Console command admission prerequisite — run 01

Frozen artifact source a5dbda7a4fd6465c94f6505b3214cbcbc2130c82; prospective qualification harness ab19a5f891d7acd869510bf696fc44d05e91cafb. Executed 2026-10-12. The failed initial smoke is preserved; the repaired native smoke exited 0. This is harness admission, not measured release or deployment qualification.

Debian SHA-256 54cddf548c1a307aade8c3ac4332ede2007e2bc9603ab0cba72d8297287d6cee; RPM SHA-256 982ad6923e17f64b35700dcfafb2994ed68e32b2c6b368589a8b6a0d550cac79. Neither package was rebuilt or changed. Installation run 03 has its separate four positive and six negative-control cells. The three hosted candidate checks retain their exact tested source identities.

Failure and causal boundary

r3-checker-controls passed 35 tests (exit 0). Disposable service-opening-r3-main-t10-s1-smoke-01 then exited 1 before measurement during enrollment. Its browser request record contains seven successful enrollment POSTs followed by HTTP 429. Owner bootstrap and session checks had succeeded. The native server's protected-peer bucket permits eight HTTP requests/sec with an eight-request burst; each campaign bridge command sends a fresh session GET and the operation. The fixture's 0.15-second command spacing offered about thirteen HTTP requests/sec even before concurrent reader and UI traffic.

The fix serializes protected command starts at 0.5 seconds under the existing lock. Both HTTP messages remain, current CSRF/session authority is still checked, and every refused response remains visible without retries. At most four command HTTP requests/sec leave capacity for the registered three visibility probes/sec and actual five-second UI poll. This is a campaign caller correction; no server quota or acceptance threshold was increased. The independent offer-accounting model uses the fixed eight-request rate/burst and integer nanoseconds, rejects the old command-pair schedule, and checks the separate visibility/UI traffic. It is finite schedule evidence, not a model of all possible concurrent traffic.

The controller remains triggered at measured second 45. Its existing ordered 100-source sequence may span about 50 seconds, so each start/response and actual apply timestamp is retained. Response completion bounds publication; it is not an exact server commit timestamp. The original per-source <=30-second apply deadline includes the bridge wait. This does not claim 100 simultaneous changes. Native telemetry offers, reader/UI schedules, source custody, independent delivery/query/rate oracles, backlog decision and resource rules are unchanged. The prospective prerequisite was committed before the successor smoke; the issue command plan preceded execution.

Executed checks

Check	Actual exit	Result
Existing checker controls	0	35 tests passed on the original harness
Initial native disposable smoke	1	Enrollment HTTP 429 before measurement; preserved
Red command-budget regression on unchanged bridge	1	Named schedule test failed, 184 modeled refused requests; original source and receipt retained
Replayed archived red fixture	1	Same expected schedule failure; preserved separately
Repaired targeted harness suite	0	50 tests passed; also repeated on clean harness commit after controller timestamp recording was added
service-opening-r3-main-t10-s1-smoke-02	0	All ten smoke gates passed; no full statistical release gate is claimed

The native successor used Chrome 155.0.8059.39, real HTTPS passkey ceremonies with a virtual CTAP2 authenticator, production serve, scoped owner commands, one real edge, ten simulator identities and source-matched recovery helpers from the successful build receipts. It ran the registered disposable eight-second fixture with two-second warmup, server CPUs 4–5 and workers 2–3, --backlog-rule clearing-v2 fixed prospectively. This does not establish physical passkey compatibility.

Native smoke gate	Result
delivery_oracle	PASS
native_custody	PASS
sampled_query_oracle	PASS
exact_native_logs	PASS
exact_native_traces	PASS
clock_mapping_le_1ms	PASS
ui_active	PASS
server_rss_le_2gib	PASS
edge_rss_le_64mib	PASS
no_oom	PASS

All 47 bridge request records returned 200. Ten control requests completed over 4.520387 seconds. Actual authenticated UI progress and its failure counts were checked separately; owner API successes cannot substitute for that UI witness. The native smoke keeps exact logs/traces, source-prefix custody, sampled independent query answers, clock mapping, memory and OOM guards. Its registered short-fixture path omits full minimum-population timing/backlog, visibility and configuration-apply gates; those remain mandatory in the measured six main cells. All four million-row query cells remain unrun.

Containment, provenance and cleanup

Every project check used python3 -B tools/resource_group.py --; native fixtures used --delegate. Default 1800-second outer deadline/no swap; native fixture 6 GiB total, server/companion 4,000,000,000 bytes and browser 1 GiB. Strict namespace admission counted 85,302,130,919 data-tree bytes and reserved 5 GiB below the unchanged 95 GB stop. No overlapping project workload. The native smoke runtime was approximately 24 seconds including fixture setup, measurement and cleanup.

Runtime recorded unchanged extracted binary/helper/console identities and unchanged loaded harness files. Server, dedicated companion, edge, generators, driver and browser were stopped; owned successful scratch/profile/cache were removed; the outer receipt confirms its cgroup stopped. The original failed smoke is privately retained with its stopped-process receipt and immutable input/harness identities; its credentials/private state are not published.

Controlled archives: results/service-opening-r3-main-t10-s1-smoke-01, results/service-opening-r3-main-t10-s1-smoke-02, and results/service-opening-candidate/harness-admission-repair. Canonical smoke summary SHA-256 078b9725966437d8faf7b7db438c2a28a63be6628881bc190a07acecaf886b65; runtime SHA-256 154a29142cf7d1c53c793dacd24e9ee197e0e326990a1a603cc6b413a0c19bd0; outer command receipt SHA-256 eed7252c8e2ace69ee23747c53f8e51cbe656245b0d08eb74e1364d4d108dfbc. Per-command response records contain synthetic node names/timestamps/status only; no tokens, credentials, source payloads or private keys are in this report.

The harness change is a separate trust-boundary commit, with its reason and counterexample. Hosted checks and review/merge remain pending. #42 stays open until all six main cells, four query cells and trace fixtures pass individually; later remote, outage, soak and browser acceptance is separate. No tag, release or package upload has occurred.