Dated source reference. Current release status: handoff state. Full original relative paths are in the developer archive.

Private declaration ownership path

The network-neutral adapter has a separate, opt-in declaration reference probe. It forwards the original native callback and grants no drawing or suppression authority. The accepted packet mask remains zero. MU's identical DLL passes original CO and college CP, including match-bound publication-to-consumer declaration snapshots, physical-reference closure and both legacy nested-material roles. The newer combined state-input diagnostic is in the pending MY build; it has no native acceptance yet.

packet-vertex-declaration-input.hpp copies the exact 24-byte descriptor and, only when the original callback will create an object, its bounded sentinel element stream. Signed zero/negative counts and an existing object do not authorize an element read. Heap and image tokens remain independently current. A copied native object word does not establish a physical reference.

packet-declaration-owners.hpp binds a current descriptor span, context and already independently owned declaration pin. It never turns readability into COM ownership. Borrows share the existing pin during the bounded metadata-copy window; they make no driver calls. The new explicit-root declaration batch keeps those pins from a strict publication metadata window through consumer recapture. A later bank rebind can use a new pin to the same object; the publication's old pin stays alive and prevents identical-address object reincarnation. A missing, foreign, changed-context or changed-storage witness refuses capture. Withdrawing an older storage generation cannot remove a replacement at the same address. Reaping a changed or retired descriptor queues its pin for later release.

native-declaration-reference-acquire.hpp first obtains a typed, owned declaration through the verified current device. It keeps that original reference alive while the independent hold is created and the bank record is committed. Source storage, object identity, renderer thread and device/context are rechecked. Driver calls, AddRef and Release stay outside metadata locks and local-copy windows. Busy locks or changes during acquisition discard temporary owners through the deferred release path.

The native observer covers the complete DAE360 prologue and its three return sequences. It preserves the original caller return word and executes original pops before observing return. The complete callback/getter bytes and each installed replacement are authenticated before projecting an original code view. Entry observes the descriptor under the mutation fence; return can retain only within the same packet and current verified device/thread/context. Driver reentry skips observation. Present requests a sweep; a saved-state native exit does the metadata reaping and release work. The shared close acknowledgement includes shader, texture and declaration banks.

Evidence	Verified scope
LR, 9,846 Windows/local sanitizer checks	Descriptor and element inputs, exact bytes, typed storage and lifetime refusal
LT, 6,850 Windows/local sanitizer checks	Independent owner bank, delayed release, stale generations and replacement preservation
LU, 166 real HAL checks	Two declarations survive source retirement through independent references; real device Reset in a controlled fixture
LV2, 194 real HAL checks	Typed device acquisition, four retained/released references, busy/context/reentry refusal and real Reset
LW3, 5,498 normal checks	192 baseline and 192 observed original callbacks; machine state and native outputs match
LW3, two isolated fault processes, 769 checks each	Tampered frame and observer reentry quarantine without replacing the native return word
LX4, 155 Windows checks	Actual production observer body around the original callback, retirement, context/code/device refusal and held-owner close
LY, 25 Windows groups	Production installation and debugger-held startup barrier over 133 exact patch windows
LZ, 100 Windows groups, nine DLL profiles and 666 API tests	Combined CPU baseline; the final formatter receipt extension is separately LX4-tested and included in the next fresh build
MA, 100 Windows groups, nine DLL profiles and 666 API tests	Receipt-inclusive combined CPU gate used by the original CI and college CJ runs
MC2, 9,706 Windows/local sanitizer checks	Complete explicit declaration order and publication-to-consumer physical pins; runtime driver creation remains unresolved
MD, 160 Windows checks	Production declaration observer and refusal of acquisition in both publication and consumer metadata windows
MG, 101 Windows groups and nine DLL profiles	Original CK and college CL pass forwarding and all three reference-bank closure gates; the new complete-batch nesting path still observes role zero only
MH, 7,344 Windows/local sanitizer checks	Identity-bound publication mailbox, cancellation, deferred foreign-thread retirement and owner continuity
MP, 7,076 Windows checks	Actual publication, native-root append, strict consumer recapture and retirement; missing native append still refuses
MO, 18,946 Windows/local sanitizer checks	Native reserved command-header byte, retained indirection refusal and exact-header change detection
MQ, 27 Windows groups	Production declaration-snapshot startup and debugger barrier over 133 exact patch windows
MU, 105 Windows groups and ten DLL profiles	Same-DLL original CO and college CP pass match-bound declaration snapshot handoff/retirement and all physical-reference closure gates

The HAL source descriptors and devices above are controlled fixtures. Separate native original CI and college CJ runs use the exact MA DLL, fresh custody and the 99-file baseline. CI observes 1,223,603 declaration callbacks and commits 1,188,275 independent bank records; CJ observes 871,423 callbacks and commits 850,159 records. Both banks close healthy with no owners, pending/quarantined entries or faults. All 99 files restore and custody releases. Both complete run archives and rollback files verify and fullfsync externally. See the exact native-original-ci-review.json and native-college-cj-review.json receipts in the takeover directory. CI's overall run fails two-role nesting; its declaration closure sub-gate is explicitly separate from that result.

The later CK/CL pair runs for 30.140/30.073 seconds after copied-clock advance. Both close all three banks healthy with zero owners, pending/quarantined entries or faults; all 99 files restore and custody releases. Their complete external archives and rollback verify/fullfsync. Original CM on the new tenth MK profile fails the snapshot gate with zero prepared/captured sets. Existing reference closure still passes; restoration, release and its complete archive verify.

CM's copied commands expose two separate input issues. The root's end marker is appended after publication: preparation now models that single analytical word without writing native memory, while consumption still verifies the actual append. The pinned interpreter ignores header byte one: the parser now accepts its native values but still rejects bit-seven indirection and any later change to the full published header. These corrections have the separate MP/MO/MQ evidence above. MR preserves a failed stale-header test expectation; MS/MT correct it without changing production input parsing. Fresh MU subsequently passes its complete combined and paired native gates.

CO/CP run for 30.138/30.148 seconds after copied-clock advance. They copy/retire two/four declaration sets, including a match-bound set with physical owners in each profile. Both finish all three reference banks healthy and closed, with zero owners, pending/quarantined entries or faults; all 99 files restore and custody releases. Their complete external archives and rollback verify/fullfsync. See native-original-co-review.json and native-college-cp-review.json. The complete-batch nesting path still observes role zero only. MY's added root/constant input diagnostic needs fresh native evidence for its changed tenth profile.

These receipts do not establish complete source/free coverage, packet effect closure, native Reset recovery or visual replacement acceptance. New exact candidates need fresh native evidence.

The private receipt parser rejects malformed fields, overflow, missing identities, faults, quarantine and a later reopened ledger. Committed record and release totals need not be equal: a rejected acquisition can also create and release a temporary independent pin. A healthy final Holds.close, zero live entries and the token-bound close acknowledgement establish physical closure. No receipt grants a callback capability to presentation packages.

Publication candidate pins and joint consumers

NM adds a metadata-only publication operation that shares an already-owned local pin. The adapter holds its registry lock. This operation neither reads a native descriptor nor calls AddRef/Release, and it certifies no source bytes or execution. It is separate from the strict observe operation, whose existing quiescent-window requirement remains intact.

The publication candidate retains its original descriptor allocation/image identity, copied command/header bytes, context, object and physical pin. Consumer capture still requires a quiescent Scope and complete byte/generation recapture, then joins the original pin through borrow_bound. A changed descriptor, freed or reused allocation, wrong context, withdrawn row or active writer refuses the capture. A later diagnostic copy cannot restore execution eligibility. NM passes 10,233 Windows and local sanitizer checks, including in-flight publication, changed-object refusal, active consumer refusal and retained native lifetime.

NK original CW passes its scoped native gate; college CX passes state inputs but fails its declaration match witness. CX records 41 preparation refusals with reason changed; the full log does not identify which producer substage refused. A global quiescence refusal is reproduced by the controlled fixture, not proven as the exclusive native cause. Both runs restore 99 files and release custody, and their complete archives verify externally. NP includes the newer candidate pin operation and joint dependency consumer; its native validation is pending.