@@ -81,8 +81,12 @@ also verify snapshot stability across validated rebinding.
 
 v3 retains raw escaped target/query, ordered fields and separate trailers; it
 has no merged v2 query/form/path map. Applications opt into bounded decoders;
-path captures use exchange::path_args(). Cookies use the standalone parser/render
-API and ordered Cookie/Set-Cookie fields. Request bodies are pulled and footers
+path captures use exchange::path_args(). Cookies use the owned `http::cookie` value,
+`http::parse_cookie_header` and typed `http::render_set_cookie` operations with
+ordered Cookie/Set-Cookie fields. TASK-192 supplies the installed helper and the
+`http_cookie` suite with all three capability-054 identities. Receipts bind named
+checks to the actual executable/hash, command, complete log and executed counts;
+semantic supporting evidence does not claim per-protocol wire observations. Request bodies are pulled and footers
 are accessed after end-of-body. Malformed encodings and limits return typed errors.
 Multipart disk sinks have explicit abort cleanup, keep-once callbacks and sanitized
 names, verified by named decoder and disk lifecycle tests.
 
@@ -62,14 +62,31 @@ application work still consumes a worker.
 | `get_content` | `admit_body(body_policy{cap})`, then `co_await body().collect(cap)` or incremental `read_some()` | Admission before reads; typed limits, cancellation and protocol errors |
 | `get_footers` | `body().trailers()` after end-of-body | Trailers remain separate from initial fields |
 | Multipart uploaded-file map and cleanup callbacks | `forms::read_multipart`, `part_sink`, `temp_file_part_sink`, `temp_file_options::should_keep` | Limits are snapshotted at invocation; exchange and part sink remain borrowed through task completion. Partial parts abort exactly once; disk files clean up on abort/destruction; keep callback runs once per completed file, throws mean remove; client names sanitized |
-| `get_cookie` / response `with_cookie` | Ordered Cookie/Set-Cookie fields; parse and render cookie values in application code | Preserve repeated fields; no native request/response convenience aliases |
+| `get_cookie` / response `with_cookie` | `http::parse_cookie_header`, `http::render_set_cookie`, ordered Cookie/Set-Cookie fields | Preserve repeated fields; no native request/response convenience aliases |
 
 Form/query decoding is optional, bounded, and reports malformed encodings.
 A query is the substring after `?` in `raw_target`; decoding it does not modify
 the raw target. Body trailers are meaningful only after a completed body read.
 
-The legacy cookie class is removed. Native headers retain repeated Cookie and
-Set-Cookie field values; applications own value parsing and rendering.
+Include `<httpserver/http/cookie.hpp>` directly or `<httpserver/http.hpp>`.
+`http::cookie` owns raw strings and attributes; `parse_cookie_header` returns
+owned pairs in token order. Iterate every `head_fields.all("cookie")` occurrence
+in received order. Parsing trims SP/HT at token/name edges, splits at the first
+`=`, strips one outer quote pair and skips malformed/empty-name tokens. It does
+not URL-decode, trim leading value whitespace or remove interior controls.
+
+`render_set_cookie(value, output)` validates before replacing output and returns
+`http::outcome_code::invalid_argument` on invalid input. Append output to an
+ordinary `Set-Cookie` field only on success, once per cookie. This replaces v2
+fluent setters and throwing rendering; direct mutation is raw until rendering.
+The renderer rejects CR/LF/NUL/semicolon, controls/whitespace/equals in names,
+and commas in Domain/Path. Empty rendered names are invalid. Attribute order is
+Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite; None implies Secure.
+Expires uses locale/timezone-independent GMT Unix seconds in years 0000..9999;
+out-of-range times now fail explicitly instead of platform-dependent conversion.
+Signed Max-Age, empty values, case and percent bytes remain unchanged. Existing
+field budgets bound input; there is no cookie jar or cached request convenience.
+The `http_cookie` suite preserves the three named capability-054 witnesses.
 
 ## Response ownership and producers
 
 
@@ -35,6 +35,17 @@ provide owned/reopened/leased body sources and per-send producers.
 \include v3_routes.cpp
 \include v3_route_handlers.hpp
 
+\section native_v3_cookies Owned cookie values
+
+Include <httpserver/http/cookie.hpp> directly or through <httpserver/http.hpp>.
+\ref httpserver::http::parse_cookie_header returns owned raw cookie pairs;
+iterate every ordered Cookie field. Construct or modify
+\ref httpserver::http::cookie attributes, then call
+\ref httpserver::http::render_set_cookie and append the output as a separate
+Set-Cookie field only on success. Invalid input yields invalid_argument and
+leaves output unchanged. The migration guide documents exact parsing,
+canonical attribute ordering, SameSite=None and bounded GMT Expires behavior.
+
 \section native_v3_websockets WebSocket sessions
 
 \ref httpserver::exchange::upgrade returns a typed rejection or owning
 
@@ -273,8 +273,10 @@ def check_receipt(root, inventory, receipt):
                     errors.append('missing live policy refusal witness')
                 if item.get('mode') in ('h2-tls', 'h3-quic') and type(witness.get('stream')) is not int:
                     errors.append('missing refused stream identity')
-            elif item['name'] not in executed_tests((root / command['log']).read_text()):
-                errors.append('named supporting test did not execute successfully')
+            else:
+                log = (root / command['log']).read_text()
+                if item['name'] not in executed_tests(log) or not matching_execution(command, item['suite'], log):
+                    errors.append('named supporting test lacks matching suite execution provenance')
         outcomes = {}
         for outcome in receipt['outcomes']:
             key = (outcome['capability'], outcome['mode'])
@@ -340,15 +342,51 @@ def check_receipt(root, inventory, receipt):
     return errors
 
 
+def named_execution(binary, suite, log):
+    """Bind named checks to the invoked executable, including libtool wrappers."""
+    actual = binary.parent / '.libs' / binary.name
+    actual = actual if actual.is_file() else binary
+    return {'suite': suite, 'executable': str(actual.resolve()),
+            'sha256': hashlib.sha256(actual.read_bytes()).hexdigest(),
+            'log_sha256': hashlib.sha256(log.encode()).hexdigest(),
+            'tests': len(executed_tests(log)),
+            'checks': int(re.search(r'^(\d+) checks$', log, re.MULTILINE)[1])}
+
+
+def matching_execution(command, suite, log):
+    proof = command.get('named_execution', {})
+    argv = command['argv']
+    cwd = Path(command.get('cwd', ''))
+    if not isinstance(proof, dict) or not cwd.is_absolute() or not argv or proof.get('suite') != suite:
+        return False
+    binary = (cwd / argv[-1]).resolve()
+    if binary.name != suite or not binary.is_file():
+        return False
+    if len(argv) != 1:
+        # The sole supported launcher is the explicitly recorded peer_policy affinity.
+        if suite != 'peer_policy' or len(argv) != 4 or Path(argv[0]).name != 'taskset' \
+                or argv[1] != '-c' or not argv[2].isdigit():
+            return False
+    if not executed_tests(log):
+        return False
+    expected = named_execution(binary, suite, log)
+    return proof == expected and type(proof.get('tests')) is int and type(proof.get('checks')) is int
+
+
 def executed_tests(log):
     """Require completed named Littletest checks, never merely a zero exit."""
-    names = re.findall(r'^Running test \(\d+\): ([\w]+)$', log, re.MULTILINE)
+    running = re.findall(r'^Running test \((\d+)\): ([\w]+)$', log, re.MULTILINE)
+    names = [name for _, name in running]
     completed = re.findall(r'^- Time spent during "([\w]+)":', log, re.MULTILINE)
-    count = re.search(r'^(\d+) tests executed$', log, re.MULTILINE)
-    checks = re.search(r'^(\d+) checks$', log, re.MULTILINE)
-    if not count or not checks or int(checks[1]) < 1 or int(count[1]) != len(names) or names != completed \
-            or len(set(names)) != len(names) or not re.search(r'^-> 0 failures$', log, re.MULTILINE) \
-            or not re.search(r'^-> 0 skipped$', log, re.MULTILINE):
+    counts = [re.findall(pattern, log, re.MULTILINE) for pattern in
+              (r'^(\d+) tests executed$', r'^(\d+) checks$', r'^-> (\d+) successes$',
+               r'^-> (\d+) failures$', r'^-> (\d+) skipped$')]
+    if any(len(values) != 1 for values in counts):
+        return set()
+    tests, checks, successes, failures, skipped = (int(values[0]) for values in counts)
+    if checks < 1 or tests != len(names) or checks != successes or names != completed \
+            or [int(number) for number, _ in running] != list(range(1, tests + 1)) \
+            or len(set(names)) != len(names) or failures or skipped:
         return set()
     return set(names)
 
@@ -419,6 +457,7 @@ def execute(identity, argv, cwd=root, tool=None, timeout=300):
                 named = executed_tests(log)
                 if not named:
                     raise RuntimeError(lane + '-' + suite + ' has failed, skipped, empty or incomplete named checks')
+                receipt['commands'][-1]['named_execution'] = named_execution(binary, suite, log)
                 if lane == 'on':
                     for name in sorted(named):
                         kinds = {test['kind'] for cap in inventory['capabilities'] for test in cap.get('tests', [])
 
@@ -0,0 +1,25 @@
+# TASK-192 interface decision and doubts
+
+Constraints: owned byte-transparent cookie pairs, no v2 classes, ordinary ordered fields, libhttpserver outcomes, one mandatory render validation boundary. Inspection finds no reusable public `result<T>`; existing HTTP helpers use optional or named result records.
+
+| Alternative | Depth | Locality | Seam |
+|---|---|---|---|
+| Validated class with fluent setters and static parsing | Hides validation but many entry points | Every setter plus raw parse bypass | Raw input needs a second state representation |
+| Owned aggregate plus explicit parse/render | Two operations hide tokenization, validation and date formatting | All emission checks in one renderer | Matches callers composing ordered fields |
+| Field adapter parsing/adding Cookie/Set-Cookie automatically | Convenient repeated fields, wider interface | Couples cookie and field policies | Hides allocation and application failure decisions |
+
+Choose owned `http::cookie`, `parse_cookie_header(string_view) -> vector<cookie>` and `render_set_cookie(cookie, string&) -> outcome`. The output reference follows atomic state replacement: errors leave output unchanged. Raw construction/mutation is explicit; validation is deferred until rendering, including parsed values. Applications append a successful value once as an ordinary Set-Cookie field. This deliberately migrates v2 fluent setters/throwing exceptions, not preserved wire semantics. No generic result framework or adapter.
+
+Decision to refute: a single renderer can safely validate every raw construction path without losing lenient parser behavior.
+
+| Doubt | Discriminator/clearing evidence required |
+|---|---|
+| Borrowed input outlives parsing | Destroy/overwrite original input then render owned copies |
+| Parsed CR or mutable attributes bypass safety | Explicit CR/name preconditions; typed failure and unchanged sentinel for CR/LF/NUL/semicolon and comma attributes |
+| Whitespace/quotes change legacy parsing | Legacy code inspection: trim only SP/HT at token/name ends; retain value-leading whitespace, first equals, strip exactly one matching quote pair |
+| Date overflows or depends on locale/timezone | C++20 civil date conversion with bounded years 0000..9999; epoch, negative second, leap day, extrema and int64 overflow tests; fixed English spelling |
+| Unrelated executable proves named parity | Command path/suite match and real binary SHA-256, native positive execution, adversarial absent/mismatched/wrong-case/count/skip/completion fixtures |
+| Allocation grows beyond input | Linear scan, one owned pair per nonempty input token; no cache/global state; input remains governed by existing field budgets |
+| Reflection creates another wire message | Independent raw TCP managed/external consumer checks exact repeated response fields, rejected attempted injection and one response |
+
+Rollback: revert the additive helper/registration before v3 API freeze. No persistent state changes. All interface doubts are cleared by the named native cases, real positive/provenance runner contracts, four lane receipts and installed managed/external raw-wire consumers in [implementation evidence](TASK-192-implementation-evidence.md). Ownership, injection, formatting and storage discriminators have no unresolved result.