Decisions

2026-10-29: Advance current v0.10.9 publication markers, documentation coverage, the frozen review candidate and six exact asset authorities only after the owner-merged source, annotated tag, all four tagged jobs, normal protected registry approval, six independently downloaded files and ten non-yanked registry archives reconcile. Retarget the published replay label to these verified bytes. Preserve the v0.8.0 predecessor, unsigned policy, historical evidence and unperformed independent-review status. A controlled physical matrix and installed startup do not claim real-title full calibration or Deep Capture success.

2026-10-31: Pair #528 and #529 in S185 because a live managed client's HTTPS continuity depends on trust surviving session teardown. The owner states there are no existing users and directs a clean break on installation, so the first installer run removes identified canonical pre-S185 Fragcap state instead of migrating it. One public installation identity lives under ProgramData with a separate machine-DPAPI-protected signer and exact SYSTEM/Administrators ACL; LocalMachine/Root trust covers all Windows users. MSI runs elevated setup with transaction-specific rollback, while portable users explicitly run the same setup. Startup status is read-only and never claims signing; each Deep Capture/calibration entry proves the key and exact root before effects. Session cleanup, ordinary uninstall and Doctor recovery retain installation trust. Explicit exact-fingerprint removal and repair remain separate elevated actions. This is source candidate work and makes no release or live-game compatibility claim. 2026-10-31: PR review found that ProductCode is stable across repair and reinstall, so it cannot by itself prove rollback ownership. A newly created CA now carries an exact MSI creation receipt, commit disarms it, and rollback requires it. Doctor includes installation CA in its one report before readiness rendering, preserving one verdict per mode. The historical published-package replay uses its original contract while the candidate package job explicitly enables S185 assertions. 2026-10-31: Second-round review found that an ordinary user can own a precreated ProgramData object despite an exact DACL and later rewrite that DACL. Installation directories and signer now require SYSTEM or Administrators ownership as well as the exact DACL. New objects explicitly declare Administrators ownership; an ordinary-user-owned preexisting object is refused before reuse or repair. 2026-10-31: Exact-head Linux and MSRV checks found that the Windows signer load call and a shared calibration confirmation helper had incorrect compile gates. Non-Windows builds now return the existing platform refusal through a stub, while the pure confirmation helper compiles on every target. The Windows-only trust-mutation import is gated with its use. 2026-10-31: The Ubuntu all-features lint subsequently found installation-only constants, MSI receipt helpers, and parsed identity fields unused in non-Windows product builds. Compile cross-platform identity helpers for controlled tests, compile MSI receipt helpers only on Windows, and retain the parsed fields for strict identity validation without claiming a non-Windows CA implementation. 2026-10-31: Ubuntu's test-target lint exposed the narrower MSI receipt boundary: those receipt tests run only on Windows, so their helpers also compile only on Windows. Cross-platform identity and rollback-decision tests remain available without the Windows filesystem/store effects. 2026-10-31: Final-package certification measured one new ordinary PE import, ole32.dll, from CoTaskMemFree paired with SHGetKnownFolderPath for the machine ProgramData root. Admit that exact OS import in the closed package contract and record persistent installation CA provisioning as an installer effect; keep all other PE import constraints unchanged. 2026-10-31: The first hosted clean MSI install reached CA provisioning but raw SDDL text equality refused newly created storage. NTFS may add the auto-inheritance control marker to a protected DACL. Accept only the same protected DACL with that optional marker and exactly the declared ACEs; retain SYSTEM/Administrators owner verification. Report the observed SDDL if any other mismatch remains, so the next package run can distinguish this hypothesis from another cause. 2026-10-31: A disposable local NTFS ACL probe identified the missing representation: the public-directory BU generic read ACE persisted as an object FR ACE plus an inheritable GR inherit-only ACE, with D:PAI. Permit that one exact canonical representation in addition to the declared protected DACL; extra grants, changed rights, and unprotected inheritance remain refused. The probe restored its temporary ACL and removed its directory. 2026-10-31: Hosted clean MSI installation under 129d2c8 persisted a second exact public-directory rendering, D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FR;;;BU), then failed the closed verifier before CA creation. Admit this measured NTFS mapping of generic read to file read with the original inheritance flags. Preserve the trusted-owner check and refusal of every unmeasured grant. 2026-10-31: The unrelated hosted process-watcher row failed twice on feb695e after seven preceding passing runs, but the summary-only matrix exposed no failure cause. Emit only a fixed, allowlisted failure category for that row, keeping raw ETW test output and command lines on the ephemeral runner. Use the category from the next exact-head run to decide whether a product or test correction is warranted.

2026-10-31: The v0.10.10 release bump changes only eleven first-party package versions across the three governed dependency graphs. Rebind the measured graph digests and unsafe-review inventory without changing third-party packages, feature edges, package and edge counts, review expiry, or exceptions. Synchronize the nine first-party identities in each isolated fuzz and native-performance lockfile; their third-party resolutions remain unchanged. The independent-review record remains an empty not-started template for the new product version; no independent whole-product review is claimed.