Execution grants — development preview

Execution grants aim to let a developer sell an executable capability and let its customer carry purchased rights to the machine that runs it, including a disconnected machine. This is development work for 0.73.0, not an enabled marketplace, purchase workflow or supported deployment promise.

Recovery and client compatibility

The development lifecycle protocol is version 2. Loading returns a model incarnation, which clients must retain with the exact compiled-image identity for unload, deletion and replacement requests. A model name can be reused after completed full Library deletion, but an old request must never stop or change its successor, even when the source is identical. Solution retirement preserves paid evidence and does not release its model name. Legacy requests without the required incarnation refuse; clients must not substitute the current model's identity when retrying an old operation.

Current issuer-status observation and retained-status export are distinct from activation. The owner binds signed observations to the approved issuer and transaction, retains the highest sequence and exact digest, and refuses older or conflicting observations. A newer observation preserves the original purchase reservation. It does not buy rights, install capacity or authorize execution.

The allowance store starts with private schema 8. The first explicitly selected coupled reservation upgrades that store to schema 9 in the same transaction; older binaries refuse it. Single-grant work stays on schema 8, and opening a store does not upgrade it. New lifecycle journals use schema 11; the explicitly selected native source-publication receipt profile uses schema 12. No path resets history. Lifecycle metadata migrations are explicit, and cannot promote old saved models into new execution authority. These development formats are not a production migration promise.

Calculation stays ordinary

An unlimited library is admitted once against its exact signed package, publisher policy, local deployment policy and installed grant. Its calculations then use the ordinary runtime without license checks, counters, storage access or reporting per call. There is no reporting heartbeat. A change to the admitted rights requires an explicit host lifecycle action, not a new per-cell check.

The native embedding API can retain a VerifiedUnlimitedLibrary after checking the exact signed package and commercial descriptor/policy. Preflight starts no runtime and confers no purchase or installation authority. Installation still checks current rights, so a previously verified object cannot bypass revocation. The existing one-shot installer remains supported. Selected local hosts can now prepare and activate unlimited Library consent from exact startup-approved signed bytes. Activation retains rights; it does not install the Library into any model. A separately authorized loadLibrary request selects customer source and a model ID under that activated purchase; keys, package bytes and policy still come only from the approved startup plan.

Core can also prepare a CompiledLibraryModel: customer-authored source compiled against the sealed publisher-signed Library, with exact source and executable digests and no ambient import fallback. Its selected model-local loader uses the same calculation engine and keeps the paid extension service separate from ordinary models and global extension configuration. An explicit drain clears both runtime lanes under their existing model lock. The local loading route persists exact identity, preserves warm inputs on retry and requires fresh authenticated admission after restart. A bounded management index serializes loading with signed revocation and chooses the affected models to drain before commit. Cold reopening also restores saved rule history and pending work through the existing runtime. Malformed known rule-state fields or oversized saved records refuse before loading; they are not silently discarded. A warm retry preserves later live state, including completed effects, rather than restoring it again. Once a new or cold Library's isolated service is admitted, restoration is guarded through saved-state replay and rule import. An error or unwind drains the service and calculator lanes and discards its partial replay cursor. The guard preserves saved recovery data; ordinary fresh-load failure rollback remains scoped to that request's newly created model. If drainage itself fails, the selected host stops with exit 74 instead of continuing with uncertain licensed runtime state. The earlier compiled-model loading/service-attachment interval is guarded too. Failed admission empties the shared runtime, so a previously obtained runtime handle cannot keep using partially admitted code. Saved resource registrations are not silently deleted; their complete lifecycle remains separate work. In particular, an existing Library's durable Stream subscriptions and cursors must survive unload and failed cold restoration. Source ingress cannot reopen the stopped model: it leaves queued events for an authenticated reopen. Signed revocation also stops source-triggered execution without discarding those events; actual model deletion retires its subscriptions. Re-registering at the source tail during an ordinary unload would instead skip queued data. When subscribers share a source, a licensed cold-admission refusal no longer prevents later healthy subscribers from processing already-retained events. The overall source operation still fails until the refusal is resolved; it does not acknowledge the stopped model's work. Strict durable producer sequencing may therefore still hold later source positions pending. This preserves the existing acknowledgment contract rather than promising independent subscriber backlogs. Unknown loader errors still stop dispatch; they may indicate shared storage failure rather than a model-local permission refusal. Cold Library and Solution admission also refuses a saved input that has no binding. Fresh report hydration uses the same strict check: reopening cannot silently drop saved values and continue with defaults. The saved bytes remain available for explicit correction, without changing the grant balance. Recovery of an already-retained report remains available without loading the model. Cold admission checks those saved bindings against the admitted compilation, including input/output and validation declarations, connector/external-reference metadata, units/FX and ONCE cell/expression identities. A conflicting record is refused, not silently repaired; an injected name cannot redirect a saved value. Cold Library and Solution records are limited to 16 MiB. These comparisons do not run on warm calculations or retained-report recovery. Finite Solution cold restoration also discards partial runtime state on failure, including a failed predicate-evidence replay. A retry must restore successfully; it cannot treat the partial model as a completed warm load. Saved authority and paid results are retained for recovery. This cleanup is selected at cold loading, not during ordinary calculation. An independently authorized unloadLibrary request stops a matching model and frees its admission slot while retaining saved source, compiled model and inputs. It compares the exact image returned by loading, works after revocation, and is safe to retry. Reopening still requires authenticated admission; ordinary loading cannot bypass the retained protection. Unload is not deletion or a refund, and it does not save otherwise unsaved inputs. Selected hosts can separately enable deleteLibrary with a preprovisioned private deletion journal. The independently authorized request binds an operation ID, transaction, model incarnation and expected compiled image. Cleanup retains a protected record until payload removal is durable; interruption requires retrying the same request. Completed retries return the retained receipt without touching a replacement that reuses the model ID. Deletion remains available after revocation and does not change allowances or issue a refund. It removes saved source and inputs, unlike unload. Integrated cleanup Performance and broader lifecycle auditing remain unfinished. The independent CLI exposes this selected development interface; it does not enable deletion on an unconfigured host. Authenticated Library and Solution loading now refuse while the configured lifecycle journal retains unfinished deletion or replacement for that model, including before a protective marker is written. An uncertain journal commit requires restart recovery before admission resumes. Startup cannot ignore an existing journal by omitting its configuration. These are admission-time checks; calculation does not consult the journal. Stop and recovery operations remain available under their independent permissions. The initial compiler bridge admits pure Libraries. Signed unlimited Library prerequisite integration is prepared on main, with native validation pending; broader graph/effect completion remains required Core work.

Selected native Library editing uses authenticated POST /internal/execution-grants/v2/replace-library. The bounded LibraryReplaceRequest binds the operation, transaction, exact model incarnation, working revision, authored-source digest, compiled-model digest and complete new source. The principal needs replaceLibrary permission for that transaction; native runtime and lifecycle storage must both be selected. The ordinary HTTP mode does not mount this route. Discovery advertises the action only for a permitted principal on that selected topology; object admission remains independent.

The same request, with a new authenticated transport nonce, retries the existing operation after interruption. The original native lifecycle journal and file publisher own preparation, snapshot/image storage, publication and completion. The coordinator checks the exact old/new live image before intent or cleanup, refuses unsettled rule/external work, and restores saved inputs, compatible Graph, Predicate, durable collection and operational state through the single compiled-model engine. Cold recovery reads the bounded actual saved selector under the normal model fence; it does not require a caller to reconstruct an in-memory model record. Fresh cold editing and reopening also require the native current generation, so a copied old record cannot roll the selected head backward. Missing or incompatible recovery material refuses without silently reconstructing it.

Partial hydration or unwinding drains the isolated resident and its cloned handles and discards its replay cursor. Published recovery after revocation can finish with execution stopped. The terminal response is a request-bound observation of finished or cancelled, never a signed receipt or a claim that code is currently loaded. Completed retries stay cold and do not overwrite later edits, reload stopped code or consume allowance. Current load, unload and deletion separately bind and authorize the current incarnation and executable.

Explicit cancellation uses the same exact request at POST /internal/execution-grants/v2/cancel-library-replacement. Only proof that the prepared transaction left the exact original selector in place permits the native cancellation commit. A missing acknowledgment, timeout or missing snapshot is not proof. Visible publication cannot be cancelled. Terminal cancellation and replacement observations remain recoverable after restart without execution.

Editing preserves compatible saved ONCE values. New or changed uncaptured ONCE expressions can be captured in a bounded exact, pure Workbook/Extension image using the same general compiled-model evaluator and currently admitted package. Saved inputs and compatible captures are applied before evaluating the pending cells. The resulting typed values enter the original native replacement snapshot before intent or publication. Volatile, effectful, live, resource and stateful images remain refused; retry uses the frozen capture rather than evaluating again. An explicit private-file licensedSourceCustody: "native-topology-v6" source checkpoint joins licensed Source/Stream/LiveTable edits to the original native Library replacement, Source owner and compiler-owned LiveTable catalog. It keeps the original grant and incarnation, retains predecessor receipts, and requires original unread input and unfinished application/publication work to drain before changed semantics can publish. Exact unchanged closed Stream contracts preserve their existing cursors, checkpoints and sinks. Recovery retries the same request; only an unpublished edit may be explicitly cancelled. Terminal replay does not execute or reload code. Older profiles retain their existing refusals.

Compilation and installed lifecycle/crash validation of this checkpoint are pending under the owner's no-build direction. The schema12/custody2 profile requires the selected native Library journal and the same absolute durable Source root; each retained LIR image remains bounded at 1 MiB. Its process-calc adapter installs exact pure code into a private worker bound to the original owner, grant, incarnation, operation, Source generation, LIR and executable. Only frozen input and original receipt/checkpoint DATA enter that worker. Lost replies recover its original result; an uncertain crash cannot authorize another evaluation. The parent model is fenced from executing the same operation.

The separate Source10 service now joins topology edits to the same charged immutable component and native replacement owners, including physical custody. Use replace_source10_library for the original prepared request/record, cancel_source10_topology to close an existing unpublished promise, and load_source10_topology_library for cold current admission. Original root/grant, predecessor receipts and full storage promises survive. Its numeric/pure Source10 contract and catalog-only LiveTable edits can select the private process adapter. The parent retains the original grant, native ONCE, Source, publication and memory owners. The process wire admits at most 32 MiB per frozen input/result, with prospective admission before ONCE and 512 MiB of conservative protocol accounting per retained operation. The worker has no provider, Source writer or grant database.

For the closed schema12 uncheckpointed profile, Source reserves the original operation before worker submission. Its actual receipt batches settle through the original native publication. Computed process rows retain the exact producer event envelope, timestamp and slot for recovery before Pending. Lost replies use the same worker/request; worker loss without a retained outcome remains uncertain and cannot authorize another evaluation.

Locked-root relocation also retains topology generations, original Initial and latest evaluation receipts. with_current_topology_model lends separately mapped current DATA; the charged loader admits the actual replacement image. Physical migration counts retained topology/control debt without refunding it. Copied data and mapped loans do not become ordinary Source writers. Installed enterprise adapters and broader effect/state/ONCE migration remain separate implementation work. Type-checking, installed lifecycle, crash and cost checks are still unrun under the no-build direction; conservative memory accounting is not an RSS guarantee. Solutions retain their signed delivered source; restoration cannot authorize a different executable.

Saved rule run numbers survive edits, including rule removal and reintroduction. Run history newer than the saved checkpoint must be saved before editing. Managed run counters refuse exhaustion instead of wrapping; existing effects can recover. Replacement also advances captured external request identities, including same-source edits and revision-zero entries. Conflicting new identities refuse recovery rather than changing the saved preparation. Old delayed publishers cannot requeue work or publish after cleanup, even if the new source contains the same target.

Replacement, unload, deletion and revocation share indexed worker retirement and model-owned queue/result/cache/capability cleanup under the existing fences. The operation's one deadline covers preflight, waiting, publication and hydration. Failure retains partial progress for retry and does not restart cancelled work. Dormant stores remain uninitialized. Shared cache entries, other models' claims, terminal job history, durable source/effect history and paid report evidence stay with their existing owners. Destruction occurs outside shared map locks. Safety drainage may extend response time; synchronous compilation/storage is not preempted.

Replacement reserves bounded bytes for the exact new image and saved snapshot. An image shared within one model is charged once. Durable, authorized physical reclamation can release unpinned terminal payloads; permanent receipts remain. Whole-model deletion releases the existing journal's model storage only through its original retirement transaction. Legacy-file accounting and broader retained Source retirement remain separate work, not implied by this bounded editing path.

All 107 selected local checks pass, covering mounted editing, true owner/journal reopen, interrupted publication/hydration, explicit cancellation, stale publishers and resource cleanup. The 19 selected source files match the compiled snapshot. Evidence is recorded in docs/operations/evidence/execution-grants-editing-2026-10-08/. This is macOS/Apple-silicon debug evidence, not machine power-loss, cross-platform or paired performance acceptance. Quantitative default-off and selected budgets remain open; all added discovery, serialization, policy and storage work occurs at selected lifecycle ingress, not per cell or resolve.

A finite allowance buys a deliberately accepted durable result, such as a report. Recalculation, preview and reading an existing result do not consume units. The selected owner reserves capacity before publication and confirms consumption only from durable result evidence. Ambiguous publication keeps capacity unavailable until reconciled; a timeout is not an automatic refund. Those durable operations have their own cost and capacity limits.

Ordinary and licensed extensions share the same immutable binding lookup. Installation retains compact indexed export records so calls do not repeatedly scan package declarations or copy package/version names for lookup. Live policy and value checks remain. This improves shared runtime mechanics; it is not a promise of allocation-free execution or unlimited durable-publication throughput.

Required package admission

For an extension or Solution that requires a grant, the signed manifest contains this top-level fragment alongside its normal artifact and export fields:

{
  "commercialAdmission": {
    "profile": "required-v1",
    "productId": "acme/library"
  }
}

Ordinary packages omit the field. A marked package cannot enter through ordinary runtime installation: it needs the selected admission integration. Older strict readers reject the field; null and unsupported profiles also refuse. Removing signed metadata changes package identity. Removing a detached descriptor does not make the package free. Do not add this marker until the target host supports the admission flow.

Solutions use the same marker in their signed grid-domain-pack.json manifest. Ordinary directory, bundle and publication installers, and the ordinary host catalog, refuse marked Solutions. Selected verification retains the exact signed artifact and checks its publisher, product, registered report adapter and current grant. A sealed compilation API now compiles a declared signed source module with the existing compiler, resolves imports only from verified declared modules, and binds its exact compiled image to the resident model. Selected report publication checks the admitted source and compiled image before making a result durable. A separate selected local loading route now requires an activated consent and explicit load permission, then persists the exact compiled model privately under the enrolled organization through the normal model replacement fence. Retry requires matching source and preserved compiled image; missing bytes never trigger ambient recompilation. The saved model retains its exact grant/transaction, owner and signed release identity. On restart, ordinary startup retains metadata only; authenticated loading must reopen the code. Ordinary source replacement, owner transfer, cloning, model-home export/import and deletion refuse licensed records. Builds without execution grants refuse these saved records rather than treating them as ordinary models. Calculation after admission uses the same calculation engine. An independently authorized unloadSolution request stops both resident lanes without deleting source, inputs, paid reports or their security evidence. It works after allowance exhaustion or commercial revocation. Retained reports remain recoverable with current security permission, without reloading code or spending another unit. Unload is not permanent suspension: a later authorized load or new report request may reopen the model. Selected deleteSolution instead retires active source, inputs and executable model bytes while retaining paid reports, security evidence and auxiliary history. Its private tombstone reserves the model ID and refuses reopening or replacement. Deletion requires separate permission and a provisioned recovery journal; retry the same operation after an interruption. Current security permission still controls paid-report recovery. This is not historical-data erasure or a refund; eventual evidence purge and ID reuse need a separate retention policy. Pending lifecycle work also blocks fresh report dispatch, which otherwise can reopen a model independently of loading. Retried retained reports remain recovery-only, even when their allowance was reserved but execution never began. They cannot start new work while deletion is unfinished or its commit is uncertain. Integrated failure/Performance auditing remains unfinished. An independently authorized report route now reserves allowance before staging and durably accepting an existing compiled-model capture. Retrying the same operation returns its retained result without another charge. Recovery can survive a commercial stop, but still requires current security policy. Ordinary research snapshot publication cannot bypass this route for a licensed model. This is development integration, not a complete paid product: complete lifecycle/recovery auditing and deployment-policy bridges remain unfinished. Selected source Solutions can use verified physical prerequisites. Extension dependency execution and portable templates still need their complete grant/runtime ownership; this route does not silently admit them or use ambient imports.

Revocation and in-flight reports

The selected management service now coordinates report callbacks and signed revocation with per-grant leases. Reports sharing a grant can run concurrently; revocation waits for that grant's active callbacks, without serializing reports on unrelated grants. Library load/replacement and Solution load check the same durable stop state and the service's selected leases. These checks are at selected operation boundaries, never in ordinary calculation.

A failed verified drain stops fresh work across service reconstruction. Explicit report recovery and cancellation remain available. A retained reservation that has never run is still fresh execution: publishing it rechecks current rights, model revision and cold input/model restoration. Clients must request recovery explicitly when fresh publication is stopped. Already-published Library replacement recovery can finish with execution stopped.

Selected Library and Solution admissions now share bounded resident tracking. Revocation finds affected models through a reverse grant index, checks their saved and live code identities, and stops the appropriate runtime under model publication fences. Unload and replacement remove only the exact tracked registration; uncertain failures remain discoverable. Ordinary models are not scanned or charged for this tracking.

The owner commits the signed notice and pending drain obligation before the callback. Only current authorization and that exact notice can complete the obligation; an older callback cannot acknowledge a newer notice. The V3 development integration shares exact live-image preflight across revocation and licensed Library/Solution unload and deletion. Library source replacement also checks the exact live predecessor before a fresh intent or prepared retry, and the exact compiled candidate during visible-generation recovery. Its publication adapter independently rechecks the predecessor before drain. These checks compare both stateless and served incremental compiled models before cleanup; an otherwise matching saved record cannot authorize replacing foreign live code. Empty resident lanes remain eligible for authorized cold recovery. Deletion refuses a foreign image or an unreconciled Source binding before recording new intent; retained native Source custody still requires its owning retirement contract. The stop paths wait for indexed training workers to finish and remove model-local facade job authority, queues and transient result state under the same publication fences and total deadline. A failed revocation cleanup retains its pending stop for an exact authorized retry. Interrupted deletion uses the existing durable journal, and finished replay performs no cleanup. Unload preserves saved data; Solution deletion preserves paid-result history. Commercial balances and signed recovery history remain retained. Focused local macOS Lite/grants checks cover these paths; they do not establish complete lifecycle, platform or Performance support. Source-specific adjunct and external-effect reconciliation still require their owning contracts. Selected source-Solution prerequisites now share this admission/lease and reverse-resident tracking. Direct Owner embeddings and multiple services sharing an Owner must supply their own coordinated exclusion; this does not introduce a process-wide execution lock.

Signed dependency integrity

The Core development API verify_domain_pack_dependency_closure can verify a Solution and its complete, explicitly supplied dependency graph against separately trusted publisher keys. It checks signed bytes and exact versions and canonical manifest hashes, refuses missing/conflicting/cyclic or extra nodes, and returns an immutable dependency-first view. It does not fetch from an ambient registry or choose among versions.

Callers can lower the hard limits of 256 publications, 4,096 edges, depth 64 and 1 GiB of supplied object bytes. Byte and metadata limits are checked before cryptographic verification; graph limits are checked using verified manifests. Lowering the graph limits does not lower the hashing budget. Shared object bytes across publications count again; the byte limit is not a peak-memory guarantee.

This verifies integrity, not execution rights. A dependency's manifest identity does not identify its publisher or exact signed release: commercial admission must bind that separately to current rights. A separate development-only compile_with_dependency_closure API can compile the retained signed graph: bare imports stay inside the importing package, and qualified domain:id@version/path imports require that package's direct signed dependency. Compilation retains exact source and compiled-image identities but grants no right to run.

A further development-only verify_dependency_rights API binds every protected physical dependency to separately trusted, signed commercial facts, including protected packages reached through public intermediaries. Its inspect_current method rechecks current unlimited grants and fresh local policy in dependency order. Packages may share a grant covering their exact release set, but each package is checked. The V3 source adds an explicit verify_dependency_rights_with_entitlements variant for independently signed commercial prerequisites outside that import graph. Each entitlement selects an exact release, independent publisher anchor, signed descriptor and issuer policy. It adds no module resolver, package payload or right to import code. Signed requirements link product/release-set groups; cycles, unused entitlement material, physical selector collisions and duplicate entitlement groups refuse. V3 source now admits selected finite prerequisites only for the existing accepted-report adapter. Four actual HTTP journeys and 73 focused library checks pass for this join on retained native diagnostic source; broader verification remains incomplete.

The selected administrator-owned Solution catalog now accepts an optional dependencyClosure containing exact publications/objects, independent publisher policy, signed commercial facts and local prerequisite approvals. Its optional entitlements array supplies commercial-only prerequisites. Each entry contains publisherId, publisherKeyId, release, descriptorEnvelope, issuerPolicyEnvelope and approval; approval.packageId is the unique local selector and must not shadow a physical package. Publisher keys must already be in the administrator's publisherPolicy; delivery files cannot enroll them. The approval has the same exact grant, product, release-set, descriptor, issuer policy, trusted issuer, minimum revision and export-policy fields as a physical prerequisite approval. In V3, optional allowedMode defaults to unlimited; explicit prepaid binds finite report-charge selection to the signed facts and selects current finite admission for the accepted-report adapter. A null or unknown mode refuses. Deliveries cannot choose this administrator policy. Omission preserves the earlier physical-only catalog; explicit null refuses. No additional publication or objects are supplied for an entitlement. Startup preparation binds those facts to the compiled graph; it does not install grants or authorize execution. Shared catalog limits count repeated inputs across plans: 32 plans, 1,024 supplied objects/artifacts and declared publication objects each, 256 publications and publisher anchors each, 255 combined physical and entitlement commercial entries and approvals each, 16 MiB encoded payloads and 4 MiB metadata. These limits are checked before catalog cryptography or compilation.

These observations alone are not execution permits. The selected management service holds the complete root/prerequisite grant-reader set through dependent load and report callbacks, checks every protected node's current rights, and registers that complete set before effects. Prerequisite revocation selects and drains affected roots while retaining each root's own code and primary grant identity. An unstarted retained report rechecks rights before restoration and immediately before staging; already-dispatched recovery does not stage again.

Preparation/resumption, signing input/completion and fresh activation/refill also require current prerequisites. Retained proof export, terminal closure and exact accepted activation/refill replay remain separate historical operations; replay verifies the original receipt and never adds capacity again. The owner's existing cancellation and transcript/head checks still apply. Source Solutions may use public or explicitly provisioned protected physical prerequisites. V3 finite and unlimited entitlement source uses that same prepared admission, complete lease set and reverse revocation index. Exact pure scalar extension dependencies use the original selected runtime and accepted-report replay child. Portable Solution DATA restoration below requires that same signed delivered source and current complete local grant graph; archive DATA cannot import paid-report authority. No ordinary calculation path consults these policies or leases; the costs belong to selected admission and publication.

Four local native HTTP reference journeys now pass for protected unlimited and finite physical or entitlement prerequisites. Committed evidence contains the selected calculation; exact retries spend no additional unit. In finite cases, the child has one unit and the root has ten: the first report leaves child zero and root nine, and child exhaustion leaves the root balance and artifact count unchanged. Prerequisite revocation drains the model, while the original report remains recoverable after cold restart without loading code or adding debit. These are development tests with public fixture keys and temporary stores, not marketplace transactions or a complete dependency-graph product claim.

The entitlement increment is still under verification. Five isolated signed-fact graph checks and twelve isolated graph/charge-binding checks pass. The actual Host library now compiles, and all 58 selected native checks pass, including configured consent/activation/refill, real loaded-model drain, historical replay, unstarted recovery and report-lease behavior. Selected grant source files stayed unchanged, but concurrent compiler inputs changed during compilation; this is a retained diagnostic result, not immutable current-candidate proof. The separate executable target initially failed in newer concurrent compiler changes. After those compiler repairs, attempt 11 compiled and all four HTTP journeys passed. Selected grant production and HTTP-test source hashes match before/after/final; other compiler, ETL and persistence inputs drifted during compilation, so this remains retained diagnostic evidence. The newer finite-admission/report-context library run passed all 73 selected checks. Its selected source hashes match before/after/final, with other concurrent compiler/persistence input drift and no input changes during tests. Broader lifecycle, platform and Performance support are not complete.

Exact extension source compilation in V3

A separate development API can now verify and compile a signed Solution's pure extension packages. VerifiedSolutionExtensionClosure::verify checks the exact registry release, canonical manifest pin and executable artifacts using an independently provisioned publisher anchor. Manifest identity and signed-release identity remain separate. Missing packages, extra packages or artifacts, conflicting pins, changed bytes and incorrect publishers refuse.

VerifiedReportSolution::compile_with_extension_closure then uses the existing compiler and compiled model. Each USE "pkg:publisher/name@version" must appear in its actual importing package's signed extension list. A child cannot borrow a root or sibling pin; an authenticated inventory is not an ambient package catalog. The inventory is bound to every exact signed DomainPack release. Pure public and protected code can be prepared; seeded and effectful packages refuse.

The separate development API can pair that inventory with signed commercial facts using verify_dependency_rights_with_extensions. Every protected extension needs its own descriptor and issuer policy authenticated by the inventory's independent publisher anchor. Public packages need no commercial facts. Missing facts, extra facts, cycles and substituted product, release set, key or signed release refuse. Legacy rights verification refuses extension payloads, so a DomainPack-only proof cannot omit their custody.

Fresh Owner inspection checks every protected extension in prerequisite order, including finite grants using the accepted-report adapter. Shared exact release sets retain one canonical charge per grant. Inspection and charge preparation reserve and spend nothing. An extension's signed commercial requirements grant no package import visibility; each source still needs its own signed pin.

The selected startup catalog now accepts optional dependencyClosure.extensions material: independently provisioned publisherKeys, exact packages, and commercial facts for every protected package. Each delivery names its canonical coordinate and publisher key ID, carries canonical unpadded base64url release and manifest bytes, and supplies the exact artifact IDs/bytes. Extension commercial packageId and the existing local approvals.packageId both use that canonical pkg:publisher/name@version coordinate. Public packages have no commercial facts or grant approval. Trust keys are administrator policy, never adopted from the delivered envelope. Omitted configuration preserves the previous contract.

Catalog preparation pairs the sealed extension inventory with the existing signed commercial graph and compiled model. It retains complete prerequisite grant IDs for leases and reverse revocation discovery, and canonical finite report charges. Shared release-set/grant aliases retain one charge. The shared catalog counts DomainPacks, extension deliveries, entitlement-only requirements and Libraries against the same bounds before decoding, signatures or compilation. Extension release/manifest bytes count as supplied objects; there is no second payload or metadata allowance. This preparation installs nothing and creates no grant, reservation or allowance. The selected local lifecycle now consumes this same prepared plan under complete root/prerequisite leases. Same-owner Receiving Copy/Fork integration for prerequisite-backed and extension-backed Solutions independently compiles the target through the same signed resolver, admits its isolated service before native restoration, and retains the original grant graph and report charges. Native runtime admission registers the complete grant scope even before a first paid report. Historical report recovery stays separate from current execution permission. The October 31 frozen Host library checks pass native publication/retry, exact shared finite charges, prerequisite revocation, real mapped-member close/reopen, and abrupt post-result acknowledgement loss followed by two cold recovery processes. Both physical and entitlement-only prerequisites and finite/unlimited modes are covered. This is the selected same-owner native profile; archive admission, different owners, arbitrary engines and broader platform/cost closure retain their own requirements. See the integration ledger for exact source boundaries.

V3 also has a private native loader seam for the exact compiled extension inventory. It requires the actual held root and prerequisite grant leases, fresh Owner admission, and charge selection matching those same local decisions. It prepares an unshared pure runtime, uses the existing compiled-model loader, then attaches the isolated service before restoration. The existing Library compensation guard covers partial load, attachment and restoration failure or unwind. A foreign live image refuses before any resident mutation. Preparation and loading debit nothing; the accepted-result operation remains the only accounting owner.

Finite extension installation uses a distinct accepted-report embedding contract, never an unlimited-rights witness. That contract admits only pure exports and retains no commercial callback in calculation. Selected local loading attaches that runtime before collection/input replay or ONCE evaluation. Required initial and ONCE publication use the existing model journal and exact saved compiled model; restoration failures drain cloned native handles while preserving durable files and receipts. The selected loader retains the stateless compiled-model lane and does not prime a second incremental resident. An interrupted ONCE save can leave a published first image without a completed facade. Selected cold load reopens the journal’s published current record and verifies its exact saved record and compiled-model container before restoration. Missing or changed files refuse; this path never recreates them.

Report publication rechecks current graph rights under those same leases and uses the existing coupled accepted-result transaction. Exact pure scalar calls with no capabilities carry opaque custody from their actual installation; immutable replay material retains their manifests and executable payloads and verifies them against every exact compiled-model binding. Ordinary installed packages or caller-supplied pure metadata cannot create this custody. Other extension publication shapes still refuse. Loading and ONCE capture debit nothing; accepted publication charges each finite prerequisite grant once, including shared packages. Exact retained retries recover their original operation and never restore revoked code or spend again.

Solution unload, deletion and root/prerequisite revocation use the startup plan and existing isolated-service drain. Cloned runtime handles lose execution while saved inputs, paid evidence and Owner balances remain under their original owners. Foreign live images refuse. The current V3 source has 94 passing selected native checks: two installation/replay-custody contracts, 83 Host component checks and nine mounted HTTP checks. Four signed Luau journeys cover public, unlimited, finite and shared finite grants through these boundaries, including interrupted ONCE recovery. This evidence is local macOS ARM64; broader platform, fault and paired cost evidence remain open.

Before package crypto or decoding, preparation checks at most 255 distinct packages, 1,024 declared pins, 1,024 supplied artifacts, 16 MiB of supplied release/manifest/artifact bytes and 4 MiB of metadata. Repeated imports share the existing 256-attempt and 16 MiB delivered-byte ceilings with source modules; each failed lookup or limit violation refuses the whole compilation. These bounds do not claim a measured compiler memory or latency budget.

Finite prerequisite accounting in V3

The development owner now has an atomic accounting primitive for one accepted result charged against several finite grants. A trusted selected adapter must supply the exact canonical charge set after publisher and current local admission. This primitive alone does not authorize a dependency or enable the Solution catalog's finite prerequisites. V3 source now joins current finite admission and the Host publication request; four native HTTP journeys pass. V3 binds an independent selected mode to exact signed requirements and derives canonical report charges at startup. The existing report context carries that sealed set into its complete retry identity; it does not accept charges from a request. Twelve isolated graph/binding checks pass on retained source. The actual Host library's 58 selected checks also pass on retained diagnostic source; concurrent compiler input changes prevent immutable source attribution. Attempt 11 then passed all four actual unlimited/finite HTTP journeys. The new library run passed all 73 scoped checks, including finite provisioning/current admission, runtime drain, revocation leases and report contexts.

One owner transaction reserves the root and every prerequisite, or reserves none if any grant is missing, stopped, mismatched or exhausted. Shared graph members covered by the same grant spend one unit; a prerequisite scope covered by the root grant adds no second debit. The retained operation binds product, exact releases, meter and each grant's debit proof. Changing that charge set on a retry conflicts. One authoritative result settles all debits together. A durable no-effect closure releases all of them; an unknown result keeps all uncertain. Repeated unknown recovery adds no transition. Revocation does not confiscate a retained result's completion path.

The selected request is limited to 255 canonical prerequisite scopes, 64 exact releases per scope and 64 KiB encoded request material. Held-reservation and completion headroom limits count debit units, while active attempts count parent operations. Each grant's checkpoint includes its own prerequisite debit sequence and the complete parent operation commitment. The existing private redb owner transaction, result-authority contract and checkpoint mechanism provide these guarantees; no separate database, evaluator or polling process is introduced.

All 28 focused local owner checks passed on their retained source: 12 new multi-grant cases, 14 checkpoint regressions and two commit-failure regressions. They cover competing last units, exact replay, root/shared-grant accounting, no-effect fences, lost acknowledgments, cold recovery, per-grant checkpoints and failures before and after durable commit. The test result authority uses a real durable store, but is not the Host's evidence publisher. This proves the owner primitive, not a complete finite dependency journey, power-loss behavior or an accepted Performance budget.

What exists and what remains

Core has strict signed-grant and publisher-policy verification, selected unlimited extension admission, and a local finite-allowance owner with restart, duplicate protection and fenced cancellation. Neither default Lite nor Pro enables the grant owner. Local tests and component measurements do not establish full-system scale, cross-platform support or physical power-loss guarantees.

Core also provides strict challenge, owner-consent and purchase/delivery receipt verification for future provisioning clients. Exact quote, policy, recipient and owner bindings are checked independently of signature validity. These development APIs do not themselves approve spending, retain consent or activate a delivered allowance.

The selected local owner now has a separate durable consent API: it retains approved terms before asking an enrolled signer for a proof, saves that proof before returning it, and recovers the same bytes after restart. Cancellation blocks late signing completion; explicit resumption keeps the original nonce. Initial activation now installs the delivered allowance and consumes retained consent in one durable transaction. Duplicate delivery cannot restore used capacity. These embedding APIs are not themselves public provisioning endpoints; the selected authenticated local bridge below supplies one bounded host integration.

Initial finite and unlimited deliveries can also be checked as a complete signed set, including the seller's exact offer and the target's consent. Carried-file verification rejects altered entry labels, missing or extra facts and wrong recipients. Verification alone is not installation authority; the selected host requires its own approved plan and retained consent. Refill verification checks the complete signed set against the locally retained allocation, checkpoint and issuer receipt. Its offline-file form uses those retained facts without network access. The selected owner retains refill consent and activates the allowance atomically, preserving later consumption and uncertainty. Concurrent retries cannot install another allowance. The selected local host now connects refill under separate exact transaction permission, retained consent and actual startup-verified Solution admission. Broader deployment/export policy bridges and the complete protected-model lifecycle remain unfinished. The local hosted journey now exercises refill after ten actual report publications: five additional units permit exactly five more reports, and replaying delivery before or after consumption never restores spent capacity. This is local integration evidence, not a claim of live-service or field deployment qualification.

Signed aggregate checkpoint and issuer-acknowledgment verification now checks balances and history without including model contents or individual results. An acknowledgment never restores uncertain units. The selected owner captures a consistent checkpoint and retains its signed bytes across restart, without pausing later report work during signing. It also retains the issuer's exact accepted acknowledgment without overwriting later consumption or uncertainty; delayed receipts cannot rewind the accepted checkpoint. Core's owner APIs now support an external enrolled signer: export a retained snapshot's exact transcript, verify and retain its returned signature, and recover the original proof after response loss without another signing call. Each step requires current export authority. These APIs never restore an older balance or expose the snapshot's private commitment key. The selected host now connects these checkpoint actions and issuer receipt retention under exact grant/action permissions and startup-enrolled public keys. No model contents or individual results are sent. Broader deployment policy bridges and the complete authenticated product workflow remain unfinished.

An explicitly selected local host now has authenticated grant/consent inspection, consent cancellation and approved Library/Solution consent preparation/resumption. A startup-owned plan binds the signed artifact and exact approved terms before a caller can prepare consent; Solution plans also retain compiled source. Library commercial prerequisites use a selected local profile on main. The selected Library catalog accepts dependencyClosure with independently anchored entitlements and complete local grant selections, using the same signed graph and original Owner as Solutions. For Libraries, physical publications, commercial, approvals and extensions fields must remain empty or absent. This material grants no code-import visibility. Only unlimited prerequisites are admitted beneath unlimited Library calls; finite report accounting retains its existing adapter. Fresh consent/load and Source recovery retain the complete grant set; exact historical delivery replay retains its original receipt. The October 31 frozen Host library checks pass actual Luau calculation, transitive rights, complete leases, failed-drain retry, unrelated model isolation and cold/process-crash receipt recovery for this profile. Signed core-Wasm and Native/Python lifecycle checks also pass, including actual guest and LIR results, original Owner reopen, receipt replay, signed revocation and physical drain. On macOS, Native identity inspection uses the existing narrow Runtime Links resolver for Python framework executables without broadening the sandbox. That earlier frozen Host selection passes 258 tests. The selected persistent Native instance profile below has its own source and validation record; installed policy and wider platform/cost closure retain separate scope. The selected local service requires signed runtime principals and exact startup-owned action/object permissions, and runs only on a loopback listener. It does not create an owner or signing keys or approve spending. Default builds/startup do not enable it. The ordinary local service refuses strict-mission and cloud-organization profiles. The separately selected organization adapter below has its own source implementation and unrun validation record.

The selected endpoint can export the exact retained consent transcript for an enrolled signer and verify/retain its returned signature. Each half requires current permission; exporting a transcript does not authorize later completion. Cancellation between them refuses completion, while valid retries recover the original proof after restart. No private signing key is generated or imported by this endpoint. A separately authorized delivery route can install the initial rights against that retained proof and the verified Library or Solution, with restart and replay recovery. Library activation creates no finite allowance. Activation does not install code into a model or authorize report publication. Prepaid refill uses its own authenticated delivery route and exact transaction permission. The independent CLI supplies explicit consent/checkpoint signing and carried-file drivers; full hosted lifecycle protection remains unfinished.

A separately authorized local action can retain an issuer's signed proof that a purchase was closed without issuance. This permanently closes that consent; unlike cancellation, it cannot be resumed or activated later. The original signed reservation and closure remain recoverable after restart. This neither restores spent capacity nor closes the external purchase or refunds payment. The private development allowance store accepts schemas 8 and 9. Only an explicit coupled reservation selects schema 9; older formats refuse without resetting history. Schema 9 cannot be opened by an older schema-8 binary.

An independently authorized local route can install an issuer's signed notice stopping future admission and recover its original proof. It preserves balances, already reserved work and recovery rights; it cannot reinstate a grant or refund units. Disconnected owners learn the notice only when it is delivered. For Libraries loaded by this service, the route drains the indexed resident models before acknowledging revocation. It does not introduce licensing checks during calculation.

The trusted Core embedding API durably retains the verified pending stop before draining residents. Invalid or unauthorized notices cannot invoke the drain; failed or interrupted drainage remains fenced after restart. Exact retries can finish the stop, and a failed commit never automatically restores stopped models. The service owns a bounded load/revoke index and the HTTP host retains normal ownership/replacement fences. Store-only embedding methods cannot acknowledge a stop while that service has indexed Library residents. Hosts must drain before replacing the management service itself; its index is process-local, and persisted models reopen only through current admission after restart.

Carried-file consent, initial activation, checkpoint and refill tools now use these contracts. Provisioning a new owner and its startup-approved support remains an embedding responsibility; the tools cannot bootstrap trust from buyer media. Additional package-kind adapters remain unfinished. The private embedding API trusts enrolled host code; it must not be exposed directly as a request-controlled authorization endpoint. These software-managed rights do not prevent an administrator from modifying the runtime or cloning its state.

Registry issuance and CLI provisioning belong to their independent repositories. Core now supplies a shared typed decoder for local management failures, with fixed error/status mappings and frozen client/host conformance fixtures. Unknown or malformed replies remain unknown outcomes; they never trigger an automatic purchase, refund or fresh operation. Report successes now also have a typed decoder that checks transaction, operation and expected grant identity and keeps reserved/uncertain outcomes distinct from committed results. It does not itself verify a signed receipt or change allowance. Authenticated capability discovery now reports the caller's permitted actions on the selected local host, with a request-bound client decoder. It excludes reserved original-root recovery and unavailable runtime/deletion operations. The list is not evidence that a particular grant, model or allowance is ready; every operation still checks its exact authority. Load, unload and delete replies now also have a shared typed decoder that checks the expected model/image and operation identity. Solution deletion keeps its paid-evidence and protected-ID assurances distinct from Library deletion. A first dynamic load can return an explicitly host-reported image for later comparisons; that observation is not independent verification of compilation. Grant inspection also has a shared bounded decoder that checks owner identity, lossless counters and conservation. Its snapshot does not authorize execution: free units cannot override a revocation or recovery requirement. Consent replies now distinguish preparation, cancellation, inspection, initial/refill activation and terminal closure, with exact receipt comparisons for recovery clients. A cancelled consent is not necessarily closed, and a local acknowledgment is not payment evidence or execution authority. Proof and signing replies now have bounded, request-bound decoders too; their bytes still require the existing transcript/signature and authority checks before use. Checkpoint snapshots, acknowledgment retention and revocation installation also have bounded, request-bound replies. All 29 advertised local actions now have shared success contracts and frozen examples. Consent and grant-inspection codec encoding preserves the frozen deterministic object-key order across packaging feature sets, including nested receipts and owner identities. Required nulls, lossless counters and strict decoding remain unchanged. This is client interoperability support, not a completed provisioning workflow: clients must still verify signed facts and independently compare the expected checkpoint, acknowledgment digest or notice head. Grid supports multiple independently authorized marketplaces. Marketplace purchasing is unconfigured for this carried-file delivery. Stripe belongs to the Grid Cloud offering; it does not become a grant protocol dependency.

Selected organization service

A source implementation connects the explicitly selected enterprise server to Core's original commercial service. It remains uncompiled and untested under the owner's no-build direction. The ordinary local grant listener keeps its existing profile restriction. This connection creates no issuer, signing keys, grant Owner or permission to spend.

Select the existing enterprise-server process and private enterprise deployment configuration, and provide GRID_EXECUTION_GRANTS_CONFIG with the original recipient/catalog/action policy. The existing principal key remains configured; the enterprise adapter obtains user identity from its native session, never from forged local-principal headers. Grant storage and enabled ledgers must already exist under the admitted Journals root, model/table homes under Models, and disk Backbone/Jobs under Queues. Paths are canonical and absolute. An explicitly selected Source profile needs its original Source root. This adapter refuses ordinary peer transport; it must not create an unaudited delivery worker.

The fixed browser endpoint is POST /internal/runtime/enterprise/execution-grants. The existing facade bearer, session, CSRF and origin requirements apply. Its JSON envelope carries route, payload (the exact original grant request as a JSON string), expectedSecurityRevision, expectedPolicyRevision, and modelId for model actions. New Library/Solution admission and replacement supply sourceReview with runId, definition, sourceRevision and sourceArtifact; the real native workflow/artifact owners verify the approved exact source. Report operations also supply registered disclosure destination/purpose. These fields identify existing facts and cannot grant approval or establish a destination.

Routes cover the existing management, capability, report, Library/Solution load, unload/delete, replacement, activation, refill, checkpoint, closure, status and revocation owners. A separate recoverLibraryReplacement route uses the same original replacement request and may finish a published operation stopped; cancelLibraryReplacement closes only an existing unpublished original. Neither can prepare or evaluate. Restore, raw source ingress and arbitrary RPC routes are outside this selected envelope. Model permissions are independent of commercial rights. Organization-wide controls additionally require current security administration and the exact original action/object policy.

The existing enterprise audit owner reserves a digest link to the actual encoded original reply and its terminal record before dispatch. Lost replies and restart recover through the original grant/native/result owner, preserving its operation ID. An interrupted audit completion is unknown; it never authorizes a replacement execution or restores capacity. Shutdown uses the same indexed resident drainage and original instance worker disposal. Pending or uncertain retirement keeps its custody fenced.

Persistent Native instances

The source implementation is checkpointed with validation incomplete. The final installed Native crash/reply-loss suite and Host binary/example checks remain pending; see the Execution Grants ledger. The profile below describes the implemented opt-in contract, not a completed validation or production-custody certification.

execution-grant-instances is an explicit Core build capability, outside edition and ordinary execution-grants defaults. The immediate custody profile is a private directory owned by the local OS account, capability-free Native V5/V6 Rust, C/C++ or .NET persistent exports, and an unlimited Library admitted by the original grant Owner. This selects the existing LIR and Native execution paths. It does not certify an external SDK, production custody or another platform.

Select GRID_EXECUTION_GRANT_INSTANCE_WORKER at trusted startup. Use that same stable identity as GRID_EXTENSION_WORKER_ID in the existing extension-worker command. The normal extension/effect/Backbone settings and exact package catalog remain required. No formula, guest, portable file or HTTP request can select this capability. Native model admission binds its original Jobs directory identity, store identity and worker into the existing native admission digest, together with owner, grant, incarnation and exact executable revision. A plain compiled Library or copied admission marker cannot create this loan.

Prepare a fresh absolute Jobs directory before any clients start. Set GRID_BACKBONE_JOBS_ENABLED=1, GRID_BACKBONE_JOBS_STATE_DIR to that private path, GRID_BACKBONE_JOBS_OVERFLOW_POLICY=reject, and a bounded GRID_BACKBONE_JOBS_MAX_WAL_BYTES in 1–256 MiB. The explicitly invoked local preparation helper is:

cargo run --manifest-path rust/Cargo.toml --locked --offline \
  -p grid-runtime-host --no-default-features \
  --features lite,execution-grant-instances,extensions-native \
  --example prepare_execution_grant_instances

This prepares the required format in the original Jobs owner. The first native admission binds this private namespace to one original grant Owner; another Owner cannot borrow it by reusing a model label. The helper neither upgrades a live legacy queue nor creates a grant Owner. Older readers reject the required snapshot format. Admit and publish the native Library model through its original lifecycle journal before starting its configured commercial worker. At worker installation, a nontransferable borrow of that original durable admission certifies the exact package digest; the worker opens no second grant Owner. Changed package bytes, a missing native loan or another worker fail closed.

The original Jobs operation records its worker generation and dispatch fence before guest execution. Create, call and dispose retain exact original outcomes; reply recovery reads those receipts. Original snapshot installation and durable publication prepare typed local result views. Model admission binds its exact scope to that view; formula getters decode no worker control metadata and perform no storage or service polling. Generic cancellation, retry, lease expiry, eviction and reclamation cannot reissue a started instance operation or remove its evidence. Principal quotas are shared across model scopes and account for retained old-generation receivers. Receipt and byte saturation refuse before another effect; evidence is never dropped to make room. Each dispatch reserves its bounded output and failure publication plus 16 KiB for retirement. Unstarted operations and active scopes reserve retirement space too, so later queue pressure cannot consume room promised to original disposal and terminal receipts.

Model stop durably fences new ingress, waits for original constructors and calls, and records disposal intent before disposing receivers at their original worker. This also covers expiration and an unpublished constructor handle. The selected worker freezes its configured shutdown grace at startup; a busy timeout retains physical custody. Failed disposal retains the same Native session for reconciliation; a second disposal operation is not a repair. Terminal model receipts bind original operation receipts and physical receiver closure. Stop-only recovery can open the native-bound original Jobs owner with effect ingress disabled. A missing or replaced directory refuses.

A failed terminal acknowledgement can be reconciled from the original live runtime's cached outcome without invoking the guest. After a worker crash, an operation lacking a durable outcome remains uncertain at its original generation. An empty replacement registry cannot prove disposal or authorize another constructor. Known receipts remain recoverable, but uncertainty cannot be turned into a successful drain, refund or replacement operation. An authenticated readmission after a terminal stop selects a new activation in that SAME Jobs owner; warm retries and cold recovery retain the current activation. The old operations and receipts remain immutable, and a pending or uncertain retirement cannot authorize the next activation. These are process-crash semantics, not a hardware power-loss claim.

Carried-file operator commands

The independent CLI now exposes gridctl grants help. It prepares selected management and checkpoint requests, signs exact owner consent/checkpoint transcripts against an independently approved body, imports an initial/refill carrier, and calls authenticated local grant and incarnation-bound model routes. Inputs and outputs are bounded files; outputs must be new. HTTPS is required except for literal loopback HTTP. Access-token authentication and separately signed principal authority are both required by the client. Unknown responses remain unknown outcomes; the client does not retry an effect or purchase rights.

The independent Registry exposes grid-registry grants help. Its explicitly selected local development journal retains purchase reservations, checkpoint acknowledgments, initial/refill signing intents and complete delivery bundles. The journal reserves a refill's current issuance head before acceptance and preserves the original receipt across deadline expiry, restart and replay. Unsigned or ambiguous issuance prevents no-issuance closure. Current operator policy and public-key pins come from an independently managed configuration. This local issuer is not a production authority-service fallback.

A carrier is not authority. The CLI's activation and refill-activation commands extract opaque request bytes; the target owner checks its own retained consent, support closure, current policy and live accounting before admitting them. Refills add only the signed purchased units, never the checkpoint's balance. The selected owner must already be provisioned; these commands neither enroll an arbitrary owner nor import a remote private journal.

Keep the original signed grant, recovery checkpoint and owner identity together. Review the exact requested action and its live accounting before accepting any recovery or refill; a checkpoint does not transfer execution authority.

0.71.1 recovery fixes

The 0.71.1 patch corrects original-storage digest comparison, fresh Source10 transaction framing, commercial directory publication proofs, and specific operation errors returned through root recovery. Existing retained journals and authority checks remain required; malformed or substituted data is refused.

The 0.71.1 patch left mapped-root observation unsupported. The selected source increment described below adds a retained-output reader; its compilation and installed validation remain unrun. A recovered data image does not authorize execution through a generic provider. Marketplace purchasing remains unconfigured; carried-file tooling is unchanged.

Selected native provider recovery

A completed original capture can continue after its Host, Source, producer and outgoing owners reopen. The authenticated provider retry selects the original model from the retained producer slot and MAC-bound Source frame, even when no HTTP facade or resident compiled model exists. The original worker reacquires the physical image and current publication authority; continuation does not load or evaluate the cold model. Its Source registration remains under the selected owner instead of entering ordinary stale-subscription cleanup.

Custody discovery alone is insufficient for a retained producer capture. Outgoing startup additionally verifies the original completed native frame. Reserved or captured work without that completion refuses startup, preserving its original cursor and durable obligations. Revoked completed work may still finish authenticated DATA cleanup, without admitting future execution.

Nonempty original provider fanout remains owned by the existing outgoing runtime. Selected durable ingress uses Grid's numeric representation in outgoing snapshots while retaining the authored provider/Stream DATA and receipt identity. Exact HTTP body validation checks every serialized field and excludes process-local receipt instants. It streams comparison into the existing bounded body without allocating a second encoded body. These changes belong to selected startup, ingress and publication; they introduce no evaluator, worker, queue, timer or journal.

Selected native organization and review bridges

The native ManagementService::load_library_for_organization composes the actual enterprise security owner with the current commercial Library lease. The embedding must lend the same exclusively held EnterpriseSecurityStore that owns its live sessions and permissions. A cookie digest alone is insufficient: native provider revalidation, CSRF evidence, current security revision, organization identity and model Run permission must all agree. Restarted session metadata needs provider revalidation again.

The selected embedding supplies an independently pinned workflow definition, run, source revision and committed source artifact. The approved native workflow must include human approval, and its artifact bytes must equal the requested Library source. Its existing writer fence stays held through publication. Use context.initial_storage_authority(existing_authority) with the original native journal: the borrowed context checks current organization/session authority at reservation, initial publication and ONCE record updates while the existing filesystem authority still verifies the exact bytes.

report_for_organization checks the actual ReportUsePolicy purpose against a registered native ResearchExport destination. It uses Restricted sensitivity and Identified identifiers conservatively. Current Run, Export, security revision and disclosure revision are required at execution, retained recovery and publication; the existing artifact/status review and commercial result owners remain in charge. An unregistered destination, stale revision or expired session refuses. These are explicit native embedding bridges. The ordinary signed-principal HTTP listener has no enterprise session loan; its unguarded strict-mission and cloud-organization startup profiles continue to refuse.

Observe an authenticated completed checkpoint

A physical OriginalStorageManagementService<true> opened over the authentic completed Source/native owners exposes observe_checkpointed_library. It accepts 1–256 unique declared symbols and reads the retained native Final/Source Completed output frame under current management and commercial rights. Cold observation uses the same admitted native Host and charged image cache. It never evaluates a formula, advances a cursor, acknowledges producer work or debits a grant.

The response protocol is grid-execution-grant-checkpoint-observation/2 and carries exact model/incarnation/source/executable/allocation identity, requested typed values and executionAuthorized: false. Unknown or missing symbols, partial frames, native tree transport and revoked rights refuse the complete request. The Desktop completed-original/terminal-recovery-original snapshot path uses the same authenticated native completed-frame owner. A recovered data image never authorizes a generic evaluator.

Completion also supports a selected Source10 publication with no outgoing children: the original transaction remains authenticated and retained. Before claiming ONCE, the selected host admits bounded memory for terminal evidence. Completed-owner cold reopening checks the exact canonical compiled-model identity before exposing retained output. The completed-original journey covers warm/cold observation, revocation refusal and release of its operation memory charge. It does not authorize checkpoint execution.

Carry a captured ONCE value through an edit

The source implementation of the existing Library replacement request supports an explicit onceValueTransfers list. Use this when a changed or renamed ONCE assignment should keep its already captured value. Each entry identifies the old and new cells, both compiler expression fingerprints and the original value digest. Core reads the value from the authentic saved predecessor; the request cannot supply a substitute value.

For an installed Rust client, construct the request from the actual old/new compiler contracts and the original saved value:

let transfer = OnceValueTransfer::new(
    original.cell,
    original.expression_fingerprint.clone(),
    candidate.cell,
    candidate.expression_fingerprint.clone(),
    once_value_digest(&serde_json::to_vec(original.value.as_ref().unwrap())?)?,
)?;
let request = request.with_once_value_transfers(vec![transfer])?;

OnceValueTransfer and once_value_digest are exported by grid_execution_grants_core::local_library_replace. Cell IDs use lossless strings on the wire; use compiler identities rather than guessed addresses. Digest input is the original value's exact serde JSON encoding. The structural fingerprints select contracts; current signed source/LIR and native record checks provide authentication.

The edited assignment receives that old captured DATA. Its changed formula is not executed to produce a replacement value. Repeat the exact original request after a lost reply: the same native operation and frozen result are recovered. Changing or omitting the migration on that operation refuses. Existing effect operations, receipts and grant ownership stay with their original owners.

An absent or uncertain original capture cannot be migrated this way. Migrations are one-to-one, sorted by destination, limited to 256 entries, with 1 MiB per value and 4 MiB total. Native tree values and invalid contracts refuse. Broader live-state transformation and fresh effectful ONCE capture remain implementation work. Compilation and all authored recovery contracts are unrun by owner direction.

Original preparation before fresh ONCE effects

Core source now connects a bounded frozen-request, nonpersistent ONCE profile through the installed Library replacement coordinator. Actual Management, current grant/compiler, Host, model fence and exact input/file owners authorize the original claim. A busy response retains the same original operation while its actual worker settles. Formula evaluation never contacts a transport or polls a service. This source path has not been compiled or exercised.

The coordinator claims exact original Native input/LIR/inventory bytes, retains the original files, admits only the frozen requests to their original Jobs root, and replays authenticated outcomes in the same LIR. A held Native writer joins the actual file and closed Jobs owners for one Seal attempt. Existing selector publication and Finished owners complete installation. Missing final files use the exact sealed Native bytes without recomputing values. Explicit surrender requires original terminal/proven-unissued receipts and fenced no-publication proof; uncertain started effects stay unresolved.

Broader finite consumption, conditional/dependent effects, Source10/physical, live/collection/Stream and persistent/process joins remain implementation work. Pending blocks generic publication/cancellation and holds its original model head. Seal retains the capacity reservation. Older cleanup code cannot release capture debt while omitting original files. Source10/native14 and physical claim joins refuse until their own integration is installed.

original_capture_authority uses the real compiler-admitted candidate and current Management/grant lease. original_capture_recovery_authority supplies receipt settlement only, including after execution rights end; it cannot create a fresh claim. Neither copied plan hashes nor compiled recovery DATA supply effect or publication authority. Authored cut/reopen, scope and storage contracts are unrun under the no-build restriction; syntax inspection proves no runtime result.

Bounded original worker capture

The actual broker's original_capture_commitment(worker, requests) identifies up to 256 complete frozen nonpersistent requests, at most 8 MiB, together with their original Jobs namespace. Commit that exact digest/count in the original Native claim. The earlier unbound original_capture_inventory is legacy comparison DATA and cannot admit fresh work. After retaining the actual input basis, admit_original_capture additionally requires the original scoped Management/grant/physical authority and physically held runtime worker. A copied Native record or ticket cannot admit it. Both Native/Jobs Owner identities and the candidate model/revision, certified export and model quota identity must agree. The runtime must retain that exact Jobs custody with its physical worker exclusion; a matching worker name in a different root refuses.

The existing extension worker commits its original dispatch fence before entering the guest and writes returned outcomes through the original receipt owner. A lost reply after a durable commit reads that same outcome. The selected actual worker registry now retains the complete returned publication or bounded error before replying and retries it on the existing worker tick after a failed commit. Only the original Jobs owner, worker generation and dispatch fence can settle it; the outgoing cache clears only after acknowledgement. Guest error details cannot act as worker control signals. A started operation with no retained outcome stays uncertain; lease expiry or a new worker cannot run it again. Existing external effect owners must resolve their own uncertainty. Generic queue APIs cannot replace, cancel, retry or reclaim these operations.

surrender_unstarted_original_capture fences the original scope and closes only proven-unissued slots. with_original_capture_outcomes borrows original terminal DATA and receipt digests/counts; it grants no execution, Native Seal or selector publication rights. Callbacks must not recursively mutate held Native/Jobs owners. Original uncertain effects, requests whose arguments depend on previous effects, persistent receiver calls and the full LIR/final-publication workflow still need their owning integration. All authored contracts are unrun; no builds ran.

The outgoing cache shares the existing 64 MiB worker-receipt bound. Capacity is reserved before dispatch; a pre-barrier refusal can release that promise, while a post-entry drop keeps uncertainty. Actual local controller handoff moves that same registry and binds its outgoing inventory in the original Jobs receipt. Publication stays frozen until that transfer is accepted. Another model/lifetime or a cold registry cannot supply that actual custody. This volatile cache does not make uncommitted output survive a process crash and does not authorize a replacement effect. Compilation and the new lost-reply contracts remain unrun.

Atomic original snapshot and missing-inventory recovery

The selected Native replacement APIs can commit an exact original input record, LIR and complete Jobs inventory atomically with the original claim. The matching Seal API commits exact final record bytes with that same Native receipt. These are original storage operations; actual current Management/grant/input/physical proof remains required. The bounded installed driver connects that proof and existing selector publication as described above; broader profiles remain open.

This Library/package profile retains its existing Unlimited admission, including prerequisites. It does not spend finite grants per function call or interpret Jobs cost metadata as a debit. Finite producer composition requires its original execution/settlement owner.

inventory.snapshot_inventory(broker, worker) exports only complete frozen DATA bound to that actual Jobs namespace. admit_original_lir_capture_snapshot reads those original requests and still requires current admission authority. surrender_unstarted_original_capture_snapshot can instead close an original inventory after a crash before Jobs admission: it records and fences the complete inventory in one transaction before it can be claimed. Only proven-unissued slots close; started effects and uncertainty remain with their existing owners. Another Jobs root or changed request refuses. No current input replanning is authorized.

The input-file owner can restore the exact preparation from that Native snapshot when a crash preceded file creation. Old claims without a snapshot retain their original recovery requirements and are not silently upgraded. Native12 and Native13 use the same existing private database/writer; Native13 reuses its control/chunk codec. Snapshot bytes and future final bytes remain charged after Seal/surrender. This development profile does not reserve physical disk. Generic deletion cannot refund retained capture snapshots/history. Source10/physical capture, legacy adoption and paid-history purge remain separate implementation work. Compilation and the authored commit-cut/file/worker contracts are unrun.

Original LIR planning and result replay

candidate.plan_original_once_capture(inputs, cells) uses the existing LIR and an inert transport planner. Its opaque inventory commits the original broker root through inventory.originals_digest(broker, worker). Under the retained original file/native loan, Core's admit_once derives those inputs from the exact basis and submits using the real Management/candidate/physical scope. admit_original_lir_capture addresses the startup-selected worker; it does not borrow that worker process's runtime. Only actual dispatch and settlement need the physically held worker and matching Jobs custody.

After the original scope is fenced and all its outcomes are authenticated, candidate.capture_original_once runs the same LIR with those local publications. It cannot submit a new request, poll storage, or contact a service. Core's input file owner then builds the final record DATA and its original receipt hashes. The LIR invocation context remains unchanged; the native scope carries the real source revision, executable, operation and grant. Current rights remain required for pure package execution. A retained old unbound scope can supply original results or surrender unissued slots, but cannot start a new guest.

This profile supports complete frozen, nonpersistent requests and ONCE policies. Unobserved, conditional/dependent and MAP calls, volatile values, other temporal policies, live/collection/process/rule state and foreign bindings refuse. The full replacement driver, final storage/Seal/publication, consumption/settlement, and post-revocation continuation remain implementation work. Five new contracts, including a signed actual-worker/LIR journey, are authored but unrun. No build or runtime validation is claimed.

Retire an original Source model while retaining evidence

The selected original-storage Core service now has a source implementation of retire_source10_library. Supply the original Library delete request under its existing permission, exact model/incarnation/image and actual Host drain context. The result identifies RetainPaidEvidence, the original native operation and Source retirement, with executionAuthorized: false.

Core requires every original input/publication/outgoing obligation to have its original completion and every input cursor to be at the retained tail. It stops the actual model, commits native Pending, publishes the Source tombstone, and finishes that same native operation. Repeat the original request after a lost reply. Retained model data, Source history, keys and receipts stay intact; their storage charge is retained. A terminal flag does not refund capacity or authorize a new execution.

Core inventories the entire selected already-admitted model home, including old untracked files. The original native key binds names, device/inode, byte lengths and content hashes. Links, changing data and excess inventory refuse. The selected profile allows at most 64 files and 64 directories, with 256-byte relative names and the existing native per-model payload ceiling. Source quota includes those actual bytes. The original startup memory plan needs 512 MiB of available declared operation capacity; this is not an OS RSS guarantee.

This source adapter is for ordinary-root Source10/native14 private-file development custody. Mapped roots use the distinct recovery owner described below. Pre-Source10 Native12/13 retained retirement is described below. Authenticated live legacy adoption and paid-history physical purge remain separate implementation work. Compilation and all lifecycle/crash/cost contracts remain unrun by owner direction.

Retire an older licensed Source model

Core's existing Native12 ManagementService and Native13 OriginalEvaluationManagementService expose the same stop-only retire_legacy_source_library operation. The embedding admits one LegacySourceRetirementStartup using the actual existing model home, model ID, original Source coordinator/anchor and startup memory owner. Paths and budgets are startup choices, never fields supplied by the DeleteLibrary request. For example, with those existing owners already selected:

let startup = LegacySourceRetirementStartup::admit(
    model_id, actual_model_home, original_raw_anchor,
    same_source_owner, existing_working_memory_plan,
)?;
let receipt = service.retire_legacy_source_library(
    &startup, principal, &original_delete_request, &mut actual_host,
)?;

The actual Management permission and original grant/native/source/lifecycle owners stop the original workers and Host, close their existing obligations and retire the same incarnation. Unsettled native frames, unpublished evaluations, unfinished topology or unread Source input refuse; the operation never acknowledges unread work. The Source marker and native Pending/Retire/Finish reuse one original operation. A retry after reopen must supply the same request and unchanged original home inventory.

This retains all original files, receipts, subscriptions, checkpoints, frame keys and history. It reserves target Source history plus the complete actual home inventory and a 64 KiB marker promise in the original native storage counters. Existing limits must cover that debt: 8 MiB of target Source history, 64 MiB of existing-home files and a 512 MiB declared decode allowance. These are bounds/accounting, not measured memory or acceptance at full capacity. Other models keep their own rows and admission. Original receipt recovery grants no execution permission; fresh current work is fenced.

Source schemas 3–8 and topology schema 12 use this path. Source9/input and Source10/11 have distinct owners. Old stores keep their actual private-file assurance; no Source14 key or stronger custody is created. Authenticated live legacy adoption and physical purge remain separate implementation work. The native cut/reopen, quota and installed-owner contracts are authored unrun; only source syntax and documentation checks are available under the no-build restriction.

Retire a recovered mapped Source model

The selected recovery service has a source implementation of retire_mapped_source10_library. Supply the original Library delete request and actual Host, under the same Delete permission and exact image/incarnation. The service uses its fixed startup model home and the original worker/Process stop owners. Unfinished work or unread input refuses until its original owner closes it.

Core keeps the mapped Source file and original recovery certificate unchanged. The original native recovery owner atomically stores a terminal retirement MAC, Source/file inventory, original Desktop receipt inventory and retained storage debt. Current admission and new Desktop rebinding are fenced. Files, paid history, original operations and receipts stay intact; there is no quota refund or new execution/grant owner. The result carries executionAuthorized: false.

For the existing root recovery/observation command, the private configuration's sourceAnchor remains sha256: followed by 64 lowercase hexadecimal digits. Core normalizes it once to the original Source owner's raw anchor at startup.

Repeat the exact original request after a lost reply. Unknown commit state requires existing-only native reopen. A changed operation or file manifest refuses. Read-only mapped DATA cannot supply the exclusive Source retirement lease. Stop-only recovery remains available after commercial revocation; historical receipt access supplies no execution rights.

The mapped recovery service now selects a shared 512 MiB declared operation plan and charges retirement before Source decoding. This is accounting, not an OS RSS guarantee. File bounds and the private-file development custody profile match the ordinary Source retirement described above. Selected physical mapping admission also reserves future native retirement control space; insufficient frozen limits refuse. No file deletion or paid-history purge is implemented by this disposition. Compilation, actual lifecycle/crash checks and costs remain unrun by owner direction.

Hand the same persistent worker to a local controller

The source now provides LibraryLoadContext::prepare_original_instance_handoff for selected installed embedders. Stop the existing runner, retain the actual Host and worker runtime, and surrender the sole worker Arc beneath the original current native Library/grant callback. Preparation returns opaque custody of those same objects. An aliased worker or another model lifetime refuses and returns custody intact. A serialized worker ID cannot supply this operation.

Accept the same capsule for its named local successor controller. The original Jobs owner durably changes the submission epoch before Core rebinds that model's dispatcher. Old dispatchers can recover existing tickets but cannot submit new work. Live receivers, queued/unfinished original calls, outcomes and receipt IDs stay with their original worker generation. Use the accepted controller's with_current inside a fresh original Library callback to run the existing worker; use retire_until for stop-only drainage, including after revocation.

Retry a lost acceptance on the returned original capsule. Do not build another worker to repair uncertainty. A crash that destroys the live runtime retains its original Jobs uncertainty and blocks adoption by a new generation. This bounded local transfer moves the actual worker object; it does not serialize native receiver objects to a different process or machine. History is bounded at eight transfers per original lifetime; exhaustion refuses.

Compilation and all authored lifecycle/crash contracts remain unrun. This source increment does not establish production custody or measured performance.

Account an ordinary Source10 model home

The selected native SDK now has source connections for live home accounting:

// Use the same signed Library request, admitted model home and original owner.
let original = service.account_source10_home(
    principal, &library_request, &accounting_operation, &mut current_host,
)?;

// After a lost reply, recover the saved operation without starting a Host.
let same = service.recover_source10_home_accounting(
    principal, &library_request, &accounting_operation,
)?;

Fresh admission requires the actual live image and current rights. Cold recovery uses from_existing_original_owners_for_home_accounting, the same Native/Source owners, original operation, fixed home root and memory plan. Organization variants also require the real session, approved source review and Edit/Run. A saved intent and exact files are required; recovery cannot create a baseline. Reuse the original operation ID after uncertainty. Changed files need their own disposition owner.

The Source owner reserves the full original manifest, final proof and byte charge before Native preparation. Native retains a matching receipt under its existing initial key and payload quota. Current model admission rejects omitted, pending or mismatched accounting, including a rolled-back Source header. Original output, Source checkpoints, grants and commercial accounting remain with their owners. Accounting grants no execution or deletion authority and refunds no units. Retirement retains the baseline; a phase flag cannot clear its charge.

The manifest is bounded at 64 files and 64 MiB; the selected Source reader needs its existing 512 MiB declared allowance. These are conservative accounting limits, not measured RSS or proven acceptance at maximum capacity. This source increment covers ordinary Source10 Library homes. Mapped homes use the separate immutable Source/Native connection below. Changed-baseline disposition, broader adoption and physical purge remain implementation work. Compilation and all authored native/fault/cost checks are unrun under the no-build direction. No production-custody guarantee is implied.

Account a mapped receiving home

For an already-admitted mapped Library, use its original recovery service:

let original = recovered_service.account_mapped_source10_home(
    principal, &library_request, &home_accounting_operation, &mut current_host,
)?;

// No Host or new worker is needed to recover the committed original receipt.
let same = recovered_service.recover_mapped_source10_home_accounting(
    principal, &library_request, &home_accounting_operation,
)?;

The service retains the actual Source mapping, private home directory and files, volume/inode observations, current rights and exact signed Library image. Native organization variants also require its authenticated session, approved source review and Edit/Run. The Source postimage stays read-only. Native atomically keeps the complete authenticated home plan and its payload charge in its existing owner. An exact earlier ordinary-home receipt is retained and referenced; those bytes are not charged a second time. Changed inventories keep their older liabilities.

Recover with the original operation and exact files. Missing originals, changed homes and replacement IDs refuse. When Native proves a failed attempt unissued, recovery still cannot create it; repeat the authorized admission with the same ID and current image. Retirement retains the accounting receipt and charge. A receipt cannot authorize another execution, deletion or refund.

The same 64-file/64-MiB inventory and 512-MiB declared Source reader bounds apply. The selected Native control promise grows from 128 to 256 KiB to retain the home and future retirement together; prior profiles keep their existing bound. These are accounting limits, not measured resource or maximum-capacity guarantees. Compiler/native/fault/quota/cost contracts remain unrun under the no-build direction. Broader adoption, changed-baseline disposition and paid-history purge remain implementation work; private-file development custody is the current scope.

Read retained output after initial-root recovery

The source now connects OriginalSourceRootRecoveryService::observe_initial_library to retained output without creating a Host. A model that has never completed returns status: "notComputed", empty values and no allocation claim. A completed initial-lineage model returns only the original authenticated output. Missing or uncertain results refuse; observation never runs the model to fill them in.

The local command accepts --observe-library /absolute/private/observation.json alongside its existing --config and exact --confirm OPERATION_ID. The owned private request is bounded by the existing configuration limit:

{
  "schemaVersion": 1,
  "libraryRequest": "<exact original LibraryLoadRequest JSON bytes>",
  "symbols": ["R1C1"]
}

For an existing physical development journal, the recovery configuration also supplies physicalMaximumNativeBytes equal to its frozen Management budget. No new store, key or allowance is created. Repeating resume retains the same recovery operation and original output allocation. The nested observation uses grid-execution-grant-restored-observation/1; it always reports executionAuthorized: false and identifies the original image and grant. Recover, Load/Unload, signed Library and current grant rights remain required. Symbols must be declared, unique and at most 256; raw output/reply are bounded at 4 MiB. Native-tree transport is refused. The selected recovery service owns a shared 512 MiB declared decode allowance, not an OS memory guarantee.

This is source implementation. Compilation, installed lost-reply/crash checks and cost measurements are unrun by owner direction. Private-file development custody does not establish production or hardware custody.

Restore portable model DATA under local rights

Explicit selected local HTTP hosts mount POST /internal/execution-grants/v2/restore-library and POST /internal/execution-grants/v2/restore-solution. Both use protocol grid-execution-grant-portable-restoration/2, transactionId, destination modelId, sourceModelId, disposition (same-identity or new-identity) and zipBase64; encrypted native .gridoc envelopes also accept archivePassword. Same identity requires matching runtime model IDs; a copy requires different IDs. This restores runtime DATA under separately provisioned local rights. It does not transfer FileID/ModelID ancestry or a Solution branch.

Load permission and transaction scope are checked before decryption. Actual load retains the original lifecycle and current grant leases. Libraries require their exact approved package. Solutions require their current signed delivered source, model binding and complete root/prerequisite graph. Source, validated declared inputs, completed ONCE, cell metadata and display name enter the original native initial-publication journal. A Library containing supported Source registrations starts with fresh local native Source custody. Archive checkpoints and producer cursors never establish execution authority in the receiving host.

Passive Arrow Frame DATA uses the existing portable manifest and IPC validator, including schema, nullability, row count and exact record/snapshot binding. Only verified direct .arrow files are staged atomically in the receiving model's original Frame directory. Existing files must match exactly, directories must retain their local ownership, and retries verify resource bytes. Corrupt or extra files refuse. Archive grants, owners, counters, actors, private journals, pending effects, browser handles and other unsupported live adjuncts remain excluded. Archives are bounded to 16 MiB, records to 4 MiB and entries to 256. These bounds also cover extracted resource DATA.

The restoration receipt binds archive bytes and destination coordinates without persisting the password. The original source-admission digest includes that receipt. Substituted archives cannot reuse it; cold retries preserve later local inputs. Normal Solution load/report/unload/delete inherits only that DATA receipt after matching the independently reconstructed local authority and executable. Marketplace purchasing stays unconfigured.

Selected engines, effects and resource stop

Unlimited Libraries select the original compiled extension engines at admission. Pure non-native packages retain their isolated pure runtime. Native packages use explicit host-owned Python/runtime-link configuration. Effectful packages require the explicitly enabled engines and capabilities plus the existing durable coordination effect broker. Missing engines or broker ownership fail closed; effects are not evaluated inline. Ambient persistent instances without the original native model loan remain unsupported. Finite accepted-report replay retains its exact pure scalar/no-capability restriction. Engine packaging still determines which engines are available in a product.

Selected HTTP unload, replacement, deletion and verified revocation join the original model IO/Frame workers, training/calibration and life-science ownership, then evict model-local Frame/table caches. Queued closures are cancelled and settled by their original workers. Timeout retains the same shutting-down owner for retry, so an old worker cannot overlap a fresh executor. Direct selected Library drains join the same owners. Started facade workers retain their original queue entries until their work settles; a pending entry refuses cleanup without discarding it, and retry can retire it after actual completion. Durable effect cleanup cancels queued calls through the original store and WAL; active worker leases remain busy until real terminal completion. Results, fencing evidence and durable DATA are preserved.

Lock/worker waits use the selected operation's absolute deadline. Cleanup and filesystem durability can exceed a wall-clock target; an expired HTTP operation cannot acknowledge successful completion. No new ordinary evaluator, worker, queue, policy lookup or per-cell/per-operation selection is introduced. The shared executor records physical worker retirement under its existing queue lock; selected waits poll that owner and require physical join. Paired ordinary/selected cost and broader platform/power-loss evidence remain separate work.

Local performance and platform evidence

The October 11 measurements use separate uninstrumented latency and resource copies with 48 paired batches per component case. Ordinary executor resource counts match its retained control. Resident unlimited dispatch adds no measured invocation allocations or locks. Selected physical shutdown now measures 22.9 µs at p95 versus 24.6 µs for the ordinary successful join control after removing an unnecessary ordinary notification and bounding short waits at selected stop. These are component measurements, not full native Host overhead certification.

Durable owner acceptance still takes 27.1 ms at p95 versus 9.1 ms for an equally durable successful control. The proposed two-percent target remains missed; no target or historical baseline has been changed. Signed admission CPU, accounting CPU outside durability and integrated restoration peak-resource budgets remain unverified.

Native macOS fault coverage passes 421 Core/Owner checks and 18 original executor/deadline checks. The same frozen signed reader cases execute on native macOS and WASM (six each). Windows portable libraries compile, but native Windows/Linux execution and physical power-loss guarantees remain unverified.

Native pooled execution for distributed model coordination

The explicitly selected native development composition now imports authenticated issuer allocations into the original grant Owner, reserves units before actual compiled-model Process operation dispatch, and settles signed consumption against the original native execution/effect receipt. Unknown effects retain their units; expiry and restart do not refund them. Additional allocations replenish the same admitted profile without rebinding previous operations.

Complete local handoff moves the actual Model, Process, custody, grant accounting and pending delivery owners to one named successor. Current and retained keys move with their original receipts. The current composition requires the same node and original shared stores; cross-node/disconnected mission transfer and external SDK/provider implementations remain separate. See distributed model coordination for the development profiles and their limits. These capabilities remain outside ordinary edition defaults and do not add authorable public Process funding calls.

Deferred original worker package admission

A selected worker retains exact protected configured package bytes until an original admitted operation supplies its actual Jobs/model/worker installation scope. Startup creates no execution permission. Retained DATA is bounded to 64 MiB and 128 bundles, and uses the same selected registry that moves during local handoff. Before guest dispatch, the original scope installs the exact package; a missing or conflicting package refuses before entry. Retained returned publications recover first, through their original owner.

Model stop and revocation fence both original instance and capture namespaces. Only original unissued work can cancel without a guest outcome. Known errors remain errors and uncertain effects cannot be repaired by submitting another operation. Compiler/type checks and the authored installed/fault contracts remain unrun by owner direction. The complete asynchronous preparation/handoff and post-revocation/original-revision profiles remain tracked in the owning ledger.

Original capture revocation after resident drain

The selected source path now discovers unfinished captures through the same attached Native journal during signed revocation and shutdown. A capture stays an obligation after its old resident leaves. Fresh snapshots retain the exact original primary and transitive prerequisite grant IDs from the certified Management lease; claim and admission check that scope. Stop uses those retained bytes even after package configuration is removed. Historical missing scopes remain DATA and fail closed when affected prerequisite coverage is unknown.

The existing Host/model fences and actual protected/live-image checks precede cleanup. Original Jobs owners close missing/unstarted requests as proven unissued; known outcomes keep their receipts and uncertain started effects remain busy. Revocation retains the original Native publication and storage obligations. Stop and pending cancellation now use a scoped client selected by the authentic original Native snapshot. It reopens the exact existing required Jobs custody, including after restart, disabled admission or a change to the current Jobs root. Missing/replaced/corrupt original custody refuses. It neither starts a worker nor admits guest execution. Original outcome reads remain borrowed from that same transaction, and unrelated dedupe history and current-root same-name work are preserved. Unknown original effects still require their actual owner's outcome.

Original executable-revision continuation, broader state/effect composition and pending/capture handoff remain implementation work. Compilation and all authored cold/lost-reply/crash contracts are unrun under the no-build instruction; this source connection is not validated product delivery.

Returned work uses its authentic original executable

The selected replacement source now attempts original returned-work Seal before current compilation. Actual Native, immutable input files and closed Jobs outcomes remain borrowed. Replay loads the retained original LIR and uses only its frozen requests and authenticated returned values. The original input owner must prove the exact saved inputs, pending ONCE cells and signed Library release. The final record retains its original clock and authoring metadata.

Commercial revocation stops future admission; it does not rewrite an admitted operation's terms. Original replay may therefore Seal after that revocation, while current organization/session and engine/capability security still apply. It cannot dispatch another guest, reload a revoked model, mint a grant owner or use the current broker as a missing-result fallback. Disabled security refuses.

Sealed original results now have a source connection through the existing selector publisher and terminal receipt, independent of current compilation or commercial re-admission. The actual Native writer, original Jobs outcomes and visible immutable files supply fresh completion proofs. Current security remains required; receipt-only completion does not reload revoked execution. Resource owners join outside Native/Jobs locks and are rechecked before publication. Original outcomes, metadata, receipts and storage obligations remain unchanged.

Queued continuation, broader state/effect migration, pending/capture handoff and legacy accounting remain open. Compiler/type and all authored installed, lost-reply and fresh-process crash checks are unrun under the no-build instruction. This is source integration, not verified product delivery.

Move an original capture worker with its pending work

The selected source now connects original capture queues to the existing consuming local Host/worker handoff. The same physical worker, original Jobs controls, requests, outcomes and returned publications move together. The named successor must accept the original durable receipt before guest execution can continue. Current security remains required; current compilation and fresh commercial admission do not substitute for original Native authority.

Lost acknowledgements retry that same consumed owner. Process loss does not reconstruct its worker generation or rerun an uncertain effect. The original stop owner can close proven-unissued work and retain known outcomes. Controller history does not rewrite original effect digests or create a grant debit.

This is a bounded single-lifetime source connection. Broader capture/receiver composition and the other gaps remain in the owning Execution Grants ledger. Compilation and all new installed, loss and crash contracts remain unrun.

Account an existing live legacy model

The selected Core SDK source now accounts an existing Native12/13 legacy Source and model-home baseline under the same original owners. The current model stays live; current Library/organization rights, original settled Source receipts and actual held files must agree. The operation adds a durable byte liability, not execution rights, grant consumption or a stronger custody profile.

Retries preserve the original accounting receipt and one charge. Exact retirement transfers that charge into the same original retirement obligation. A changed baseline remains charged until its actual disposition is proven; generic cleanup cannot refund it. History and provider cursors are retained. Broader legacy adoption, Source10 live-home accounting and physical purge remain in the owning ledger. Compilation and all new recovery contracts are unrun.

Use pure source MAP around an original captured effect

The selected source profile can now keep inline pure Lua helpers in the same original LIR capture. For example, pure work can prepare the one frozen request and derive another ONCE value from its original result:

USE "pkg:publisher/library@1.0.0" AS math

DEFINE Triple(value) = <lua type="number" template>
  return {{value + 0}} * 3
</lua>

A1 = math.double(SUM(MAP([1, 2, 4], Triple))) ONCE
B1 = SUM(MAP([A1, 1], Triple)) ONCE

output Result = B1

This example assumes the admitted signed fixture package whose double export is the original effect. Core validates the saved inline source contract and prepares its actual pure code using the existing source factory. Planning only records the complete request. The original Native/Jobs/worker owners execute that request; replay reads their authenticated result in the same LIR. A retry cannot introduce another request or grant owner. Nested pending results cannot be sealed as completed ONCE values.

Every effect request must still be known before the original Native claim. An effect whose arguments require an earlier effect's result remains outside this bounded profile. Durable collection/Stream state and broader receiver composition remain open. Compilation and the authored installed/reply-loss/ process-loss/handoff contracts are unrun under the no-build instruction.

Recover the original code after a package change

The bounded frozen-request capture source now saves the originally verified package in its existing Native preparation before the effect can start. It saves the exact release, manifest, artifacts and original publisher anchor. All saved requests and encoded code share the existing 8 MiB inventory limit and original storage reservations. A larger package refuses before effects in this profile.

If a different signed package is configured later, completing the old operation still uses the saved original code, original input-file proof and authenticated Jobs outcomes. Retrying the old operation retains its request, ONCE values, receipt and grant owner. It does not activate the new package. Current security and required engine capabilities still apply.

The original Jobs control also carries the package DATA. After process loss, a stateless request proven never to have started can run once under the same logical worker and required Jobs custody, even without a configured package directory. An uncertain started request stays with its existing execution owner. Saved code or a receipt cannot authorize another dispatch, recreate a persistent receiver, or repair uncertainty by submitting a replacement request.

Historical preparations without saved code require their exact original verified package; a newer package is not a fallback. Compilation and the authored native, reply-loss, process-loss and changed-package checks remain unrun under the no-build instruction. Broader receiver/state/finite composition remains open.

Keep the original grant graph during recovery

When a capture was admitted with a primary grant and two prerequisite grants, its recovery must still hold all three. Changing the current management catalog to require only the primary grant cannot remove those original obligations.

With the actual lifecycle journal attached, Core now selects and rechecks the complete original graph from its Native snapshot before recovery callbacks run. It takes the original grant leases in canonical order, checks the grants in the same Owner, and checks the original Native basis again. No grant is created, activated, consumed or refunded by this selection. A changed current graph cannot use those recovery leases for fresh execution or new queue admission.

Final publication also checks the record against the original saved release. The SDK's original_capture_release(native) returns that release as DATA; it does not authorize execution or publication. Original file, Jobs, current security and model publication owners still decide those operations.

Current session, permissions and source review remain required. The following connection also covers removal of the entire root management entry. Compilation and the authored native, reply-loss, crash and scope-isolation checks are unrun under the no-build instruction.

Finish a capture after its catalog entry is removed

Suppose an original capture was admitted under three grants and its root management catalog entry is later removed. With the same original lifecycle journal attached, Core can now select that known nonpersistent capture from its Native preparation, hold all three original grant leases, replay saved code against original inputs and authenticated outcomes, then finish its original publication and receipt. This source connection also retains the original Jobs custody when current engines are disabled or point to different work.

No current plan is invented. Fresh execution, compilation and topology installation refuse without a real current plan. A missing original operation, saved package or complete scope also refuses. Historical preparations without saved code still need their exact original verified package. A started uncertain request remains with its original execution owner; removing configuration does not authorize another request or reconstruct a persistent receiver.

Already-sealed receipt/publication checks use the original Native-bound metadata and final outcomes, without admitting code again. Replay still requires actual original code verification and Native/input/Jobs proofs. Current organization, session, permissions and reviewed-source checks remain in force. Compilation and the authored native, reply-loss, process-loss and isolation cases remain unrun; broader state and receiver composition remain implementation work.

Preserve Graph edits without running imported code

A Library model can contain both imported package calls and a static Graph with saved user edits. During a compatible model edit, Core now checks the exact old and candidate LIR's Graph DATA through its existing Graph mutation/checkpoint owner. It compares authored graphs, replays the original audit events, and checks checkpoint plus tail produce the same graph. This does not load a model, install a package or evaluate its formulas merely to inspect saved Graph state.

For example, changing a numeric result formula can retain an unchanged Graph's original property-edit history. Changing that Graph's authored endpoints, substituting its saved events or corrupting its checkpoint refuses. The existing original Native, grant, model and file owners still authorize publication and retain the additive Graph source binding. Missing binding/history keeps its existing immediate path. Live/deferred Graphs and Graph state within a captured effect still require their original source/state connections.

This is source implementation only. Compiler/type checks, the authored Graph inspection contracts and existing signed Library publication/cancellation/crash journeys remain unrun under the no-build instruction. Costs are unmeasured.

Move a worker that owns several Library models

If two models share one persistent receiver worker, move both models' original custody together. Moving only one would omit the other's queued calls or returned results. The local Core API with_library_instance_handoff_models now checks all existing model registrations and holds the union of their original grant leases. The embedding must retain its model/file fences and supply the actual current Native records, in canonical model order. No new model or grant is admitted.

Use that scoped view's prepare to consume the actual Host and unique worker, then the returned capsule's accept to retry the same original handoff. Core prepares and accepts every model controller in one original Jobs transaction, then rebinds all already-isolated model dispatchers under ordered model locks. Original receiver objects, queued operations, results, outgoing publications, receipts and worker exclusions move intact. An old dispatcher cannot submit a replacement operation after its epoch changes. prepare_next moves the same accepted owners again; retire_until remains stop-only.

For example, Model A may own a receiver and Model B only a queued constructor. Selecting A alone refuses before any transfer receipt is written. Selecting both can retain both original operations and complete them under the same moved worker. A lost preparation or acceptance reply retries the original operation; a process crash keeps the original generation fenced and cannot recreate native receivers. The existing single-model handoff also uses the explicit existing-model rebind rather than attempting a new model admission.

This selected API is bounded to 64 models, 8 MiB of request DATA, 64 MiB retained compiled LIR and 256 distinct grants. It adds no enterprise/HTTP endpoint. Collective installed organization guards, combined capture/receiver movement and closed capture history still need their owners' connections. Compiler checks and the authored native/reply-loss/crash contracts are unrun under the no-build instruction; costs remain unmeasured.

Keep organization authority on every transferred model

The native Core bridge with_library_instance_handoff_models_for_organization now binds each existing model to the actual current security store, provider- revalidated session, CSRF proof, actor and source review. Supply one original OrganizationSourceReview for each canonical Library request. Core holds all original review fences through the existing collectively leased handoff callback; two reviews sharing a workflow store acquire its process writer once.

Preparing or accepting a controller requires Edit and Run on every model. An accepted controller's current execution uses Run authority. For example, an operator who retains Run on Model B after losing Edit can still use its accepted worker, but cannot transfer either model's control through that narrowed scope. Original stop-only retirement remains available after fresh authority is revoked.

A stale or missing source review, substituted artifact, wrong CSRF proof, unrevalidated security reopen or revoked native effect guard refuses at its owning boundary. Saved descriptors confer no worker or grant rights. The source bridge retains the same original Native/Jobs/model/file/grant owners and physical worker.

This native connection adds no network handoff endpoint. The installed server's collective custody and original audit connection still needs its actual worker owner; receiver objects cannot be reconstructed from an HTTP payload. Compiler checks and authored workflow/native/lost-reply/crash cases are unrun under the no-build instruction; costs remain unmeasured.

Retain completed receiver history when moving its worker

A worker can retain a disposed receiver from an earlier lifetime while other Library models still have active calls. The local single-model and collective handoff now carry that completed lifetime as original DATA. Core checks its terminal Jobs receipt and operation records against the same original physical worker. The active and historical selection is bounded to 64 lifetimes.

For example, close Model C through its original fence and disposal owner, then move Models A and B with the same consumed Host and worker. C's original results, disposal receipts, tombstones and controller history remain unchanged. C receives no new controller or execution rights. Lost replies retry the same handoff; after a process crash the original receipts remain, and native receivers cannot be reconstructed. A live or uncertain C refuses this receiver-history path.

This source connection requires real terminal Jobs evidence and a closed physical registry; a copied receipt or history label is insufficient. Mixed captures and closed capture history still need their original Native connections. Compilation and authored native/lost-reply/crash contracts remain unrun under the no-build instruction; costs are unmeasured.

An upgrade also preserves an older pending handoff that omitted terminal history when that history had no state in the actual worker. Core verifies the original inventory and all current terminal-history proofs, then accepts the same receipt. It does not replace the handoff or change its worker, operation or epoch. An old inventory cannot excuse an active receiver or uncertain operation. New handoffs bind the complete retained history. This compatibility contract is authored and unrun under the no-build instruction.

Coordinate original capture owners together

The local with_original_library_capture_owners bridge can now borrow several retained original captures beneath one lifecycle fence, one union of actual grant locks and one Native writer. Supply their original replacement requests in operation-ID order. Each context retains exactly its original graph and source; a current catalog change cannot substitute a smaller graph or a new operation. Older captures of the same model remain separate original obligations.

For example, Captures A and B may share a prerequisite while retaining different primary grants. Core locks the union once and lends each operation only its exact original graph. Revocation in B still fences fresh B work; it cannot turn A's open graph into a revoked graph. The callback sees both original Native snapshots and can join their existing Jobs owners. Quiesce the actual models first and retain their file/model fences. Do not run a guest or recursively mutate Native inside this borrowed callback.

Bounds are 64 operations, 8 MiB request DATA, 256 distinct grants, 8 MiB Native row DATA and 256 MiB retained Native snapshots. This owner borrow does not itself move a worker: complete combined capture/receiver and multiple-capture controllers still need their atomic original Jobs/capsule adapter. No new HTTP endpoint, worker, grant owner, effect operation or evaluator is created. Compiler checks, authored owner/native/crash contracts and cost measurements remain unrun under the no-build instruction.