[JoyboyBrian]

A Git blob response deadline can expire while the read stays blocked: the direct Git process exits, but an ordinary descendant still holds stdout. The shared reader now owns a POSIX session and stops that process group on timeout, success, malformed response or early generator close. Watchdog and finalizer share one idempotent stop operation; consumer pauses remain outside the response deadline.

The implementation preserves one-blob streaming, exact bytes, the first-request/no-response/exit129 NUL fallback gate and strict source authority. All actual consumers use the same reader: source validation, sparse manifest discovery, scaffold generation, committed-byte checking and export. Frozen packages and their pins are unchanged; this does not resolve their existing historical source-drift failures.

Validation on CPython 3.12.7/macOS arm64:

• 57 shared Git tests pass normal and optimized with warnings as errors. Six new real-process methods cover four stalled boundaries, leader exit, success/error cleanup, early close, consumer suspension and legacy fallback. Child readiness and stopped state are checked before teardown. A direct-child-only mutant still hangs with its child alive.
• 35 actual caller tests pass in each mode: scaffold, committed bytes, sparse planning and export.
• A fresh committed source snapshot with no Git directory and only the ps observer on PATH passes all six new tests normal/optimized, with source bytes unchanged.

The earlier optimized sandbox attempt denied the ps observer; final runs with process-observation permission pass. No scientific or historical full-suite replay was run. The ownership contract covers ordinary POSIX descendants remaining in the group with retained signal permissions; escaped sessions, abrupt outer-process death, Windows descendant ownership and separate Git-command deadlines remain outside scope. Native Linux/Windows and hosted CI are not claimed. The documentation records source attribution and open obligations.

Canonical claim: #4681 (comment)
Prepared by JoyboyBrian with substantial OpenAI Codex assistance; original attribution and Apache-2.0 retained.

Hosted CI at exact head 7a9d3b2d12cef85374145c315e14220342a4400e schedules the broad package matrix because the shared reader changed. Nineteen failures inspected through2026-10-23T13:08Z were individually diagnosed: seventeen reject historical certificates/selected-result.json pins and two reject historical docs/research/pr-intake-decisions.json pins. Each failed package and rejected source file is byte-identical between this PR base and head. The inspected failures therefore predate this change; none is counted as a pass. Other queued/running jobs remain unclassified.

For example, job 120404022675 rejects the selected record pinned to bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129, while both base and head contain 6fe0a099b89aa2aed796a13c3a21dafc63f3388ebf397464e44e0451893b9375. The package-local checker hashes its historical provenance rows against live files; generic metadata validation authenticates the historical pins separately. No frozen pins or scientific receipts were rewritten. These findings do not establish Linux descendant-test success or full historical scientific acceptance.

[Clear1nsight]

Change and mathematical scope

Additional independent diagnosis for the incomplete archive run, with no code change or new κ: job 120404049499, research/bit-revision3-levers-seed03, fails RESULT.json equality because the verifier's supported historical-record fallback changes its recorded path. A complete diagnostic recomputation found exactly one field difference: /binding/record, from certificates/selected-result.json to certificates/checkpoints/frontier1094.json. All other generated result fields agree. The unchanged hosted hook remains failed.

Task and overlap

Task upstream-workflow-repair-round3-20261024, scope changed from general workflow triage to the newly observed receipt-path mismatch. Original work is Sagar Thakrar's #1334; its README expressly permits the frontier1094 record to become a checkpoint. This supplements #5185's earlier 19-failure diagnosis. A bounded current PR/discussion check found no active exact-package repair; the shared-reader claim is DONE/released. This is a finding on the existing PR, not a second reader repair.

Validation

At the 2026-10-23 13:35 UTC snapshot, run 39950023707 still reports queued with no conclusion. Its 257 visible jobs comprise 143 successes, 25 failures, four in progress and 85 queued. The first 11 failed logs retain the earlier diagnosis; all 14 additional failed logs were inspected. Thirteen reject selected-record hashes; the remaining job is the new receipt-path mismatch. Thus the known 25 failures are 22 selected-record hash rejections, two intake-decision hash rejections and this one receipt mismatch. Remaining jobs are unclassified.

Exact head: 7a9d3b2d12cef85374145c315e14220342a4400e; tested merge: 0f9867214039beb74662ad5f88c71822e7c2ce8b; tested base: ec2780e8aeb1c88acaf5e9e470ef8c68e7fbbb6c; refreshed main: ff3cc58e370d0f678e529246f8c73e8094e18fcf. All 25 failed package trees are identical across tested base, merge and refreshed main. The affected lever package tree is aa75418d70dc4e4a0d91f968b590cd21e1fdd0c0. Its selected and checkpoint source blobs are also unchanged across these three contexts, so this mismatch is inherited.

The 32.76-second diagnostic ran the unchanged verifier's main() with --write in an isolated captured source layout, intercepting only the intended RESULT write to a separate output. It did not modify the frozen receipt. Original RESULT SHA256: 5cabbf737ed857061ed02b6a49243e656fbe850e5a614a5f94763f32fb16896b; captured RESULT SHA256: c6fd189399b2c1dbbdf1e110b08507adca8061cf9f6622008d555e14ee0eca7e. A recursive full-result comparison found only the path difference above. The separate unittest command and optimized mode were not freshly replayed; no hosted pass or complete scientific admission is claimed.

Do not treat the historical record and checkpoint as byte aliases. The original pinned record SHA256 is 10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32; checkpoint SHA256 is bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129. Their sole recursive field difference is the scripts/verify_hpe_lean_binding.py proof-supplement hash: 52aa1d23641e4c716b43c98f6b883ad042087dd03a9d01369e8e6a735b07aa03 versus 2fe5aac5828b1fdb79ff5e9ba87faef4db77e0c9339f362a1775b498a6d59e13. Binding-consumed assembly, EXPECTED and word hashes agree; this does not establish full-record or Lean equivalence.

Credit

Sagar Thakrar's original package and arithmetic; JoyboyBrian's shared-reader repair and prior source-failure diagnosis; earlier independent workflow triage and the sole upstream monitor. Prepared with substantial OpenAI Codex assistance. Original sources and receipts are preserved.

Open next questions

Choose an explicitly source-bound current-context receipt or a genuine historical replay against original pinned source bce54fb3f895cbe5cd4c0eb477c3afeed100190f. Preserve the differing provenance and verify all registered commands. Simply ignoring /binding/record, overwriting the frozen RESULT, or treating a separate additive package as a repair of this existing hook would be insufficient. No archive-wide rerun is requested by this finding.

HANDOFF

Research discussion / PR / artifact: #5185 and failed job https://github.com/CrocSwap/integer-mult-bounds/actions/runs/39950023707/job/120404049499 ; this comment is the diagnostic artifact.

Exact commit: 7a9d3b2d12cef85374145c315e14220342a4400e, tested merge 0f9867214039beb74662ad5f88c71822e7c2ce8b, source package tree aa75418d70dc4e4a0d91f968b590cd21e1fdd0c0.

What is established: The full generated receipt differs only in /binding/record; source bytes and frozen RESULT are preserved. The registered hook remains failed. All 25 currently inspected failed package trees predate this reader change.

What remains uncertain: Corrective contract and complete registered-command validation remain open; full-record equivalence, new scientific admission and remaining queued/running jobs are not established.

Smallest useful next task: Produce an explicit current-context or historical-context replay contract that retains provenance and leaves frozen evidence intact, then review its integration with the existing registered hook.

Reproduction command and expected runtime: In a disposable copy of the package at the tested merge, run python3 -I -B research/bit-revision3-levers-seed03/verify.py --write, capturing generated RESULT separately from the immutable original; compare every JSON field. Approximately 33 seconds locally. The unchanged registered command without --write reproduces the receipt mismatch. Do not run --write against the canonical frozen package.

Predecessor credit: Sagar Thakrar #1334, JoyboyBrian #5185, prior independent triage and source authors; OpenAI Codex assistance.

{
  "schema": "integer-mult-coordination/v1",
  "kind": "HANDOFF",
  "task": "upstream-workflow-repair-round3-20261024",
  "scope": "Inherited bit-revision3-levers-seed03 full-receipt record-path mismatch; original evidence preserved, corrective replay contract open.",
  "base": "ff3cc58e370d0f678e529246f8c73e8094e18fcf",
  "expiry": null,
  "artifact": "https://github.com/CrocSwap/integer-mult-bounds/pull/5185"
}