Dated source reference. Current release status: handoff state. Full original relative paths are in the developer archive.

Private material dependency batches

The batch prepares copied candidates. It does not classify callbacks or permit replacement drawing. Prepared::callback_authority and Owned::callback_authority remain false.

Preparation first enumerates the complete conservative material-command census inside a bounded 512 KiB candidate observation. It then copies each material and its texture-parameter graph under the adapter's short registry locks. The private candidate observation checks publication identity, the writer thread and the fence's fatal state. It does not certify quiescence or lease an execution scope; bounded, fault-guarded copies may overlap native mutations. Inconsistent copies may be refused immediately or become unusable candidates. No preparation result is executable, and later stages cannot refresh a stored allocation/source token.

Candidate observation cannot replace a consumer Scope, acquire physical ownership or commit an omission. Reentrant use inside a fence gate and foreign thread use retain fatal refusal. This applies only to complete-batch candidate preparation; existing consumers and ordinary observation modes are unchanged.

Consumption establishes the existing strict resource scope and re-enumerates the entire census inside a bounded local-copy transaction. The transaction refuses mutations already in flight or any prior scope revocation. Its gate delays new observed native mutations before their unsafe effects, while local checkpoints retain the original epoch. It permits neither omission commits nor native/driver calls or retirement. Reentrant mutation still changes the epoch and invalidates the result. The adapter holds its registry mutex before taking the try gate; it never waits for a native writer while holding that gate.

Physical witness collection shares already-retained local Pins. It invokes no AddRef or Release backend, and Pin destruction only queues deferred retirement. Actual driver cleanup remains outside the transaction. The test backends now assert that no retain/release callback occurs during local copying. The complete batch observer runs before the independent single-material diagnostic, so the latter cannot preempt its capture attempt with an earlier scope refusal.

The census command addresses, parameters and byte count must equal the prepared census. Every material, parameter payload, descriptor, source generation and physical owner must then validate within that same scope. Any mutation during capture, changed command, allocation reuse, missing dependency, budget exhaustion or partial failure invalidates the execution and clears the output. Earlier retained references unwind with the failed candidate. Scope retirement remains mandatory.

This arrangement permits candidates copied before an unrelated mutation to be considered later. It does not permit that mutation inside consumer validation or an omission commit. A copied candidate whose dependency actually changed must fail its consumer comparison. The source/free/context, complete native code, ordered cache and material effects, nested-VM identity and semantic owner contracts still apply independently.

The command census is deliberately a superset. Command-like inline data can cause refusal. The separate control-flow diagnostic must not replace this gate or turn opaque callbacks into state-only effects. In original BT's three hash-checked copied samples, all 430, 602 and 685 material candidates were on the explicit command path. Those samples therefore did not explain the batch failure through raw-only candidates. They establish neither resource ownership nor callback classification.

The JP component receipt covers 29,407 Windows and local ASan/UBSan checks, including mutations between preparation stages and precise copied refusal traces. The production observer releases its outer metadata mutex between those stages. JQ covers 10,418 checks of the production publication, consumption, retirement and cancellation body. JT passes the fresh 77-group combined gate, but original BW still fails complete native batch coverage. Its trace identifies image-resident metadata; see the separate storage binding. JY passes 78 fresh groups, and KC passes 79 groups with typed image-owner receipts and ordered cache-sequence tests. Original BY's real image-backed descriptor has one match-bound copy/retirement pair, but its complete-batch gate still fails: most producer attempts cannot enter a quiescent metadata window, and its two nonempty consumer attempts refuse. All 99 files restore and custody releases at 2026-11-08 19:03:25 UTC. Its complete archive and rollback verify/fullfsync.

The new candidate observation removes preparation's global quiet-window requirement while preserving every consumer check. Current local ASan/UBSan and TSan tests pass 29,667 checks, including an in-flight producer that prepares a candidate while its consumer refuses, no rearming after the writer ends, generation reuse, added/removed/changed commands, mutations between and during stages, incomplete reads and bounded capacity. Fresh Windows resource, combined and native campaigns remain required. Component checks do not grant native acceptance.

Original BZ tests KJ's candidate preparation for 69.198 seconds after clock advance. Preparation progresses, but capture still refuses while the original epoch changes and a resource mutation is in flight. All other existing component gates pass; all 99 files restore and custody releases at 19:31:19 UTC. Its complete archive and rollback verify/fullfsync externally. These diagnostics motivated the local-copy transaction, which BZ does not contain.

KM now passes 30,141 Windows checks and local ASan/UBSan/TSan checks. KN passes 10,793 production-body checks; KL passes all 23 resource groups. The primitive copy tests separately cover writer exclusion, reentrant writes, nested commit and copy refusal, wrong threads, exception cleanup and later ordinary commits. KO passes all 79 fresh Windows groups. Original CA and college CB pass complete nonempty match-bound batch copying and retirement for 30.033/30.088 live seconds; all 99 files restore in each game and both release custody. Their complete external archives and rollback pass content, metadata and durable-storage verification. No new callback authority is accepted from these component tests.