Bind seed preparation to qualified detach host and fresh data destination

docs/roadmaps/barc-01-useful-play.md

@@ -569,3 +569,22 @@ requested production is admitted by this source qualification.
 **Actor eligibility remains false; requested-unit acceptance is unproved;
 useful play remains 0/6.** SourceLink remote content and telemetry usage remain
 unknown. Publication and installed adoption are separate.
+
+### Seed input source reconciliation after BAR39 (2026-10-05)
+
+The [finite mapping profile](../../tests/Broker.NativeProof/RuntimeEvidence/fixtures/seed-attribution-helper/helper/mapping_profile.py)
+now selects the retained detach host compiled from
+`2e332259c5db590be63bb628e6c4de4b3c8e2291` and the prospective
+`bar-native-seed-data-preparation-20261005-v3-clr10` data destination.
+The startup source role names that compiled candidate. All 44 retained host
+files (8,827,674 bytes) match the original compiler operation's hashes and physical
+pins. The 453 inherited mapping rows and original CLR pin set remain unchanged.
+All 117 portable controls passed, including refusal of both consumed data
+destinations and the earlier host. This changes source bindings only.
+
+The prospective data root remains unprepared. A successful separately admitted
+data copy must supply complete actual custody before a successor seed profile
+can become ready; native startup requires its own exact admission. A future
+operation-root change requires an explicit mapping successor. Neither this source
+change nor retained host custody admits native execution. Actor eligibility
+remains false and useful play remains 0/6; telemetry coverage is unknown.

tests/Broker.NativeProof/RuntimeEvidence/fixtures/seed-attribution-helper/helper/mapping_profile.py

@@ -28,14 +28,14 @@ def admitted_pins(p):
 HISTORICAL_PROFILE_SHA='b2d3dd34b88a838a073fa64aa514681c01f1dfee0bd4388fea8441a87bc93dcf'
 BASELINE_SHA='11224181c3b33d6894a35cc7e32f655b2087442e4ba4958ef7700dc2c333cad0'
 HISTORICAL_ROWS_SHA='8b5d4e2c59978b2e5f0d3d6457a3276935de52859279a0047102017ebd11324c'
-RESULT_ROWS_SHA='b9da4fff63926901802580850fcc91888455d5584cdc4e9d38daff1ed807031a'
-SUCCESSOR_BASE_ALLOWED_SHA='2e15d85a1ea33e9f2bca9f24f10046e9a10ea1c28645c4faf4fe9376dd816546'
-SUCCESSOR_MAPPING_DELTA_SHA='7851f21c579ca183d7c5a7641dcc114213ffa7d67e18187b2b93da5fceea1741'
+RESULT_ROWS_SHA='33826428b41de8c76f4af81af287ecd83d9a13e3792e9105b40ca62156993ea0'
+SUCCESSOR_BASE_ALLOWED_SHA='fbaf4b5b6c1c2b0bb11bd361931d4c194ec6da948ef9aeb73edfef2363343959'
+SUCCESSOR_MAPPING_DELTA_SHA='5ea5acb80b52c5ec81a1b4cc999c1f8ca5c316ce0302218263ea9918b85b3310'
 RETAINED_PHYSICAL_ROWS_SHA='33f0adb4e40baf2da15d1794e46311b66ecb1bbb2c80cf517ce98d2f83d0d07a'
 BASE='/home/developer/.local/share/fs-gg-private'
 HISTORICAL_DATA=BASE+'/bar-stock-policy968-private-input-successor-20261003/packet/runtime-data'
-DATA=BASE+'/bar-native-seed-data-preparation-20261005-v2/packet/runtime-data'
-HOST=BASE+'/bar-native-seed-input-preparation-20261005-v1/native-host/Broker.NativeProof'
+DATA=BASE+'/bar-native-seed-data-preparation-20261005-v3-clr10/packet/runtime-data'
+HOST=BASE+'/bar-detach-compiled-qualification-root-operation-20261005-v1/native-host/Broker.NativeProof'
 POLICY=BASE+'/bar-native-seed-policy-adoption-root-operation-20261005-v1/placement/managed/RuntimeEvidence'
 OLD_HOST='/tmp/bar-stock-fb00-managed-artifact-preparation-synthetic-pdb-successor-20261004/native-host/Broker.NativeProof'
 AI={'officialCInterface':'AI/Interfaces/C/0.1/libAIInterface.so','highBarPlugin':'AI/Skirmish/highBar/stable/libSkirmishAI.so','stockOpponentNullAI':'AI/Skirmish/NullAI/0.1/libSkirmishAI.so'}

tests/Broker.NativeProof/RuntimeEvidence/fixtures/seed-attribution-helper/helper/test_mapping_profile.py

@@ -44,10 +44,11 @@ def digest(value):
  def validate(self,p,digest):
   with patch.object(m,'semantic_digest',side_effect=digest):return m.validate_schema(p)
  def test_independent_golden_delta(self):
-  self.assertEqual(m.semantic_digest(self.delta),'7851f21c579ca183d7c5a7641dcc114213ffa7d67e18187b2b93da5fceea1741');self.assertEqual(len(self.projection),458);self.assertEqual(len(self.base),145);self.assertEqual(sum(x['kind']=='clrPE'for x in self.projection),313)
- def test_consumed_v1_data_paths_refuse(self):
+  self.assertEqual(m.semantic_digest(self.delta),'5ea5acb80b52c5ec81a1b4cc999c1f8ca5c316ce0302218263ea9918b85b3310');self.assertEqual(len(self.projection),458);self.assertEqual(len(self.base),145);self.assertEqual(sum(x['kind']=='clrPE'for x in self.projection),313)
+ def test_consumed_v1_and_v2_data_paths_refuse(self):
   p,digest=self.fixture();old='/home/developer/.local/share/fs-gg-private/bar-native-seed-data-preparation-20261005-v1/packet/runtime-data'
-  q=copy.deepcopy(p);q['dataRoot']=old;self.denied(self.validate,q,digest)
+  for consumed in (old,old.replace('-v1/','-v2/')):
+   q=copy.deepcopy(p);q['dataRoot']=consumed;self.denied(self.validate,q,digest)
   q=copy.deepcopy(p);entry=next(x for x in q['mappingDelta']['added']if x['role']=='highBarPlugin')
   for field in ('declaredPath','canonicalPath','baseAllowedKey'):entry['row'][field]=entry['row'][field].replace(m.DATA,old)
   self.denied(self.validate,q,digest)
@@ -90,6 +91,7 @@ def test_new_role_path_and_full_pin_join(self):
   p,digest=self.fixture()
   for field in('nativeHost','dataRoot','engine'):
    q=copy.deepcopy(p);q[field]='/unselected';self.denied(self.validate,q,digest)
+  q=copy.deepcopy(p);q['nativeHost']='/home/developer/.local/share/fs-gg-private/bar-native-seed-input-preparation-20261005-v1/native-host/Broker.NativeProof';self.denied(self.validate,q,digest)
   q=copy.deepcopy(p);q['policy']['apphost']='/old/policy';self.denied(self.validate,q,digest)
   q=copy.deepcopy(p);row=next(x for x in q['executableMappingIdentities']['rows']if x['declaredPath']==m.POLICY);row['pin']['inode']+=1;self.denied(self.validate,q,digest)
  def test_missing_preparation_refuses(self):

tests/Broker.NativeProof/RuntimeEvidence/fixtures/seed-attribution-helper/helper/test_prearm_startup.py

@@ -7,7 +7,7 @@
 import mechanics as m
 import stock_bootstrap as b
 class Startup(unittest.TestCase):
- def p(self):return {'source':{'fsbarCommit':'361f5060aea0e340fb8a33da96a91fd234e7fc39','highbarCommit':'b'*40},'proposedPorts':{'grpc':5021,'gateway':3900,'unusedReceiverOrigin':3800},'runId':'controlled','nativeHost':'/controlled/host','engine':'/controlled/engine','dataRoot':'/controlled/data','startscript':'/controlled/startscript','runtimeEnvironment':{'DOTNET_EnableDiagnostics':'0'},'engineRuntimeEnvironment':{'XDG_RUNTIME_DIR':r.ROOT+'/engine/run'},'policy':{'apphost':'/controlled/policy','closurePath':'/controlled/closure','closureSha256':'c'*64,'environment':{'PATH':'/usr/bin:/bin'}}}
+ def p(self):return {'source':{'fsbarCommit':'2e332259c5db590be63bb628e6c4de4b3c8e2291','highbarCommit':'b'*40},'proposedPorts':{'grpc':5021,'gateway':3900,'unusedReceiverOrigin':3800},'runId':'controlled','nativeHost':'/controlled/host','engine':'/controlled/engine','dataRoot':'/controlled/data','startscript':'/controlled/startscript','runtimeEnvironment':{'DOTNET_EnableDiagnostics':'0'},'engineRuntimeEnvironment':{'XDG_RUNTIME_DIR':r.ROOT+'/engine/run'},'policy':{'apphost':'/controlled/policy','closurePath':'/controlled/closure','closureSha256':'c'*64,'environment':{'PATH':'/usr/bin:/bin'}}}
  def test_closed_raw_path_and_policy_environment(self):
   p=self.p();self.assertEqual(r.environment(p,'host')['BARC_ONE_UNIT_RAW_EVENTS'],r.ROOT+'/host/raw.jsonl');self.assertEqual(r.environment(p,'policy'),{'PATH':'/usr/bin:/bin'});self.assertEqual(set(r.commands(p)),{'host','engine'});self.assertEqual(len(r.commands(p,'d'*64)['policy']),7)
   for role in ['browser','receiver','actor']:

tests/Broker.NativeProof/RuntimeEvidence/fixtures/seed-attribution-helper/startup_runner.py

@@ -15,7 +15,7 @@ def profile():
  from mapping_profile import load_profile
  need((HERE/'startup-profile.json').is_file()and not(HERE/'startup-profile.json').is_symlink(),'closed JSON input')
  p=load_profile(HERE/'startup-profile.json');need(p['schema']=='bar.seed-attribution-profile/v2' and p['preparationReady'] is True and p['attemptRoot']==ROOT and p['roles']==['host','engine'],'closed startup profile')
- need(p['source']=={'fsbarCommit':'361f5060aea0e340fb8a33da96a91fd234e7fc39','highbarCommit':'b57f11f290dc3239d894b0285ae272b6b21bc25d'} and p['engineSource']=='de69361239d8c8b1012dba3f5aa3122954ea4da3','literal source roles')
+ need(p['source']=={'fsbarCommit':'2e332259c5db590be63bb628e6c4de4b3c8e2291','highbarCommit':'b57f11f290dc3239d894b0285ae272b6b21bc25d'} and p['engineSource']=='de69361239d8c8b1012dba3f5aa3122954ea4da3','literal source roles')
  need(p['limits']==dict(wholeSeconds=180,hostReadinessSeconds=60,cleanupReserve=8,termSeconds=3,killSeconds=3,streamBytes=33554432,attemptBytes=134217728,attemptFiles=1024,mapsBytes=4194304,ownedIdentities=128),'literal diagnostic caps')
  need(p['runtimeEnvironment']['DOTNET_EnableDiagnostics']=='0' and p['diagnosticConfigRootSourceDecision']=='Root approved SOURCE profile only; runtime diagnostic admission must bind this exact environment','explicit preparation-independent runtime configuration')
  need(p['runtimeObjects']==dict(directory=ROOT+'/engine/run',socket=ROOT+'/engine/run/highbar-0.sock',role='engine',aiId=0,mode=448)and p['engineRuntimeEnvironment']=={'XDG_RUNTIME_DIR':ROOT+'/engine/run'},'literal reviewed runtime object/environment')