[MauScheff]

Problem and result

The existing consumer binding uses a closed owned-envelope projection. The installed verifier rejects that source shape. Its authority-repair preflight also rejects an existing, already-declared dynamic dispatch before it can validate an exact known-authority correction.

This candidate integrates the preserved consumer binding fixes and bounded complete-matrix verification. It adds a narrow authority-alignment preflight through the existing receipt and mutator. It adds no analyzer recognizers, provider fallback, CLI option, dependency, or runtime product behavior.

Boundaries and compatibility

• An omitted envelope-flow binding retains the existing exact-envelope rule. Older tools reject the opt-in fields.
• Header, payload and actual status provenance remain checked. Unknown or transformed source shapes remain rejected.
• Retained structural compatibility requires exact prior Git/source pins. It does not exempt new domain records.
• Matrix batching preserves the complete representative Cartesian product and one execution deadline. Missing later results fail.
• Authority repair preserves source, purity, call uncertainty, inferred effects and all non-authority row fields. It cannot introduce dispatch, undeclared authority, extra rows, capabilities or facade bindings through the bounded exception.
• Existing advisory policy remains unchanged. Native tests, reference solver, consumer validation and composition remain strict. No RMS self-routing or release-gate waiver is used.

The binding helpers serve the existing implementation binding and its provenance proof. No product states, transitions or contracts change. The only added distinction is an explicit opt-in closed-envelope representation; the repair reuses an existing action family.

Evidence

• All-target native ARM64 release compile: exit 0, unchanged snapshot.
• Focused authority controls: 3 passed, 0 failed. Red proof failed at the old blanket dispatch guard.
• Isolated consumer at 3319247d0fb3ffaa36cc1eae674824fcfa473f5e: 143 product-owned pins verified; ready receipt, dry-run and apply passed. Purity edits, unknown authority, stale source and stale canonical metadata were rejected before mutation.
• Full isolated consumer validation after apply: exit 0, 0 errors, 142 retained advisory warnings. Diff contains only the reviewed existing authority row and generated semantic revision provenance. Live product was not edited.
• Final native suite: 907 passed, 0 failed, 5 explicit external-fixture tests ignored; actual exit 0. The cvc5 test remains required in CI. Full representative-matrix positive and later-batch negative controls passed separately on the preceding same-matrix implementation.
• Required CI run: all 10 required jobs passed, including cvc5, four native shards, three operating systems, both Python versions, formatting, consumer validation and composition. The separate repository self-audit remains advisory under the existing policy.

Native maintainer receipts and frozen binaries are retained under /tmp/rms-authority-preflight.xOIE8X. Isolated native-test CLI SHA-256 (pre-commit build metadata): 8ef5ef041c1540146f9cf1ab6c6947ecd0180cd99e41f511b9db094fa8f65d81.

Merged revision: 3935f7cdc7ceec77aa3877a516a1c4a893172404. Its tree is exactly the tested candidate tree a9a9731bee8aa0249633141b77ae3db152172dbf.

No installed candidate or product release acceptance is claimed by this PR alone.