feat(sdk): support embedded hosts with durable task completion

[1-ztc]

RDK Studio embeds one physical Moss SDK runtime and needs public host policy helpers, producer-side run identity and trustworthy task completion. This exposes existing context/sandbox/patch helpers from the public root, adds an optional synchronous producer observer inherited by root/child/finalization runs, and provides run-local device visibility for authenticated hosts. The package remains @rdk-moss/agent, with one root export, the upstream CLI/package lifecycle and no new runtime dependencies. The expanded public API is versioned at 0.27.0.

This development branch includes official main 4cf10a932fc294c36e61e7be0333611eb83df9a8. This and Studio develop e92d3f5 are the recorded latest-source cutoff. This is a draft integration branch; no main merge, tag or npm publication is performed.

Runtime and task correctness

• Configured queue concurrency survives idle periods, drain and clear. Idle default lanes still clean up.
• Resume and task_acceptance retain the persisted external command, execute it in the task workspace and respect its real exit code. Notes cannot replace command authority. A successful external command retains the original contract audit, including unmet metrics.
• Cancellation before native acceptance dispatch cannot produce accepted state. Successful acceptance requires all real ledger/contract/lifecycle barriers to finish. An internal identity attestation distinguishes this result from a custom late/forged PASS. A truly completed commit stops remaining tools and later model cycles in that agent; child acceptance cannot stop its parent. Deferred steering remains unconsumed without a redundant model call.
• Task readers/writers share the existing generation-protected mutex. Live ownership is not evicted by age, released async scopes reacquire, nested active parent scopes remain valid, and aggregate reads drain siblings before releasing ownership. Pending-append sidecars restrict readers to a confirmed byte prefix after failed sync/rollback. Invalid/unknown markers fail closed; provably undispatched owned preparation failures are compensated. Closed scopes/cancellation cannot append late command evidence over an earlier result.
• Only actual native acceptance IO registers a post-deadline settlement barrier. The original tool deadline still fires; failed persistence grants no trusted stop. Ordinary timeout remains bounded. Uninterruptible OS commit IO can delay cancellation/budget completion; uncertain IO is never called accepted to manufacture an exit. Separate appends are not a multi-file transaction. POSIX directory entries are fsynced; Windows only claims the available file-sync guarantees.
• Concurrent TaskRuntime refresh calls join the same in-flight/queued IO; endRun drains it and preserves original errors. TUI background/startup/terminal storage failures are handled visibly rather than becoming unhandled rejection or false success.
• ChatOptions.deviceConfigured?: boolean enables host-authenticated device tool visibility per run without a shared process target. Unset keeps CLI discovery, false overrides global discovery. Existing filters, child scopes/allowlists, approvals and owner-bound closures retain execution authority. Child contexts carry their actual child run ID.
• Legacy goal verification normalizes real nonzero ProcessError into the existing FAIL/one-continuation branch. Infrastructure handling and the five-minute deadline remain unchanged.

Output and Windows boundaries

• Optional tool_end.content exposes the existing bounded, redacted canonical tool result while retaining the default preview. A real 1132-character test failure previously lost its final verdict in the preview; canonical content preserves it. A shared URL-credential scanner replaces the old quadratic search without changing secret grammar, output bytes or redact-before-truncate order. The real 100KB/5s regression and old-regex differential oracle remain.
• Windows background commands enter an anonymous, non-inheritable KILL_ON_JOB_CLOSE Job before user code runs. Native initialization failure fails closed. PowerShell retains user shell defaults; cmd uses built-in Windows PowerShell with exact stdin/stdout/stderr/cwd/environment and 0/7 exit behavior. Actual 144/112-byte native layouts support 64/32-bit hosts. The registry stops only its actual Job owner immediately before the original bounded taskkill call; it never trusts stdout as kill authority. This covers ordinary inherited descendants, not arbitrary breakaway or WMI-created processes. Original startup/cancel/tree-kill/native-gone deadlines remain unchanged. The retained 32-bit prototype cold-start timeout is a startup risk, not presented as a successful run.
• Windows self-SIGTERM tests assert the actual numeric termination code, nonce/PID identity, disappearance, unreachable marker and empty stderr. Real 0/7 and launch/exception negative controls prevent an unrelated exception from impersonating termination. POSIX SIGTERM assertions and both original 200ms timeout cases are unchanged.
• Doctor reports ordered PATH scan facts and the current process entry, without claiming a shell winner or installation identity from an npm shim basename.
• The latest upstream missing-hook boundary is repaired: cmd's internal 9009 ERRORLEVEL is retained rather than being normalized to the ordinary Claude exit-1 verdict. Real explicit exit 1 still allows; exit 2 still blocks. Successful external recovery and explicit exit 0 remain supported. Built-in echo does not clear ERRORLEVEL and cannot hide a missing hook. Quoted Unicode/metacharacter argv, stdin, cwd, command recovery and real write/no-write regressions remain.
• OSC filtering consumes coalesced/split replies, flushes literal partial heads before composer controls and reconstructs Ink's empty escape chunk only inside the filter. A terminal ST escape cannot cancel an active run; a real user Escape still can. Elided read hints normalize dot segments; unresolvable relative hints conservatively invalidate cached bodies, including outside-workspace reads.
• Equivalent platform fixtures preserve the underlying execution/trust/secret/permission negatives and original budgets. Windows requested-mode observers are not claims of POSIX permissions or owner-only ACL isolation. Blocking CI jobs and all prior required deadlines remain blocking; newly added official platform-specific cases are reported separately when unexecuted.

Current exact-head validation: 5e41ca3

Head: 5e41ca3ec629ee40669d67b03c7c28f16c1cc51e; tree: e22e6d9dff811347db19cd314189f4f58b1d9d89. Lock SHA256: 69e1b238315f4ef90062bc218e321fe86f36e8afc6e9c883e47b4dd2c490042a; original registry: 370 whole files.

The delta changes only case 7 of test/task-runtime-mission.spec.mjs (8 added / 1 removed lines). The fixture captures and awaits the same actual original refresh() Promise that applyEvent(task_define tool_end) synchronously triggers. It asserts that this Promise exists, then retains the original runtime.version > versionBefore assertion. It does not call refresh or endRun to rescue the assertion, mock core IO, alter production, add a timeout, remove a negative assertion or change a numeric budget. The previous 50ms was a blind fixture wait, not a product latency deadline. Independent bounded source review approved immutable fixture blob 295200593e3f461b3ddfbe57ccbe92992e6b86f1, SHA256 ebc196cd7c32eca7146f365acb091cd250e21ea43ecaa060539a617d217880e3.

The original exact 2d4777c Linux full remains FAIL, exit 1 / 509850ms, reached 285/370. Case 7 failed its original version assertion (151.951868ms); the whole had 13 PASS / 1 FAIL / 0 SKIP. This did not by itself prove a production lost update or a unique filesystem cause. Its separately executed 94 supplements all passed, including the original 13 required wholes; smoke exited 0 / 11409ms. The aggregate remained exit 1 / 1138093ms. Neither its prefix nor supplements are new-head full verification.

Actual candidate negative controls demonstrate the replacement oracle:

• Owned compiled-dist missing-trigger mutation: real whole exit 1, Promise-exists assertion fails (13 PASS / 1 FAIL).
• Separate owned missing-notification mutation: real whole exit 1, original version assertion fails (13 PASS / 1 FAIL).
• Unmutated runtime and real owned tasks.jsonl directory: captured actual refresh rejects with native EISDIR, exit 1; a version change cannot conceal the failed IO. These are expected actual negative failures, not successful core results.

Fresh owned exact-head Linux clone from a self-contained bundle, with its own original npm install and actual POSIX Python prerequisites:

Original exact-head command	Exit	Elapsed
npm ci	0	22098ms
npm run check (format/lint/typecheck)	0	54617ms
npm run build	0	11614ms
npm run examples (all three)	0	840ms
node scripts/run-package-tests.mjs --filter test/task-runtime-mission.spec.mjs	0	1693ms

Clean selected POSIX aggregate: exit 0 / 92957ms, original mission whole 14 PASS / 0 FAIL / 0 SKIP. Stamp 5e41ca3; exact source/tree/lock/fixture identity checked before/after, tracked source clean and process environment restored exactly. Candidate dirty-overlay results are separately retained and do not stand in for this clean qualification. Raw receipts: scratch/5e41ca3e-exact-posix-receipts/, scratch/2d4777c6-mission-candidate-receipts/.

The new exact clean Windows selected qualification was also run once, in a fresh owned clone with a same-lock read-only dependency junction and its own dist/build stamp. Original build exited 0 / 14882ms. Original whole results:

Whole / independent entry	Exit	Elapsed
runtime-gitignore	1	8743ms
O67 refused proxy	0	582ms
O70 exit hang	0	576ms
O87 CONNECT without answer	0	11760ms
O79 worktree isolation	0	7813ms
custom output dimensions	0	1981ms
resize	0	1752ms
TUI projection, original 8s assertion	0	6760ms
background completion, original 900ms assertion	0	3108ms
independent npm run smoke	0	20369ms
real pywinpty 3.0.5 preflight	0	500ms
original ConPTY first-run whole	0	71571ms

The Windows selected aggregate is FAIL, exit 1 (150397ms sum of recorded stages), because runtime-gitignore retains its real native cleanup ENOTEMPTY failures for link/badgit fixtures. No target was created, no retained directories removed and no original cleanup or security assertions weakened. The 900ms whole's single pass is not a source performance fix or stability proof; earlier exact-head failures remain below. O70 retains its original three POSIX-only skips, and smoke reports its existing POSIX PTY-unavailable branch; these are not executed Windows passes. The separately executed genuine ConPTY whole covers its complete first-run journeys. Windows original assertions, 900ms/8s deadlines and runner remain unchanged. Matching clean stamp, before/after tracked cleanliness and case-aware three-state environment restoration were all verified. Raw Windows logs and receipt: scratch/5e41ca3e-exact-windows-v1-*.

Normal official development-branch push exited 0 / 6505ms, and an independent official SSH ls-remote verified this exact SHA. Current GitHub API reports draft CONFLICTING / DIRTY, empty check rollup and zero exact-head Actions runs. This is not 12 pending or passed jobs. The new fresh owned exact 370-file original full run is still pending; it will run after the host pins and freezes this exact source. The self-contained bundle is scratch/sdk-final-5e41ca3e.bundle, SHA256 5704c14953ed956ab9fd0473f15fcefb2c659a109c08ba199782b978a19f9478.

No main merge, force push, tag or npm publication. The recorded upstream cutoff is unchanged. Author tracked source is clean; four retained untracked failed-fixture directories remain untouched, so the whole author directory is not called clean. Historical first failures and unexecuted platform portions remain explicit below.

Historical exact-head validation: 2d4777c

Head: 2d4777c6e7ddcb0027453eb791b720190eae7813; tree: ac9c8443484a3529dbecffbb58b7e03a2b5a6632. Lock SHA256 remains 69e1b238315f4ef90062bc218e321fe86f36e8afc6e9c883e47b4dd2c490042a; original registry remains 370 whole files.

This delta changes one test fixture, 21 added lines, with no production/API/dependency changes. The real Chinese doctor warning contains the public bare endpoint archive.d-robotics.cc; the earlier locale oracle split this data into archive and cc. Only the exact hostname with strict ASCII hostname boundaries is excluded. Surrounding English, independent archive cc words and prefix/dot/hyphen/alphanumeric lookalikes still fail. Two Chinese positives and eight negative controls preserve the existing oracle, surface assertions, public network fallback, timeouts and runner. Bounded independent review approved the exact immutable fixture blob b30fe5a202493b340b83d453cc0d837359336afc / SHA256 2834854740870eb27a5da5e22bc5fc20c36f62b35359d657b5970b0f885a784d.

The actual production renderer and exact cb88 oracle reproduced << archive cc; the candidate returned no hits and all eight old/new negative controls remained hits. The first fresh POSIX candidate whole exited 0 (77449ms). Its subsequent check failed only Prettier formatting; this first failure is retained. Formatting collapsed only the new replace expression to one line, and independent reconstruction recovered the original approved bytes. The second candidate standard check/build/three examples exited 0; these dirty overlay results are separate from the clean committed results below.

Fresh owned Linux clone from a self-contained exact-head bundle, with its own original npm ci and real Python/pyte/fcntl/pty/termios environment:

Original exact-head command	Exit	Elapsed
npm ci	0	17732ms
npm run check (format/lint/typecheck)	0	32809ms
npm run build	0	6482ms
npm run examples (all three)	0	538ms
node scripts/run-package-tests.mjs --filter test/cli-ui-language.spec.mjs	0	77684ms

The complete original locale whole ran on POSIX, including real public probe/fallback surfaces and both English-injection checks (690/690 and 765/765). This is not a Windows ConPTY substitution. Clean stamp is 2d4777c / 2026-10-12; exact tree/lock/fixture identity and tracked cleanliness were checked before/after, and process environment presence/value restored exactly. Aggregate selected qualification exited 0 (136555ms). Receipts/raw logs: scratch/2d4777c6-exact-posix-receipts/, with final.json recording every original command and exit.

The preceding exact cb88 original Linux full verification remains a real FAIL: 183660ms, reached 83/370, first failure this locale oracle, 287 unreached. Separate unchanged whole coverage completed 290 files (289 PASS / 1 same-locale FAIL) and covered all 370 registry paths together with the original prefix, without turning full FAIL into PASS. The subsequently executed exact 2d4777c original Linux full exited 1 / 509850ms, reached 285/370 and first failed mission case 7; separate 94 whole supplements and smoke passed without converting full FAIL into PASS. None of the cb88 history qualifies it or a later head. Historical Windows original 900ms and runtime-gitignore whole/cleanup failures remain preserved. No retry, skip, enlarged deadline or new Job optimization conceals them.

Ordinary official development-branch push exited 0, and the GitHub PR API confirms this exact head. The draft PR currently reports CONFLICTING / DIRTY, empty check rollup, and the exact-head Actions query returns zero workflow runs. This is not 12 pending or passed jobs. No main merge, force push, tag or npm publication is performed; the recorded upstream cutoff has not been advanced to chase moving main. Author tracked source is clean; the retained untracked failed-fixture directories remain untouched.

Prior cb88 validation (retained history)

Head: cb88c19157d84a9404a2f99bc62e96549949179d; tree: ac51d44b7b120aa4baae783db25abb2add05a820. Lock SHA256: 69e1b238315f4ef90062bc218e321fe86f36e8afc6e9c883e47b4dd2c490042a. The original registry contains 370 whole spec files.

This checkpoint adds six narrow fixture repairs after 44df: the dimensions generator still rejects its first next() without an unused lint suppression; Windows smoke launches the actual npm.cmd; O70 uses file URLs for native ESM imports; O67/O87 clear case aliases before setting proxy variables; O79 uses real shell quoting/forward slash paths and drains every owned worktree lease before root cleanup. Original raw Git execution positives, guarded zero-execution negatives, proxy CONNECT/blackhole behavior, CLI assertions and all deadlines remain intact.

One production security repair follows an actual native reproduction: on this Windows host a dangling entry was present in directory enumeration while lstat/readlink returned ENOENT, and the original runtime-ignore creation followed it. The existing helper now checks raw directory entries before creating .moss or .gitignore; Windows matching is case-insensitive and POSIX matching remains exact. Enumeration errors fail closed. This is a bounded pre-existing-entry guard, not a guarantee against a subsequent replacement race. No public API or dependency is added.

Exact clean detached-worktree standard check exited 0 (40005ms), build 0 (14215ms), and all three examples 0 (2447ms). Source/lock identity matched the author checkout; dependencies were a read-only junction and dist/fixtures belonged to the qualification worktree. Final stamp: cb88c19, with no dirty suffix. Before/after tracked status was empty. Process-scoped PATH/TMP/language/probe variables used case-aware presence/value restoration; restoration failures were empty. The author checkout still contains retained untracked failed-fixture directories and is not described as wholly clean.

Original exact-head check	Actual result
O67 refused proxy	0; 2/2 native tests
O70 exit lifecycle	0; 2 passed, 3 original POSIX-only cases unexecuted on Windows
O87 CONNECT without answer	0; 8/8
O79 isolation/real malicious Git drivers	0; 3/3
Dimensions / resize / TUI projection	0 / 0 / 0; 1931 / 1924 / 6531ms, original 8s unchanged
Original 900ms background completion	1; 2256ms whole, original empty-output assertion retained
Original runtime gitignore whole	1; 9380ms, native dangling-link inspection/cleanup ENOENT / ENOTEMPTY retained
Original CLI smoke	0; 17159ms; its existing Windows POSIX-PTY exclusion remains unexecuted
Original first-run ConPTY, real existing Python prerequisite	0; 67810ms; actual pywinpty 3.0.5 preflight 0, original journeys/deadlines unchanged

Four actual native dangling cases (leaf, uppercase leaf, parent file link, parent directory link) retained real symlink Dirents and left the target absent before/after the compiled helper. A genuine normal .moss creation positive passed. All five security assertions passed, but four actual cleanup operations failed ENOTEMPTY, so this focused probe exited 1 overall. High-level .NET deletion was a no-op/failure, and a separately compiled native DeleteFileW / RemoveDirectoryW probe returned real error 2. Failed directories remain retained; no target was created for cleanup, no cleanup error was swallowed, and the original whole fixture was not weakened.

The complete original Windows npm run verify was most recently attempted on the immediately preceding 70d fixture checkpoint, before the production guard: 45/370 files passed, file 46 cli-first-run-e2e.spec.mjs failed with the default WindowsApps Python launcher returning 9009, and 324 files/smoke were unreached. Its original 900ms file passed on that run; the separate cb88 original 900ms failure above demonstrates the unresolved timing risk. The separate real-Python ConPTY success is not a replacement full-suite PASS. cb88 does not borrow the 70d full run or the historical 44df 352-file supplementary coverage as exact-head full qualification. Linux original full verification was pending at that checkpoint; its later exact cb88 result and the new-head pending run are recorded above.

An initial PowerShell 5 wrapper incorrectly treated native stderr as an exception and never produced a business-test terminal result. A later ConPTY wrapper completed the original body but incorrectly restored Path using case-sensitive Contains('PATH'); both wrapper failures remain recorded. The corrected wrapper passed actual absent/nonempty/empty environment restoration and rejected the old case-sensitive mutant before the valid whole run. These records are separate from test assertions and are not retroactively called successful executions.

Receipts: scratch/cb88c191-exact-qualification-receipt.json, scratch/cb88c191-native-guard-cases-receipt.json, the corresponding cb88c191-exact-* original logs, and the retained 70d1549c-* full/ConPTY/wrapper logs. Standard check and selected PASS results do not mean this SDK has qualified all original gates. The original 900ms and runtime-gitignore whole failures remain blocking evidence. No main merge, tag or npm publication is performed.

Official development-branch push exited 0 and an independent official SSH ls-remote confirmed the exact cb88 SHA. The current draft PR reports CONFLICTING / DIRTY, with an empty status-check rollup. An exact-head Actions query returned zero workflow runs. CI is therefore not started for this head, rather than 12 pending or successful jobs; no old CI success or rerun is substituted. This recorded source cutoff has not been advanced to resolve moving-main conflicts.

Prior 44df validation (retained history)

Head: 44df2d7cd141ea0f8088486cc0eb0770c8bc66ac. This six-file checkpoint avoids repeated external terminal-size probes for custom non-TTY Ink output sinks and redundant task entry/normal-turn snapshots. Existing valid dimensions, real TTY resize, host accessors/read-only dimensions and host updates remain authoritative. Cleanup restores only properties still owned by this mount. Each independent public task entry still canonicalizes freshly; no cross-entry path cache, lock-generation or budget semantics are weakened. Public SDK ABI is unchanged.

Actual native CPU diagnosis found repeated synchronous terminal-size/tput probes blocking Ink commits; filesystem delegate wall timings included that blocked JS delivery and are not claimed as a unique disk/fsync cause. The unchanged TUI 8s projection and resize whole tests passed against the final six-file working source (7831ms and 2352ms); the new real-native dimensions whole passed in 2786ms and observed 5 mount probes followed by zero additional probes on a later real commit. Initial pre-effect probes still exist. Original task/lock files passed all 36 cases. Working-source evidence is distinguished from exact clean-stamp qualification below.

Exact committed-source standard check exited 0 (66760ms), build exited 0 (16627ms), and all three examples exited 0 (2525ms) in a detached own worktree. Its dependency lock matched the author checkout, dependencies were a read-only junction, and dist/fixtures were its own. Exact build stamp is 44df2d7 / 2026-10-12 with no dirty flag and tracked status empty before/after. The author checkout's standard check separately exited 1 because Prettier found two retained failed-test fixtures; they were not deleted, moved, formatted or added to ignore rules to manufacture PASS.

The full original npm run verify ran once on this exact source in fresh owned TMP and exited 1 (88357ms): check/build passed; the first 17 of 370 registered whole files passed, file 18 background-completion-user-visible.spec.mjs:112 failed with empty CLI output against the unchanged 900ms wait. 352 files and smoke were unreached. Environment presence/value restored exactly and tracked source stayed clean. Original full status: scratch/44df2d7c-original-fullverify-file-manifest.json; logs/receipts: scratch/44df2d7c-exact-*.

Supplemental unchanged original-runner --filter coverage has now completed all 352 unreached whole files: 340 PASS / 12 FAIL, with zero selected-file/launcher mismatches. It exited 1 after 1464199ms; tracked source remained clean and exact stamp remained 44df2d7. The original TUI 8s projection whole passed on this exact committed source in 6806ms, including phases and final verdict. Original background, task authority/durability/cancellation/locks, runtime drain, SDK and child lifecycle wholes passed. The separately invoked original smoke exited 1 at its native npm run build launch before smoke CLI assertions; its helper omits the native error from the rendered failure, so launcher attribution remains pending. These results do not change the original full-verify FAIL.

The 12 original supplemental failures are retained: ConPTY driver returned9009; four Python3/pyte layout prerequisite failures (CLI language, inline exit, MCP failure layout, screen layout); device dry benchmark localhost-port/Python acceptance failures; runtime .gitignore symlink safety plus cleanup failure; refused-proxy copy; clean-exit/Windows absolute ESM import; CONNECT blackhole proxy saw no CONNECT; home grep hit its original120000ms timeout; and O79 raw git clean/merge fixtures failed to establish required must-run baselines. No source/environment cause is assumed without native evidence, no negative assertion is weakened, and no skip or timeout increase is used. Real Python/native Git prerequisite rechecks, if run later, will be reported separately and retain these first failures. Receipt: scratch/44df2d7c-native-filter-supplement-unreached-receipt.json; classified original evidence: scratch/44df2d7c-final-coverage-failures-manifest.json; original per-file logs: scratch/44df2d7c-native-filter-supplement-logs/.

An initial supplemental harness passed forward-slash relative filters to the Windows runner and selected no specs. It was stopped and its logs/receipt retained; those launch failures are not business test results. Corrected native filters used a separate log/receipt stem. The author checkout's retained forbidden fixtures were not deleted, moved or ignored.

One paired real Job-phase diagnostic compared only internal standard constructors with the existing constructor cmdlet. Original close was 1086ms; candidate close was 953ms, without proving sufficient room for the original settle50+wait900 contract. Ordering and diagnostic overhead do not establish sole causality. No Job production change, timer reset, budget increase or safety-gate removal was made.

Ordinary official development-branch push exited 0; no main/tag/publication was performed. GitHub reports this draft PR CONFLICTING / DIRTY against moving main beyond the recorded 4cf source cutoff; the new-head run query currently returns no workflow runs, not 12 pending or successful jobs. Prior CI failures below remain historical evidence, not qualification for 44df. No old CI rerun is used to conceal a first failure.

Prior a661 validation (retained history)

Head: a661d8b5139a9c6ac0bb15aace49b5af04310814. Exact clean build stamp: a661d8b.

Exact-head standard build exited 0 (22130ms), complete check exited 0 (62768ms), and all three examples exited 0 (3860ms). The complete original sequential 16-file group exited 0 (94620ms), with 12 TAP tests passing and no skips/cancellation, plus the complete inline assertions. The affected 27-file group exited 1 (97701ms): 25 files passed, the 26th file was the unchanged TUI 8s FAIL projection test, and the final workspace-trust file was unreached. That final file separately passed in 13340ms; this is not a 27-file PASS. Two new official O86 cases were skipped on Windows (POSIX sed command and symlink), recorded as unexecuted rather than passed. All three new boundary repairs passed their full original files and meaningful native negative controls. The original local npm run verify entry ran once in fresh owned TMP and exited 1 (105918ms): check and build passed; 17 of 369 whole spec files passed, file 18 background-completion-user-visible.spec.mjs:112 failed with empty CLI completion output against the original 900ms wait/assertion. The remaining 351 files and smoke were unreached. Full reached/unreached status and the original log/receipt are retained in scratch/main-4cf-a661-original-fullverify*. TMP/TEMP/TMPDIR restored exactly; the failed fixture directory remains untouched. No exact-head full-suite success is claimed. Logs/receipts: scratch/main-4cf-a661-exact-{build,check,examples}.*, scratch/main-4cf-corrected-final-{original16,affected27,unreached-tail}.*.

Original failures remain available: merged missing hooks 24 cases / 14 failures, literal bracket loss, coalesced OSC leakage, split-ST unintended cancellation, and elided relative-path stale reuse all produced actual RED before their narrow fixes. The original TUI 8s failure remains unmodified: its last recorded negative run had only two FAIL verdicts and one repair before its deadline, without final FAIL projection. A delegated native-FS diagnostic measured repeated canonical realpath latency, not a stalled fsync or a proved unique cause. Its deadline/repair count/assertions are not raised or skipped.

Official development-branch push exited 0. Original 12-job CI for this exact head finished with 7 successful jobs and 5 failed jobs (original first run, no reruns). Successful jobs: Check, all three documented-install jobs, Windows pwsh shell, Linux real terminals, and Ubuntu Node 24 full Test. The PR workflow checks out synthetic merge 6cd08c7 of this branch into moving main 2a7d1873, so it is not a pure a661-tree test. Both macOS Test jobs first failed the newly introduced exec-write-lock.spec.mjs:45 diagnostic path assertion (actual ../../../t/.../src/big.ts, expected src/big.ts); both Windows Test jobs first failed the same assertion with actual src\big.ts versus src/big.ts. The read-scope refusal itself occurred. Windows crossed the original background/Job file and did not reach TUI. Ubuntu Node 22 first failed qa-repro-o67-o70-exit-bundle.spec.mjs:214: refused-proxy diagnostic expected a proxy message but received API key rejected (401); Ubuntu Node 24 full Test passed. Complete 12-job JSON and original first-failure logs are retained in scratch/main-4cf-a661-ci-final-* and scratch/main-4cf-a661-ci-*-first-failed.log. That file is absent from the recorded a661/4cf source tree. The original log is retained; no further main synchronization or fixture rewrite is silently assumed. This CI preserves the blocking jobs, original deadlines and negative tests. Prior 3f original CI finished 10/12: both Windows Test jobs first failed (late native descendant / POSIX signal expectation), neither reaching TUI. Prior 265 original CI finished 9/12 (Windows process-tree, exact diff notice, Windows shell lookup). Those original logs, complete JSON and other earlier first-failure receipts remain saved; no rerun replaces them. Older 3f/169 focused PASS is not used as qualification for this merged head.