[i2cjak]

Native standard-user Windows testing of packaged 0.14.2 reproduced #927's remaining corruption: Rt.save sends health JSON through native Windows→Cygwin argv, which halves paired backslashes. A saved C:\backplane_kicad\ can then decode a backspace; \n/\t paths are affected too. The UI, RPC, SQLite setting and reload preserve the typed spelling.

Write the cache as native UTF-8 through a private same-directory temporary file and atomic rename. Failed writes/renames preserve the previous cache. Add actual Bend Rt.save IO coverage and effect controls for drive letters, UNC paths, trailing backslashes, escape sequences, spaces, Unicode, quotes, controls and partial-write failure. Every local-small.py lane runs the Bun effect test and asserts that Rt.save uses the native writer without Proc.run; Linux nightly/release CI also runs the cache regressions.

Refs #927. Keep #927 open until a corrected packaged build passes native acceptance and the fix ships. Native installation itself succeeded on the previous package (real UI download/extraction and pinned CLI execution), but the health-cache check failed. The unchanged canonical #946 native check passed. Original package identities and the end-to-end trace are in docs/reviews/kicad-health-cache-927.md and the tracked receipts.

Validation on final head 40b56de2ee29ad3b3fbed4b46c66ad45a97f8777, tree 9f07ccb5e274187de26148b63f21d733ea9f71ab:

• Boat j20261104205744-1758427, clean source, cap 3,699,998,720 bytes / swap 0: scoped KiCad controls and actual compiled Rt.save IO passed; discovery 7/7 and installer 21 tests passed (three native PowerShell cases skipped on Linux). The complete small-gate invocation passed its Python/Bun/Node prefix, including 389/389 Node tests, then the final stock Bend mailtriage step was killed. The stock complete gate did not pass.
• Diagnostic j20261104210111-1791885: unchanged stock bend test/mailtriage_test.bend was kernel OOM-killed after 19.594 seconds under the same cap, with no output: NO RESULT.
• Assigned composite execution j20261104210315-1812403: actual compile, IO main and all 138 original assertions passed on the exact final source with composite compiler 41262875, Bun 1.3.10 and frozen flags. Exit 0, 138 ok, no FAIL/Error; 150.636 seconds, cgroup peak 2,662,490,112 bytes, swap 0, zero OOM. Root, Bub and the merge owner accept this only as the missing regression execution evidence for this Preserve Windows KiCad paths when saving health JSON #951 merge. It is not a stock-gate pass, establishes no stock/composite output equivalence, and changes no guard.
• Canonical bend PROOF.bend was attempted unchanged in j20261104193708-1087045: kernel OOM kill after 13.529 seconds under the 3.7 GB cap, no output: NO RESULT / NOT PASSED. LAWS/PROOF were not weakened. Structural validation is a separate check.
• Independent source and delta reviews report no blockers, including the final rebased head.

Corrected-package native qualification, including Windows rename-over-existing under Bun, remains outstanding. Rt.save error reporting and the pre-existing Tk.append JSON-through-shell writer are recorded as nonblocking follow-ups on #927. No local tests/builds, app packaging, deployment or restart was performed here. Root owns the authorized release re-cut and publication after the new combined packaged Windows gate passes. This thread owns checking the next scheduled nightly check and proof results.

[i2cjak]

Canonical proof status: NO RESULT — NOT PASSED.

Boat job j20261104193708-1087045 exited 0 because its diagnostic collector completed. Inside that job, the unchanged canonical bend PROOF.bend process exited -9: kernel-confirmed cgroup_oom_kill after 13.529 seconds under memory.max=3699998720, swap 0. It produced zero output and never printed “All terms check.” Its receipt state is incomplete. This is not a proof pass.

The green backplane/boat-kicad-927-scoped status covers only the listed scoped cache/discovery/installer tests and the structural LAWS/PROOF shape check. The shape check is not a canonical proof. No law or proof was weakened. The hub/web build memory allowance will not be used for a proof retry.

Merge still requires the previously authorized independent review/scoped-check exception for the known full-hub cap limit. Corrected packaged-build native qualification remains outstanding, and #927 stays open until the verified change ships.

[i2cjak]

Independent review of 79a18057e23e6b235f3b57905d52aee5c08b606a: mergeable as-is as a source fix; no must-fix defect found in the health-cache change. The head has not moved. GitHub's current base is e07633b1203b27051d65ef9071816eea5acfea89; the actual merge-base/head parent is caf71af247d87f9d89c0af7ced8a2721d152d541. I reviewed the three-dot PR diff, relevant callers/readers, PR description, comments, and tracked receipts. References below are at the reviewed head.

Findings, ordered by severity (none blocks this scoped fix):

• P2, pre-existing / separate follow-up — JSON still crosses the same shell boundary elsewhere. src/server/server.bend:8741 (Tk.append) passes line as a sh -c argument to printf. Its callers at src/server/server.bend:17479 and :17586 supply Json.show(...) containing free-text notes/summaries; .draft.jsonl uses it at :8748 too. Thus JSON containing Windows backslashes still has the original transport exposure in browser-task logs. This PR removes it from the health-cache writer, not repository-wide. These lines are unchanged by this PR; address them separately rather than claiming all JSON-through-Cygwin paths are gone.
• P3 — the new Linux checks do not distinguish the original Windows bug from the old implementation. .github/workflows/ci.yml:312 runs both new tests in the Ubuntu js job (:229). The compiled Rt.save regression exercises the real encoder, effect dispatch and reader, but restoring just the old shell-based Rt.save would still pass it on Linux: POSIX argv does not perform the offending native-Windows-to-Cygwin conversion. The effect controls test the new helper directly, so they also cannot detect that caller-only reversion. Add a native Windows/pinned-Bun negative control when doing corrected-package qualification. The value matrices (test/tools/kicad_cache_test.py:22, test/tools/atomic_text_test.cjs:19) cover literal backslashes, b/n/t, spaces, Unicode, UNC and trailing separators, but omit a literal backslash-u path and extended-length \\?\ payloads, and do not exercise native UNC/long destination paths or held-open readers.
• P3 — make the advertised Windows test explicitly UTF-8. test/tools/kicad_cache_test.py:35 uses locale-default read_text() on a UTF-8 file. On Windows Python configured with a legacy code page, the Japanese case can fail despite a correct writer. Specify encoding='utf-8'; likewise make the captured subprocess text encoding explicit at :29 if using this harness on such a runner. This does not invalidate the Linux receipt.

Scope assessment:

• Atomicity/cleanup: src/server/effects/host.js:1884-1897 stages under the destination's parent, so the rename stays on the same volume. It opens exclusively, writes the complete UTF-8 string, closes before rename, and never unlinks/truncates the destination first. Normal partial-write exceptions and rename failures close the descriptor and remove the private staging directory in finally, preserving the old cache. The injected tests at test/tools/atomic_text_test.cjs:32-40 meaningfully check both preservation and cleanup; the write injection really writes a partial file before throwing. Cleanup is best effort if rmSync itself fails, and process termination can leave staging directories; neither is tested or a reason to promise unconditional cleanup.
• Windows replacement/readers: fs.renameSync is the replace-existing operation, not a copy/delete fallback implemented by this patch. Windows replacement can fail when a reader denies delete-sharing; that should retain the old complete cache and take the cleanup path. A compatible reader can keep reading the old file. The Windows sharing contract and replace-existing operation support this distinction. The generic injected rename failure is useful, but is not experimental verification of either case in the packaged Bun runtime. Rt.save still intentionally discards save errors (src/server/kicad.bend:481), as it discarded the old subprocess result.
• Fsync policy: there is no file or directory fsync (src/server/effects/host.js:1887-1891). This provides replacement atomicity during ordinary operation, not power-loss durability. Omitting fsync is reasonable for this disposable, recomputed health cache: boot parses and validates it and rediscovers on a miss (src/server/kicad.bend:426-433). Do not treat the generic helper as durable storage for authoritative data without a separate flush policy.
• Exact bytes/compatibility: Rt.save still supplies exactly Json.show(Rt.json(rt)); native UTF-8 writing adds no BOM, CRLF conversion, newline or trailing newline, matching the old intended printf '%s' output. Schema and readers are unchanged (src/server/kicad.bend:401-433, src/server/server.bend:3152). Literal b/n/t/u sequences, UNC and extended-prefix strings are opaque JSON payload data at this boundary; no path normalization or second escape interpretation is applied to them. That establishes the serialization logic, not native discovery/execution support for every long-path spelling.
• Source/effect integration: src/server/host.bend:229, src/server/effects/host.js:2365, and src/server/kicad.bend:481 agree on the two String arguments and Result-to-Unit handling. Both production health-save callers still use Rt.save; I found no second health writer or dependency on the removed .tmp name/shell side effects.

The seven discovery tests and installer fixtures are useful adjacent regression checks, but neither invokes the production health-cache save boundary, so they would also pass without this fix. Three actual PowerShell cases were skipped on Boat; the older native package receipts reproduce the bug and establish installer results, not success of this corrected source. The compiled save test and effect controls provide complementary coverage, with the Windows limitations above.

No tests/builds/proof were run locally or remotely for this review; the recorded scoped results were inspected, not independently rerun. The canonical proof remains incomplete, not passed. Corrected packaged-build Windows acceptance remains outstanding and #927 should stay open through qualification/shipping. This COMMENT is not release signoff or authorization to lift the 0.14.2 publication hold; merge remains owned by the #927 thread.

[i2cjak]

Second independent review of 79a18057e23e6b235f3b57905d52aee5c08b606a. It adds to the earlier COMMENT and does not repeat it. No blockers: I found no defect in the Rt.save change. I agree with that review on Tk.append, the caller-only revert gap, the read_text() encoding, fsync policy and Windows sharing semantics.

This was a static review. I ran no tests, builds or proof, on Boat or locally, so nothing here has been run on Windows.

Should fix before merge (small, not blockers)

1. Neither new test is in the merge gate. docs/reviews/kicad-health-cache-927.md:74 says "Both are included in CI", but ci.yml only has workflow_dispatch and workflow_call triggers, so it runs nightly or on a release. The merge gate is scripts/local-ci.py, and neither test is reachable from it: scripts/local-small.py lists its tests by name, and neither scripts/fast-tests.txt nor scripts/extended-fast-tests.txt includes them. A break would reach main and show up only in the next nightly. atomic_text_test.cjs needs no Bend and takes seconds, so it can go in local-small.py. The doc line should also say nightly/release, on Linux.

2. Two cheap ways to close the Linux-only gap, without waiting for package qualification:

• Caller-only revert: add a source assertion that Rt.save calls H.FS.write_atomic and contains no Proc.run. test/tools/kicad_open_script_test.py:24 already reads kicad.bend this way, and this one does fail on Linux.
• Native replacement: add bun test/tools/atomic_text_test.cjs to windows-agent-tree (ci.yml:65). That job is already on windows-2025 with Bun 1.4.3 and needs no Bend. The test's loop writes the same target five times, so this would be the first run of rename-over-existing on Windows under the shipping runtime.

3. The effect test runs on the wrong runtime. ci.yml:312 and extra/kicad-927-native-fix/check.py use node, but the hub ships on Bun. local-small.py already runs similar effect tests with bun, so switching costs nothing.

Worth doing, can follow

4. Log the failure in Rt.save. src/server/kicad.bend:481 discards the errno that the new effect now returns. The discard itself isn't a regression, but it matters for qualification: a failed mkdtemp or rename on Windows leaves a stale cache and no trace, which looks just like a fix that did nothing. One log line would make the packaged acceptance run diagnosable. Staging also creates a directory beside the target, and I could not confirm how Bun on Windows treats that for very long home paths. That failure would be equally silent.

5. Say in the host.bend comment that FS.write_atomic is not durable. I agree fsync is unnecessary for this cache. But fs_pairing_token in the same file does fsync, so the name invites a later caller to assume more than it provides.

Checked, nothing to change

• Other argv writers: besides Tk.append, PiRun.write (server.bend:5134), OmpRun.write (:5173) and Agx.write (agyio.bend) also send content through printf '%s' "$2". None is exposed today, because their payloads never emit two adjacent backslashes. Pi has no backslash sequences, Omp has one '\\n', and Agy has only single ones. This is fragile, since a \\ added later would be halved on Windows without warning, so include them in the Tk.append follow-up. My search was line-based, so it is not exhaustive.
• Upgrading from an already corrupted cache: this heals without a cache version bump. Invalid JSON parses to Null and fails the stamp check. A decoded setting fails the setting equality in Rt.boot. Both go back through discovery, and Hub.kfound.* then saves a good file. One residual case: a file that stays valid JSON, with matching stamp and setting but some other field decoded, would be trusted by Rt.cached. I found no concrete field that does this; Rt.normal keeps native cli paths on forward slashes.
• Receipts and base: the sha256 values for host.bend, host.js, kicad.bend, LAWS.bend and PROOF.bend in the receipts match this head. Main is now 703505cae. No commit since the merge base caf71af touches those files, src/core/json.bend, src/core/kicad_install.bend, test/check.bend or ci.yml, so the scoped results should still hold on the merged tree. scripts/pre-merge.sh is still required.
• Pins and evidence: no hash pin or effect list needs updating for the new effect. A keyword scan of extra/kicad-927-native-fix for tokens, keys and user paths found nothing sensitive.

The missing proof run

Low risk from this diff, but it is still not a pass. The OOM tells us nothing about this change either way, because the run hit the 3.7 GiB cap at 13.5 s and gave no verdict.

• LAWS.bend and PROOF.bend are unchanged.
• No law or proof names Rt.save, Rt.json or FS.write_atomic, so no proved statement depends on the changed body.
• bendok.sh does not pin the count of foreign defs, so one more foreign def in host.bend should not change the verdict.
• Rt.save keeps its signature, so its callers in server.bend are unaffected.

The real gap is narrower. LAWS.bend imports server.bend, so kicad.bend and host.bend are inside the proof's closure, and neither the proof nor scripts/check.sh check has completed on this tree. The evidence that those files compile is the kicad_cache.bend compile and run in the Boat receipt. Since that receipt has no separate --check-only result, treat the next nightly check and proof jobs as the required backstop, and confirm they are green after merge.

Verdict

No blockers from this review. Items 1-3 are cheap and worth including before merge. As the PR says, #927 stays open until a corrected package passes native acceptance. This is not release signoff.

[i2cjak]

Delta review of 319141ec379957d05563fa6c5a2ec0c161c9ee48 against the reviewed 79a18057. The requested changes are good, and I found no blockers. I read the code and hashed git blobs; I ran no tests.

• Production bytes: git diff 79a18057 319141ec -- src LAWS.bend PROOF.bend is empty, so the earlier source review and proof assessment carry over unchanged.
• Merge gate: atomic_text_test.cjs sits above the --focused-only and --guards-only branches in scripts/local-small.py, so "every lane" is accurate. The lane can't skip it on a stale pass either: with no roots, inputs-key.sh hashes every tracked .bend and .js file, so a change to kicad.bend or host.js forces a rerun.
• Source assertion: it closes the caller-only revert gap on Linux. It requires H.FS.write_atomic( and forbids Proc.run( within the Rt.save def, so moving the shell call into a helper fails too.
• Runtime and wording: ci.yml and check.py now use Bun, and the doc correctly says nightly/release, Linux, not the per-PR gate.
• Sidebar guard failure: this is independent of this PR. I hashed all 177 pins in scripts/sidebar-draft-inputs.json at this head, at caf71af and at main 123676a2. The same three files mismatch at all three commits (src/core/kexport.bend, src/core/refview.bend, src/mobile/hubs.bend), and this PR touches none of them or the guard.

Limits to keep in mind (none blocks this):

• backplane/boat-small-gate is red, so the small gate has not passed for this PR. The lane stopped at the sidebar test, so the steps after it never ran in job 1195105, including kicad_library_header_test.py and kistack_test.py. The new test ran before that point and passed. The rerun after the #948 remediation is what qualifies the gate.
• Receipt 1195105 ran on a dirty tree at 79a18057, and its sources hashes cover only the three production files, which do match this head. Its output shows the new assertion ran, but nothing ties the test bytes to 319141ec. The rerun on the committed head settles that as well.
• Rename-over-existing on Windows under Bun is still unrun, because the optional windows-agent-tree step was not added. Corrected-package qualification remains the first native check.

The proof status (no result) and the qualification hold are unchanged. This is not release signoff, and merge stays with the #927 thread.

[i2cjak]

Rebase confirmation for f6f0cc08137edc1dac2b96e7013e34e4a978a209 (tree 63f9811113bc00889009823f5526334408f9d677) on main 64eca09231b21cf009a9de81b8e8158dcdc91644. The rebase carried over exactly, and I found no blockers. This was a static review of git objects; I ran no tests.

• Same two commits: git range-diff shows = for both, and the stable patch IDs match (79a18057 → 75da4ed03a, 319141ec → f6f0cc0813). 64eca092 is the merge base, and main has not moved since.
• No PR-owned file changed: the file set is the same 20 files. I compared blob IDs at 319141ec and this head for all of them except the older evidence/run-* receipts, which are covered by the patch IDs. That includes the three production files, scripts/local-small.py, test/tools/atomic_text_test.cjs, ci.yml and test/tools/kicad_cache_test.py.
• Sidebar pins now match: all 177 pins in scripts/sidebar-draft-inputs.json match at this head, so the three stale pins that stopped the last small-gate run are gone. That is a hash comparison only, not a run of the guard or its tests.
• Earlier assessments still apply: main's commits since caf71af changed none of src/core/json.bend, src/core/kicad_install.bend, test/check.bend, scripts/inputs-key.sh, scripts/local-ci.py, scripts/bendok.sh, LAWS.bend or PROOF.bend. No law or proof names Rt.save, Rt.json or FS.write_atomic.

Not established by this review:

• No commit status exists on this head yet, and omp was still running when I checked. The complete local-small and scoped Boat results for this committed tree are what clear the two limits from my delta review (the small gate has not passed, and receipt 1195105 was not tied to committed test bytes). Please confirm that job ran at f6f0cc08 with a clean tree.
• Proof remains NO RESULT, not passed, so the next nightly check and proof jobs are still the backstop.
• Rename-over-existing on Windows under Bun is still unrun. The combined Windows PASS is its first native check.

This is not release signoff. Merge stays with the #927 thread.

[i2cjak]

Rebased #951 onto actual #948 merge 64eca09231b21cf009a9de81b8e8158dcdc91644.

Current reviewed head: f6f0cc08137edc1dac2b96e7013e34e4a978a209, tree 63f9811113bc00889009823f5526334408f9d677. The existing Opus reviewer confirmed the rebase has no blockers and preserves both reviewed patches exactly. Boat job j20261104201529-1405267 explicitly recorded that head with dirty: no, under kernel memory cap 3,699,998,720 bytes / swap 0.

• All scoped KiCad checks passed, including the Bun atomic-write controls, no-Proc.run caller assertion, actual compiled Rt.save IO, seven discovery tests and 21 installer tests (three actual PowerShell cases skipped on Linux).
• The sidebar guard now passes, and the complete small gate passed the subsequent KiStack 11/11 and service-runtime 25/25 checks.
• The complete python3 scripts/local-small.py attempt then failed in a separate unchanged baseline test: release_bootstrap_test.py::test_workflow_pins_this_component_producer. release-bootstrap.yml:189 pins producer 29ba06044c73b99c06176a70c2bba557c965798f368e4a686a7642971fc15ab4, while current scripts/service-release.py hashes to 86722ad1d13a307eb08815398c454619551f51fa157f4c0f91f0deb08348fb3c. Preserve Windows KiCad paths when saving health JSON #951 changes neither file. The finding is routed to the coordinator; no re-pin/bypass here, and the full gate is not passed. Preserve Windows KiCad paths when saving health JSON #951 remains unmerged pending that resolution.

The canonical proof is still OOM-killed, NO RESULT, NOT PASSED. Neither scoped tests nor structural checks replace that verdict. Corrected-package native qualification remains outstanding; the new OMP consumer preparation has not run. #927 remains open. Root alone owns the user-authorized re-cut and publication after the corrected combined Windows acceptance passes.

[i2cjak]

Final rebase confirmation for 40b56de2ee29ad3b3fbed4b46c66ad45a97f8777 (tree 9f07ccb5e274187de26148b63f21d733ea9f71ab) on main af56a8b2d0aad0c84a7cf90ff9a4ae22b0fa4100 (tree 928f878df42375ccf8ec3752342ca8ff2ba7d483). The rebase carried over exactly, and I found no blockers. This was a static review of git objects; I ran no tests.

• Same two commits: git range-diff shows = for both, and the stable patch IDs match f6f0cc08, 319141ec and 79a18057. af56a8b2 is the merge base and still the tip of main.
• No PR-owned file changed: the same 20 files, with zero blob differences from f6f0cc08.
• Main's delta is as described: #955 and #956 change .github/workflows/release-bootstrap.yml (the producer pin) and four desktop/test fixtures. None of those five files is in this PR, and none is a src file or LAWS/PROOF, so my earlier source and proof assessments still apply.
• Sidebar pins: all 177 match at this head. That is a hash comparison, not a run of the guard.

Not established by this review: this head has no commit status yet, and omp was still running when I checked. The complete small gate needs to pass on 40b56de2 with a clean tree, and it should be the receipt the merge relies on, since earlier ones were for other heads. Proof remains NO RESULT, not passed. Rename-over-existing on Windows under Bun remains unrun until the combined Windows run.

This is not release signoff. Merge stays with the #927 thread.

[i2cjak]

Final stock small-gate step: kernel-confirmed OOM, NO RESULT, NOT PASSED.

On reviewed head 40b56de2ee29ad3b3fbed4b46c66ad45a97f8777 / tree 9f07ccb5e274187de26148b63f21d733ea9f71ab, the clean-tree complete small-gate run j20261104205744-1758427 passed all preceding Python/Node checks (including 389/389 Node tests) and the scoped KiCad checks. Its final unchanged bend test/mailtriage_test.bend process was killed without output, so the complete stock gate is not passed.

The diagnostic retry j20261104210111-1791885 confirms the cause under the same cap:

• Exact command: bend test/mailtriage_test.bend; test SHA256 87395049843cd97bb9d6e70131d81b895b8c236048ae8ecde349bf0364f26941.
• memory.max=3699998720, swap 0; peak cgroup bytes 3699998720.
• Exit -9, reason cgroup_oom_kill, state incomplete, timeout not reached (19.594 seconds of a 120-second bound).
• Kernel event deltas: oom=2, oom_kill=1; peak child RSS 3635556 KiB; output bytes 0.

The diagnostic wrapper exited 0 only because evidence collection completed. It is not a test pass. The diagnostic transport added only an untracked wrapper to the otherwise unchanged source; the original complete-gate attempt was clean. The first retry never launched because Boat excluded its diagnostic file under build/; that transport refusal yielded no test result either.

The unchanged canonical PROOF.bend attempt separately remains OOM-killed, NO RESULT, NOT PASSED. No test/proof cap was raised, no skip flag or test change was used, and no gate was weakened.

Compiler lane B alone owns the explicitly authorized one-time mailtriage test using composite compiler 41262875 with frozen flags on this exact tree, under the same 3.7 GB / swap 0 limit. Its eventual result must be labeled a composite run; substitution for the stock step requires a reviewed disposition. No automatic full-stock-gate pass or merge waiver is inferred. #951 remains unmerged and #927 remains open for corrected packaged Windows acceptance and shipment.

[i2cjak]

Merge-owner concurrence on final head 40b56de2ee29ad3b3fbed4b46c66ad45a97f8777 / tree 9f07ccb5e274187de26148b63f21d733ea9f71ab:

I audited Lane B's composite execution receipt for j20261104210315-1812403. Receipt checksums match. All 3,649 transported tracked files match this Git commit; no source, test or script file was omitted. The eight extra transport files are the compiler/job tools. The unchanged mailtriage test SHA is 87395049843cd97bb9d6e70131d81b895b8c236048ae8ecde349bf0364f26941. The output contains exactly the 138 original assertion labels, once each, with no failure or error lines.

The actual command compiled and ran the test IO main with composite compiler 41262875 (archive SHA be39bfb8c44da887702c51ef80dea07a6b0366c754f2eb15615e73a1f0d62581), pinned Bun 1.3.10 and frozen flags: rc 0, 150.636 seconds, peak RSS 1,519,348 KiB, cgroup peak 2,662,490,112 bytes under 3,699,998,720 bytes, swap 0, zero memory-max/OOM events. No check-only mode, cache, assertion change or stand-in was used.

Root and Bub concur; I accept this as a scoped substitute for the unavailable stock mailtriage execution evidence for this PR's merge only. No repository guard changes or general compiler-equivalence approval follow. The existing backplane/boat-small-gate failure remains unchanged. Stock mailtriage was OOM-killed with NO RESULT, and canonical PROOF was OOM-killed with NO RESULT / NOT PASSED. This is neither a stock full-small pass nor a proof pass.

The receipt is retained at /home/h/Documents/i2cjak/bp-coord/mailtriage-receipt-40b56de2/ (RECEIPT.md SHA e52ed55a20aa22aa6eabc1ea908740ea123a37281761db3a7cad95f5de5ac40e; raw test log SHA 8b2a9af28aafa3448962af2fef661d063bb97b50faee427a48645eb2bb606a36). Root disposition SHA: 0c35aae6e424adec09f7bf58aace3afac81fe55fe42268816cda8a1934a63707.

Next: fresh exact-head capped Boat premerge guard, then normal merge without admin or branch-protection bypass. #927 stays open pending corrected-package native acceptance and shipment; no build or publication is authorized by this receipt alone.

[i2cjak]

#951 merged normally as 044a62d6ee72765b1e49e277d8306fa0b9efe425 at 2026-11-04 21:13:33 UTC. The actual merge tree 9f07ccb5e274187de26148b63f21d733ea9f71ab equals the reviewed/tested head 40b56de2ee29ad3b3fbed4b46c66ad45a97f8777.

Fresh premerge Boat job j20261104211217-1884630 passed merged LAWS/PROOF structural validation under 512 MiB / swap 0 (peak 40,648,704 bytes, zero OOM). This was a normal merge without admin or branch-protection bypass. The installer/root received the merge/head/tree receipt immediately for the authorized corrected-candidate freeze.

The remaining Windows corruption was reproduced in health-cache saving: native Windows→Cygwin argv halved JSON backslashes. The native UTF-8 atomic writer removes that shell/argv round trip. Scoped cache/discovery/installer regressions passed. The actual mailtriage IO test passed 138/138 on the exact tree with the assigned composite compiler under the unchanged 3.7 GB / swap 0 cap, accepted by root/Bub/merge owner only for this merge's missing regression evidence.

The complete stock small gate did not pass: stock mailtriage was OOM-killed with no result. Canonical PROOF was also OOM-killed with NO RESULT / NOT PASSED. Neither status was rewritten; no proof or guard was weakened.

#927 remains OPEN. Corrected-package real Windows standard-user acceptance and shipment are still required; no new-package result or release signoff is claimed. Follow-ups remain Rt.save error reporting and the pre-existing Tk.append JSON-through-shell path. No local tests/builds, duplicate app build, packaging, deployment or restart was performed here. This owner will check the next scheduled nightly check and proof results when their run IDs arrive.