, not CI delay.

[trissim]

Independent parent owner-factoring review of0c03066891a973787b99aa351a5185fc8b55be09: all100 focused bootstrap/launch/projection source casesPASS4.55s, zero skips/deselections, bounded15s; original launch/observation decision bodies are deleted from their consumers and owned by the already-existing plan/result declarations. Source Popen/network/shutdown intercepted; no native/installed acceptance.

The expanded paired dependency review finds a concrete remaining guard issue in pinned ZMQRuntime9: original packaged ratchet src/zmqruntime, main0f9e840→28d9ed6,179 metrics, one positive delta ZMQClient GodClassExcess +142. OpenHCS own-root pass does not cover that source dependency. Native owner Lovelace has exact evidence and remains sole editor; parent creates no competing patch. Preserve native lock/reservation/process identity/uncertainty semantics while closing real ownership growth, not relocating it to a helper for the metric. Native review is posted on PR9. Fresh main4a9c9b3 additionally contains merged preparation-refill PR279, to integrate normally at the next coherent checkpoint.

Original attempts and failure diagnostics remain preserved. No hosted CI wait imposed; meaningful remaining work is paired architecture and source-aligned actual native/installed workflow, not another status handshake or another biological replay.

[trissim]

Parent integration checkpoint published to this existing PR, not a competing implementation. Current main992a479b1 normally merged at ac9456f; native112c240 and metaclass448cdf0 retain their main ancestors. Original author tree and failed native attempts remain untouched.

Independent integrated source checks: 197 PASS, zero skips/deselections, 6.51s tests / 7.30s process / 265044KiB peak RSS. Original missing-native-extension collection failure retained separately; the existing two native declarations built locally in 3.37s without package installation/download. Original packaged structural ratchet against current main: 5187 metrics, no positive deltas, exit0. This is source/changed-path structural evidence, not a full global NRA, biological or installed/runtime acceptance.

Exact checkpoint and original receipts include actual import paths, uncertainty/ownership review, bounds, and the Fiji recipe resource correction (no shared-cache runtime proof claimed). Terminal owned rebuildable scratch retired; protected harness/history/cache unchanged.

Parent owns next serialized actual paired bootstrap/observe/exact-close and valid-volume acceptance. Current independent-context blind repeat keeps its original freeze/deadline and runtime slot; no installation or scientific coaching underneath it. PR remains draft pending that concrete live path, NOT optional hosted CI. Twenty GiB is a warning margin, not a hard admission limit. Whole expanded ZIP goal remains active and unfinished.