# SDD ledger — plan: docs/superpowers/plans/2026-10-10-imperator-comprehensive-audit.md

## Baseline and audit coverage

Frozen main `81b7ce67114f96ebcd05b257571ce8a6bc9e68c7`, tree `352e615beb3251b60424d4aa81b6929037c51778`, package0.4.0. Previous exact-main [38024642590](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38024642590) passed all six jobs. Five independent domains covered workflow/recovery, governor/scheduler, store/pagination/migrations, host/tools/plugins, and operations/execution/evidence. Parent covers packaging, runner/SQLite verification, open issue dispositions and integration. No tracked AGENTS.md or PR template exists in the157 baseline blobs; CONTRIBUTING requires topic PRs and actual checkout/packed validation.

Known source defects43/44/46/48/52/57/59 were reproduced and initially repaired. Issue53 is a narrow deliberate contract extension. Issue47 already uses trusted actor/session identity, including a real worker named lead remaining nonroot. Issue45 current terminal-unresolved visibility stays; misleading chronology wording is corrected. Issue42 remains deliberate legacy any-kind+nonempty-path investigation evidence requiring human content review; a strict execution task cannot use that sequence without its actual receipt. PR50 already closed without useful delta. PR41's three missing legacy caller/alias coverage groups are adopted by Task2, with obsolete PR closure deferred until verified main.

## Rulings

- Ruling: use isolated GitHub branches and Actions after managed executor capability startup failed — actual shell tools are unavailable — local/production/paid-model acceptance stays unverified.
- Ruling: preserve terminal unresolved blocker visibility (#45), changing misleading chronology wording only — hiding preclosure leftovers violates current contract — callers seeking insertion-time chronology must use the fact-write metadata.
- Ruling: retain deliberate legacy any-kind+path basis (#42), clarify human-review boundary and prove strict receipt isolation — excluding one negative kind would not prove success and changes investigation compatibility — legacy callers remain responsible for content review.
- Ruling: narrowly extend settled-only same-proof replay (#53), preserving all scope/owner/row-generation checks and no writes — safe retry should not depend on a later reservation — old callers expecting that specific fence now receive historical settled result.
- Ruling: freeze delivery/review and require root return for restored-root revalidation (#59), including current-revision failed-review history — existing direct reverify path bypasses budgets — max_reworks0/exhausted moved workflows require a new authorized task.


- Ruling: bind original recovery object per tools activation; missing/replaced/closed/unreadable journal refuses controls before effects — absence cannot establish earlier same-key outcomes — a replacement requires controller verification of the original database and reactivation, while same-object reconnect and genuinely absent/no-key detached legacy retain compatibility.

## Initial task evidence

These are historical module gates, not final release approval. Every production correction followed tests-only discriminating RED against unchanged production. Parent independently read six complete GREEN logs per task. Each separate reviewer read its full source diff and real evidence.

| Task | Tested code SHA | RED | GREEN six-job run | Independent spec / quality | Detail |
|---|---|---|---|---|---|
| 1 | `8a0b84de21c3de107551ab70e37cce4f9f1a9153` | [38030764528](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38030764528) | [38030970282](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38030970282) | /root/v04_workflow_review: no P0/P1/P2 | [Report](2026-10-10-imperator-audit/task-1-report.md) |
| 2 | `e6f0fd022d4c929e7d77603a0bde78232c8526d3` | [38030851937](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38030851937) | [38031521153](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38031521153) | /root/board_review: no P0/P1/P2 | [Report](2026-10-10-imperator-audit/task-2-report.md) |
| 3 | `e02b7cab27ab413d49a12cc562b324e6cde15f2e` | [38030568074](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38030568074) | [38030790223](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38030790223) | /root/v04_release_review: no P0/P1/P2 | [Report](2026-10-10-imperator-audit/task-3-report.md) |
| 4 | `6a1f1c3df53161943ca7121fde7ed13203cbacb3` | [38031371708](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38031371708) | [38031767125](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38031767125) | /root/v04_release_review: no P0/P1/P2 | [Report](2026-10-10-imperator-audit/task-4-report.md) |
| 5 | `1e6fe649f856697d526319f54a06179f2934c06f` | [38030967110](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38030967110) | [38031405217](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38031405217) | /root/v04_performance_review: no P0/P1/P2 | [Report](2026-10-10-imperator-audit/task-5-report.md) |
| 6 | `d41ab37361fd45fbd4f8d7a66f0c1fed2cd0d04c` | [38030813783](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38030813783) | [38031317435](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38031317435) | /root/v04_operations_review: no P0/P1/P2 | [Report](2026-10-10-imperator-audit/task-6-report.md) |

Counts are tests/pass/fail/skip. Task1 offline873/867/0/6, native873/861/0/12; Task2 878/872/0/6 and878/866/0/12; Task3 857/851/0/6 and857/845/0/12; Task4 903/897/0/6 and903/891/0/12; Task5 871/862/0/9 and871/856/0/15; Task6 876/870/0/6 and876/864/0/12. Anchored boundaries are40 except Task4's42 and Task5's43; all native jobs also passed17 host and13 isolation. Task5's three additional SDK cases really execute in the anchored stage despite expected primary SKIP; Task4's two alias cases execute native task_verify→bash→accept.

## Actual PR review and completed follow-up

Seven topic PRs [60](https://github.com/86cloudyun-afk/dsh-imperator/pull/60), [61](https://github.com/86cloudyun-afk/dsh-imperator/pull/61), [62](https://github.com/86cloudyun-afk/dsh-imperator/pull/62), [63](https://github.com/86cloudyun-afk/dsh-imperator/pull/63), [64](https://github.com/86cloudyun-afk/dsh-imperator/pull/64), [65](https://github.com/86cloudyun-afk/dsh-imperator/pull/65), [66](https://github.com/86cloudyun-afk/dsh-imperator/pull/66) were created and attached; none merged. PR66 is explicitly stacked on PR63. Common plan/spec/briefs/ledger belong to the parent release branch.

Independent actual-PR reviewer read all effective base→head diffs, verified every owned blob against tested candidates, found no deletions or shared-plan changes, and audited real reviews/comments/threads. CI evidence reviewer read42 full PR-triggered job logs, including28 unpacked-native jobs; current90 check-runs are success. Initial PR runs:60=38031598942,61=38031748483,62=38032165643,63=38032277881,64=38032282466,65=38032287694,66=38032448799. These GREEN results did not override actual review findings.

Four newly confirmed paths held all merging and reopened Tasks1/2/6. They have now completed tests-only RED, six-job GREEN and independent spec/quality follow-up:

| PR feedback | Follow-up |
|---|---|
| [61 legacy revision clear](https://github.com/86cloudyun-afk/dsh-imperator/pull/61#discussion_r4236754935) | Old failed review can persist same plan/evidence generation with stage=test/revision=NULL. Check later legacy replacement revision and passing-review descendants too; active failure lineage must require bounded root return without revoking terminal history. |
| [62 explicit null](https://github.com/86cloudyun-afk/dsh-imperator/pull/62#discussion_r4236775615) | Mounted recovery:null must be unreadable, not genuinely absent detached mode. |
| [62 real Cordis miss](https://github.com/86cloudyun-afk/dsh-imperator/pull/62#discussion_r4236775617) | Normal authoritative ctx.get undefined cannot become a lookup failure through optional reflective missing-service throw. Require actual pinned-native positive and failure controls. |
| [63 control integrity index](https://github.com/86cloudyun-afk/dsh-imperator/pull/63#discussion_r4236774781) | Whole-run correlated anomaly counts need task-leading access; test actual production SQL EQP and substantial scoped fixtures before the additive index fix. |

All four inline threads were answered with actual evidence and resolved after independent repair review. Current PR heads/base dependencies changed; no merge has occurred. Pending: updated exact clean-PR checks; complete0.4.1 integrated checkout/actual-packed matrix; original-base release review; fresh additional final premerge review; dependency-ordered expected-head merges; actual final-main tree and six-job verification. Exact future completion will be recorded only after execution in the release PR and final task response.

## Failure history and ownership

Task1 initially had an incorrect expected_version in a restored terminal test; tests-only correction preceded accepted RED. Task2's first implemented candidate passed the new regression assertions but failed two obsolete exact-schema fixtures; only expected additive columns/diagnostic counts changed, preserving prior checks. An isolated Task2 remote commit omitted base_tree and was detected incomplete before integration or PR creation; its own branch was corrected with a lease, the bad commit is outside final ancestry, and the accepted full tree preserves all157 baseline files. Main was unaffected.

Task4 inherited exact complete Task2 candidate e6f0fd0 through an additional parent; RED evidence separately lists Task4 defects and the two old Task2 fixture failures. STORE integration is Task2 text plus only two Task4 paragraphs; parent has verified removing those additions reconstructs Task2 byte-for-byte. Task4 owns two native alias cases in host-boundaries; Task5 owns separate host-api-contract. Task6 follow-up owns only appended real-Cordis cases on its original host-boundaries baseline; root must integrate their hunk with Task4 cases and test the union.

Task2 narrowly owns submit-status chronology, owner-session submitted_at:null migration row, sqlite receipt/waiver zero diagnostics, and verify-store S04 exact columns. Identity, no-write, rollback and previous meaningful checks stay. One workflow audit agent was platform-interrupted; completed findings were retained and reassigned, not treated as a reproduced project crash.

## External and measured boundaries

Managed executor failed capability startup; no local shell, target-production or paid-model acceptance is claimed. Missing deployment入口 and failed run/child logs leave actual historical long-task crash causes unverified. Ordinary native Actions use no model requests.

The original-main and Task5 native logs share four MaxListenersExceeded types at11 listeners during repeated official profile boot. Independent SDK/source comparison finds no new repository hook evidence; logs lack registration stacks, so neither per-listener runtime attribution nor production-crash cause is asserted.

Node `^22.23.2 || ^24.19.0`, pinned DSH rc.2/alpha.2, acceptance60s/cleanup12s, names/database location and no-external-runtime-dependency policy remain. H01/H03 helper evidence does not establish H02/H04/H05/H06; full-tree managed adapter stays closed. Existing100k history and bounded fault/SIGKILL probes do not prove production uptime, long paid-model task behavior or expenses.

## Follow-up and assembled0.4.1 evidence

| Task | Tested candidate / report head | Actual RED / GREEN | Independent result |
|---|---|---|---|
|1|`4a5d03755f9674d11682efca88c6a191f7376b2e` / `30232c06f264eae9416960511bff681cb806d701`|[38033436454](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38033436454) / [38033601930](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38033601930)|v04_release_review spec/quality PASS|
|2|`de88459306d8e77de2ebb5cfdb004ab21450ed9a` / `48b3b6a80c74f73a0347a903e762fd2034c6e319`|[38033102913](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38033102913) / [38033267129](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38033267129)|board_review spec/quality PASS|
|6|`5488c0c61216d50bfea19f7f9318d8675c273c8c` / `1a6bf2d8f0873cfbde7f4d40c2cfaef61b96ad6e`|[38033145348](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38033145348) / [38033318869](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38033318869)|v04_release_review spec/quality PASS|

Parent and independent reviewers read every follow-up RED/GREEN log. Task1 effective RED has15 failures per suite; GREEN offline890/884/0/6, native890/878/0/12 +40 boundaries. Task2 RED has2 failures; GREEN offline880/874/0/6, native880/868/0/12 +40 boundaries. Task6 RED has8 primary failures plus4 actual native failures; GREEN offline886/880/0/6, native886/874/0/12 +46 boundaries. All native jobs have HOST17/ISOLATION13. A Task1 first follow-up fixture tried reopening a permanently closed store object; it was corrected in tests only and is not accepted RED evidence.

Task1 upgrade history uses scoped real artifact lineage in the current plan/generation, includingNULL and already-produced replacement states. Unrelated orphan references remain outside actual delivery ancestry. Task2 seven production queries on280 tasks/8120 controls use the task-key covering index; old journal rows/columns remain identical. The performance index does not become a doctor's data-readability prerequisite; preflight adds it on its copy and records schemaHash. Task6 real running Cordis contexts distinguish authoritative absence, primary lookup failures and null publication; common service resolver stays baseline.

Clean component heads at assembly:60 d3a30c2;61 4e6cae1;63 8976957;64 35a6016;65 fb38b09;66 6a09c55 (base63);62 4febf0d (base66). Dependency order63→66→62 avoids competing end-of-file additions. LatestTask2 STORE text plus only two Task4 paragraphs reconstructs Task2 byte-for-byte when additions are removed. Shared native file is exact baseline + Task4 alias hunk + Task6 Cordis hunk; parent verified both identities. Original full-tree files and registered test lists are preserved; package/README now target0.4.1. Integration counts and final merge/main evidence await actual execution and are never inferred from module GREEN.

## Second actual-review repair round and final assembly inputs

Initial aggregate be24024f380f1d2035e6247b43e834ccf8528590 / tree641d8c6c563f6398074958e04eee917546d5cede passed push38034288333 and PR38034290717; the latter's real synthetic checkout tree matched the candidate. Parent and independent whole reviewer read all six PR logs: offline1001/992/0/9, native1001/986/0/15, anchored51/51/0/0 plusHOST17/ISOLATION13. Real100k probes, baseline parity, five-round fault soak and actual SIGKILL rollback/reopen passed. Full original81→candidate review found no other new P0/P1/P2, but held release for malformed begin/finish envelopes and startup audit scans. None of the eight audit PRs merged before these findings were resolved.

Task2's [diagnostic38034874104](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38034874104) used100k assigned receipts plus100k assigned waivers and six NULL audits. Actual shared migrate/open/boot/adopt SQL scanned task-leading covering indexes. Valid [RED38035331240](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38035331240) failed only the new run-key SEARCH assertion in every job. [GREEN38035489681](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38035489681) at bb2ee34e5e28ec5cd350d0a8834f21cedc2fe06f / tree6c60ce2ff3063c7103c27e797866254626827e76 passed six jobs: offline881/875/0/6, native881/869/0/12 +40/17/13. All eight actual counter queries now SEARCH both NULL partial covering indexes;200006-row hashes, PRAGMA columns, added_columns[], counts, boot/adoption/quarantine and existing control-index checks remain. Observed100k healthy count0.037–0.052ms versus diagnostic4.735–11.824ms; first old-table index creation still inspected history (11.500–17.079ms). No wallclock gate or arbitrary startup-latency guarantee. Final report afe3f69807acc9117f0a1cec8565bb06437c734a differs from tested code only by report. board_review independently read18 diagnostic/RED/GREEN logs, full original-base source and exact manifest: spec/quality PASS.

Task6's valid [RED38035485460](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38035485460) at04aacf36b54ecb4e3ebe0855158178c5170c683d had214 expected failures in each job: offline1124/904/214/6, native1124/898/214/12, while46 native boundaries and17/13 host/isolation checks passed. Earlier incorrect legal-direct-caller fixtures were repaired in tests only and remain failure history rather than accepted RED. Latest [GREEN38035848255](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38035848255) at b3dc0d7d7d10e5fdc3dd983c9fd632cadd79b146 / tree078175262458a9c9173bf70c715cc1750db680c2 passed all six: offline1124/1118/0/6, native1124/1112/0/12 +46/17/13. All214 negatives,24 legitimate SQLite positives, six prior actual-Cordis cases and eight strict child Node native/cross-realm rejecting Promise cases passed. Response fields are snapshotted once and whitelisted; only validated synchronous new intent authorizes effect. Invalid begin refuses with original retry key; invalid finish reports unknown original intent/key without claiming database settlement failed, because commit-then-malformed may already have persisted accepted. Promise rejection is consumed without awaiting or accepting asynchronous durability. Latest report b2785b96b73af6e12a0dc7eb01a9f8a9e8f7121f differs from tested code only by report. v04_release_review independently read valid12 RED/GREEN logs, original-base source and final manifest: spec/quality PASS.

Both new actual inline findings are answered/resolved after independent module review. Doctor submitted_at feedback is already implemented/tested by dependentPR66, not duplicated inPR63. Latest clean component heads: 60 d3a30c2eecf7df01853cdc6e3616174e3dea3a30; 61 4e6cae140fbed884c1312509e38a33352b3e7609; 63 b78042aa9c82dd47f91b0c1aae2c692d07d3a14c; 64 35a6016946cf8046d0cd638b430f009005547a1f; 65 fb38b09f7b43abd3addb18ac179e0ae97478a844; 66 d8ba0189ec4942b05d9f686fe2c638b7531ad317; 62 f85991a75432bb245370b966e69210564920cc94. PR66 carries latestPR63; PR62 carries latestPR66. Shared STORE remains newestTask2 plus exactly twoTask4 paragraphs; removing those additions reconstructsTask2 byte-for-byte. Shared host remains exact baseline+Task4 aliases+Task6 sixCordis cases, unchanged by envelope validation. No baseline path/test registration or native gate was removed.

Final revised aggregate acceptance, original-base whole approval, fresh additional premerge round, exact-head merges, final-main CI and actual issue/obsoletePR dispositions are pending at this source snapshot. PR67 records their actual outcome after execution. Managed executor/target deployment logs remain unavailable; these isolated child-process crash regressions do not identify the historical production long-task crash cause.

## Third actual-review repair: stable early-refusal keys

The revised7bb25767311fc95e32ec1ca1e7af92519ef42500 / tree683460e5180a54ebf1015b8b92e94d47acb8b2a8 passed push38036532231 and PR38036536357 six jobs: offline1240/1231/0/9, native1240/1225/0/15 and51/51 anchored boundaries plusHOST17/ISOLATION13. Full-original-base source review passed but release remained held for one new actualPR62 finding: early unavailable branches omitted the original structured retry key even though they refused a second effect.

Tests-only a098c56cb970f6bd02fca2dbfb7daacdd0dd32cc / [RED38037162428](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38037162428) reproduced26 missing-key failures in every job, with no fixture failures and zero second host effects. Source 27a39e2b428edd6e5328904bcefb2378c35b3d11 / tree0916cb83c2d8686615b1212ff0c7e9077aad3d26 passed [GREEN38037335341](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38037335341), all six complete logs read by parent and independent reviewer: offline1176/1170/0/6, native1176/1164/0/12 +46/17/13. All52 new negatives/positives and original envelope/Promise/Cordis cases passed. Final report-only 52d54070239257a092b81c8f34ae99febc843274 / tree624a2190692ce60af18db7c857b94963d6907f23, complete manifest and original-base spec/quality received independent PASS. The report preserves the actual RED-reading order and earlier invalid fixture history.

Early failures return only a validated explicit key or the original trusted-coordinate hash. They never allocate a new UUID to represent lost history. Without those inputs the caller must retain a previously returned generated key separately. Genuine detached success and normal mounted new-intent UUID fallback remain. Updated cleanPR62 a283c3b10d975ab8b8b6268bfcb85ca34cf96cd5 / tree81a675d0eb27c79ea1961ad3bcc8790b69613420 retains latestPR66/63 and the verified shared host union. Its actual review thread is answered and resolved. No other module production or shared hunk changes in this round; no audit PR has merged at this source snapshot.

## Actual low-CPU deadline diagnosis

ActualPR67 review5478139871 reported the unchanged60,000ms aggregate deadline killing node:test in its environment. This report was investigated, not dismissed because it had no inline thread. [Diagnostic38037137830](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38037137830) compared frozen original81b7ce67114f96ebcd05b257571ce8a6bc9e68c7 / tree352e615beb3251b60424d4aa81b6929037c51778 with candidate7bb25767311fc95e32ec1ca1e7af92519ef42500 / tree683460e5180a54ebf1015b8b92e94d47acb8b2a8, Node22.23.2/24.19.0 and actual1/2 CPU affinity. Eight complete job logs confirm exact checkout/tree, availableParallelism1/2, inherited npm affinity, original verify-all source, original exit0 and timeout:false. Baseline852/846/0/6; candidate1240/1231/0/9. No failed/cancelled jobs.

|Node / CPUs|baseline primary seconds|candidate primary seconds|
|---|---:|---:|
|22.23.2 /1|29.459|50.621|
|22.23.2 /2|31.710|30.341|
|24.19.0 /1|30.274|39.919|
|24.19.0 /2|34.109|40.553|

Each combination is one independent runner sample. This matrix did not reproduce the reported timeout; it cannot rule out that earlier unknown environment. The nominal9.379-second slowest-suite margin excludes spawn/close overhead and is not a guarantee for arbitrary machines. CPU affinity does not model quota/frequency/load. Three candidate offline skips require native SDK anchors; original12-second cleanup source is retained but skipped in this offline diagnostic, while normal packed/native gates execute it. Diagnostic-only branch b879922fa8e9f1a7266e07e663cdc1964ba026a0 / treec93b0d68260f7c021c663cedab292949e816b91d adds only runner-deadline-diagnostics.yml blob6e2e4c527c34e0024bfac326232d6e0b5c941f36 and preserves all174 candidate blobs. Its workflow/artifacts remain outside the release. Parent and independent performance review read all8 complete logs and source: evidence PASS, disposition **not reproduced in this matrix**. No production runner change or60s/12s waiver is justified by this result.

This next assembled source still requires its own exact-head six-job acceptance, complete original-base review, fresh additional actual-PR premerge round, dependency-ordered merges and final-main verification. Actual future results are recorded in PR67; unavailable deployment/run/child logs still prevent attributing historical production crashes.

## Fourth actual-review repair: all delivered ancestry and actionable recovery

The preceding aggregate 61cffb0ef602b62d191a4f6c6e61d722b4e8fb1f / treeb4bc5b757edf498f97cd89a0cd1e1f91a38a0284 passed six-job push38037871308 and PR38037875245: offline1292/1283/0/9, native1292/1277/0/15 and51/51 anchored boundaries plusHOST17/ISOLATION13. Whole-source and an additional fresh premerge review passed at that point. PR63,66,62,60 subsequently merged with exact-head checks, independent review and verified resulting trees/parents; current main4a9eb8e8910add4204e5e8aabe01644438929f54 / treed386132c445c2d9f9ed76fa867f244bc764670a9. Its actual main run38039582853 passed all six complete logs read by parent: offline1235/1229/0/6, native1235/1223/0/12 and48/48 anchored boundaries plusHOST17/ISOLATION13. A mechanical PR61 refresh retained every owned blob and all main changes; its six-job1273-test GREEN did not cover two new actual review findings. All remaining merges were paused and previous aggregate approvals withdrawn.

Actual PR61 review5478397636 identified (1) unreviewed/all-pass delivered ancestry left by legacy writers bypassing root return, and (2) frozen strict-evidence errors recommending reverify/waiver that the workflow forbids. Independent review confirmed both source paths. Tests-only 6134452e1e378ea50fe56fddd8e4cab54b898f9c / tree4987d7ed3367e84a3720de3f3513286e00dbf10c and [RED38040626126](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38040626126) reproduced 23 expected assertions per job against unchanged production, including actual tool JSON hints and real source/log mutation between both acceptance strict reads. No fixture failure is accepted as behavioral RED.

Code 4524b9e04fb54bbde47b8998548c32bae946808a / tree700a7a9b582db4ae06a82177da1f9dc6d074c4d5 and [GREEN38041034332](https://github.com/86cloudyun-afk/dsh-imperator/actions/runs/38041034332) passed all six complete logs: offline913/907/0/6; native913/901/0/12 +40/17/13. Final report-only 2ddec8efb14b834a2ddf9e90abef4bab57f8ac7a / treeff85067bd33cdc2f18cdffc13387056d1b078f87, owned manifest and complete original-base spec/quality review independently PASS. The parent integrates six Task1 owned blobs plus only the documented import/second-acceptance-call hunk on latest Task2 store/index.js; whole-side replacement is forbidden. All other Task2 source and the shared STORE/host unions remain byte-identical.

Same task/run/plan/evidence-generation actual artifact ancestry freezes replacement regardless of review outcome, including identical receipt reuse. Sole exact-current delivery still permits normal first review/passing acceptance, including max_reworks0. Different tuple/generation/plan and root-authorized new generation, original-key read-only replays and completed historical results remain discriminating controls. Frozen workflow strict failures provide budget-aware trusted-root return→claim→verification/new artifact/review guidance, or an explicitly root-authorized new task when budget is exhausted. This contextual guidance covers review and both actual acceptance reads; ordinary strict tasks retain reverify/explicit waiver and mutable workflows retain normal verification. No global tools error contract changes.

This newly assembled source must receive new exact-head six-job acceptance, changed-workload one-CPU probes, full original-base whole review and another fresh additional actual-PR premerge round before remaining merges. Final main tree/six jobs and issue dispositions remain future gates at this source snapshot. Previous GREEN/PASS records are historical, not substitute approval for the revised source. Actual later results belong in PR67. Failed managed executor and unavailable deployment/run/child logs still prevent attributing historical production crashes; no paid-model execution is claimed.

## Additional actual premerge guard repair

PR65 discussion_r4237238079 confirmed a real registered stop accepted:false→SQLite rejected→compatible E_CONTROL_OUTCOME_UNKNOWN replay, previously hidden from ECHO. Tests-only da0fe0fd3b62d725efd71b2f8aae8ecd3d577b22 / tree9e8360860397a9f9cc747ec0ff5ec96bfb5e64c7, RED38043630241 completed10:07:07 UTC and all six raw logs read before production009462fb6002a6224c5428669c2fffd3590fcbe6 at10:09:43 UTC. Only6 ordinary native/PTC×fold/projection/plugin plus2 actual SDK targets failed ERR_ASSERTION; no fixture/deadline failure. Source/treeb665bc47698f945b3b9f33465a888188346ea193, GREEN38043938948 passed all six complete logs: offline1326/1315/0/11; native1326/1309/0/17 plus53/53 anchored boundaries andHOST17/ISOLATION13, cancelled0. Final report-onlyded333ff0c01aecafe517cfa19cbf78c857c2121 / treeb8496770aac27db84a466f4f909cc35cc4268c62 preserves162 other blobs and the complete already merged scope report. Independent module Spec/Quality PASS. Only coherent complete durable stop-rejection replay bound to the matched target/original key counts definite; pending/unknown/unavailable/contradictory metadata, nativeUNKNOWN priority and deduplication stay protected. Real replay dispatches0 additional interrupts after one initial explicit refusal and leaves the entire persistent row unchanged. Cache adds only SHA256 binding, no raw key/args. No merged tools protocol, 60/12 deadline, dependency or pin change.

This revised snapshot supersedes the e9f16f3/b0a55654 source approval. Six component PRs (63/66/62/60/61/64) have actually merged; current main89b6271d451447261c453b628e6783d6f2b42d53 / treed56993aa2edb06159df6619f2982018d25e27a4b. The new clean PR65 and complete release still require exact-head six-job acceptance, current-source single-CPU diagnostics, original-base whole review and an additional fresh actual-PR premerge round. Final main and issue dispositions remain future gates; subsequent actual results belong in PR67. Old CPU samples, including Node24 59.250s with thin nominal margin, remain historical and do not establish new-source deadline reliability. No production crash attribution or paid-model execution is claimed.