[erikleblansch]

Summary

• Recover complementary chunks through bounded rediscovery and single-use pressure-retirement continuations. Preserve original deadlines, resource admission, selected routes and privacy boundaries.
• Add closed, opt-in budget/continuation diagnostics and protected browser/Weather delivery harnesses.
• Correct the cancellation fixture's thirty-second bootstrap prerequisite without changing its eight/four/two-second acceptance gates.
• Retain bounded Weather HTTP 429 diagnostics without extra requests, body access or automatic retries.

Current candidate and verified baseline

9441b451 fixes the newly diagnosed route-loss propagation: a correlated helper rejection (Kernel, Capacity, Unavailable) releases only the unissued request's reservation, retaining existing sibling flows. Lost/cancelled/corrupt handoffs and ambiguous cleanup still retire the route. The existing bounded attempt count, deadlines, selected relay route and genuine MPTCP requirement are unchanged. Eleven focused Rust tests, formatting and independent review pass; dependencies and lockfile are unchanged.

Protected standalone provider run 38204038877 passes on exact 9441b4514ae0c66c6353158fdeb45579773c32fa. Independent schema-three validation and a complete raw-evidence rebuild agree with the aggregate, SHA-256 0d8cbd696240dd7d12f73545c4ef305b5b73e6a845620388a88bad3819d449a3. Named fetch reconstructs nine chunks / 2,097,275 bytes from two providers. Native/HTTPS each reconstruct sixty chunks / 15,728,640 bytes from three providers, with 5.139/4.655-second bulk overlap. Late recovery completes in 11.096 seconds with gate release at 4.975 seconds; cancellation and zero-owned-object cleanup pass. Guest-root network state is unchanged. This run makes no weather requests and contains no pressure fixture; worker allowance stays twelve, peak three, with no pressure or continuation events. CodeQL and Quality run 38204014574 both pass for this exact revision. The separate pressure-proof branch feature/content-pressure-acceptance retains failed run 38205593860 on 52a3a787. It completes the actual sixty-chunk transfer and observes CPU-only allowance contraction from ten to one plus two useful serial continuations (31 chunks / 8,126,464 bytes), but its evidence checker incorrectly requires generic discovery when the phase uses authenticated targeted refresh. Cleanup succeeds with zero owned objects and equal guest-root network state; late recovery and cancellation are not reached. The failed aggregate remains failed, SHA-256 c1bacb39e85b50e2fd2093e4aff00cd8f87e8b3b3561cdf3e92f0c1c383848ef.

Fixture-only correction 0f391c77a2b9ee72ec2df26cb398a03041ed314b distinguishes generic queries from targeted lookup starts/finishes and verified nonempty client responses. A lookup finish alone is insufficient; all pressure, continuation, three-provider, privacy, route and cleanup gates remain. The component is now schema two, within aggregate schema four; the old raw result is not upgraded. 117 focused checks, ten existing inert cancellation checks and independent review pass.

Protected full-sequence trial 38207713645 passes on that exact revision. Independent raw reconstruction matches the complete schema-four aggregate and schema-two pressure component, with aggregate SHA-256 d25eb8460f7edc8f428c9d438db805b254f334608aa9842edc7f8b878c420872. Real CPU-only pressure reduces allowance from twelve to one after three peak leases. Two serial continuations return thirty verified chunks / 7,864,320 bytes; the whole sixty-chunk / 15,728,640-byte object completes through three providers without origin fallback. Targeted refresh records three starts, finishes and verified nonempty replies; generic DHT queries remain zero. Healthy native/HTTPS transfer, late recovery (5.371-second gate, 12.887-second fetch), cancellation (116 ms independent cache delivery, 10 ms EOF), privacy and zero-owned-object cleanup pass. Guest-root network state is unchanged. This proves useful continuation under measured pressure, not pressure subsiding or improved owner-task performance.

The pressure fixture and its evidence are now included in this PR. Head c48fba8c adds only the status ledger to the tested 0f391c77; hosted Quality 38209378939 and all CodeQL checks pass for this exact head. No Weather inputs or source requests were part of the protected trial.

0e23140b adds a separate signed-service readiness prerequisite using the existing typed discovery API: at most two requests in thirty seconds, no desired provider/address injection, B off, unchanged route and cold content cache. All preparation events remain separate from the unchanged six-second measured gate and 300-second fetch.

Two Rust socket tests, seventeen late-provider tests, nineteen aggregate tests and ten existing inert cancellation checks pass. Independent review confirms cleanup and explicit historical/current evidence versions. Continuation diagnostics in 1fb13275 pass twelve focused Rust tests and sixteen extractor tests; returned progress is not a claim that failed/cancelled receives wrote nothing.

Protected run 38199501353 passes on exact source 0e23140b903c58b5abf80502923d40f705b773c0. Local current-schema validation independently passes; aggregate SHA-256 86466078298fcab6b6ae951fbd369b8ce0b28a2bda566cf238aa69a0deebd4a6.

• Genuine readiness: one signed A offer through relay0 in 3.015 seconds, B off, route unchanged and content cache cold.
• Measured late recovery: first A snapshot after 5.163 seconds, B activation in 61 ms, gate release after 5.246 seconds within the unchanged six-second bound; exact nine-chunk / 2,097,275-byte fetch through two useful providers in 12.976 seconds.
• Requester cancellation: actual thirty-second bootstrap cooldown, two busy probes, confirmed SIGTERM, independent cache-only delivery in 165 ms and control EOF in 5 ms.
• Native/HTTPS adaptive phases each reconstruct sixty chunks / 15,728,640 bytes through three providers with 4.913/4.479-second triple overlap. Budgets remain twelve, with no pressure flags and no continuation events. This does not prove pressure-retirement recovery.
• All owned objects removed; guest-root network-state hashes identical.

9b132f6c only adds the omitted exact version pin for the readiness dev path dependency and records fresh UI evidence; runtime source and Cargo.lock are unchanged. The prior Quality run stopped at that wildcard-dependency gate. The pin matches existing conventions and locked offline metadata; compatible hosted Quality run 38200580494 and CodeQL now pass for that revision. The local cargo-deny 0.18.3 cannot parse the existing license configuration and was not used to waive this check.

Documentation-only 726fe694 passes hosted Quality and CodeQL. Those results are not carried forward as proof for the later runtime correction.

Joined trial stopped before Weather

The later local joined VM on 9b132f6c, using immutable Overmorrow bundle profile 3, fails at content-provider-named-fetch before any Weather acquisition or rendering. Its aggregate reports CONTENT_NAME_FETCH_FAILED; SHA-256 a2c9379b12f96623c95e527b57ffb4e6873337a0f35420be0e60ef2c1ca8c5e7. Both providers register and metadata verification reaches body retrieval. One body MPTCP socket is ready; the second receives a definite helper Kernel rejection. The client incorrectly converts that rejection to AcquireUnconfirmed and destroys the shared route, disrupting the sibling flow. The original kernel syscall/errno is not retained; it is not attributed to port collision, expiry or load.

The narrow route-preservation correction is now published as 9441b451 with focused passing regressions, as described above. The original failed run remains failed; the new protected run is attributed separately. Cleanup completes with zero owned objects; the VM, scratch and forwarded port are removed. Readable development-host network hashes match; firewall access was unavailable and is explicitly not verified equal. No new weather-source request occurred.

A subsequent joined attempt on the proven 9441b451, with the unchanged verified bundle, is aborted with exit 143 during the guest build because of development-host memory pressure. It reaches neither topology execution nor Weather acquisition and is not automatically restarted. The owned VM, runner, SSH supervisor, scratch and forwarded port are removed; base image and source are unchanged. DNS, routes, rules, addresses, forwarding, namespace names and WireGuard names match. Full host-network equality is not proven: firewall comparison is unavailable and the link hash differs; dynamic bridge timers are present, but the original raw values were not retained to establish the cause. The next preparation step is a reproducible hosted input recipe, not publication of the private bundle.

Retained live evidence

• Run 38195177153 on c63ddf36 fails overall at the late-provider first snapshot. Its first query through the newly selected broker is genuinely empty after 1.151 seconds, with two dial failures; a later offer cannot satisfy that first-one-offer condition.
• Independent reconstruction passes native/HTTPS delivery of 15,728,640 bytes in sixty chunks from three useful providers, with 4.023/4.489-second triple overlap. HTTPS has one authenticated HEAD and no origin body/range requests. Worker allowance is eleven, with no pressure flags.
• B is not activated and cancellation is not reached. Fetch/gate cleanup and identical guest-root state are retained. Quality and CodeQL pass for c63ddf3, not automatically for this new revision.
• Earlier run 38190664934 independently proves actual late recovery of 2,097,275 bytes in nine chunks through two providers; its aggregate fails at the prior cancellation bootstrap condition.
• Overmorrow's corrected verifier now passes an actual isolated browser trial with synthetic products, before/after pointer refresh. Weather PR12 is merged at d3d9c18 with passing component and CodeQL checks and retains exact typed-table proof; it does not establish joined core delivery or separate product DOM containers.

Remaining gates

• Protected sequence through late recovery, cancellation and shutdown on 0e23140; the later pin/docs-only difference is explicit above.
• Actual protected pressure-retirement continuation in the complete independently rebuilt sequence on 0f391c77.
• Joined real-source Weather delivery through the core into Drizz.li/Overmorrow, using the newly validated immutable Overmorrow bundle (manifest 0a9f81a54eb594af9884aebcdf79c03d8efb767447973f7ad40acb92844bf645) with the corrected verifier and fresh full Browser09 proof.
• Native mobile execution.
• Passing hosted Quality and CodeQL for exact 9441b451 (earlier baseline).
• Passing hosted Quality and CodeQL for updated head c48fba8c.

Ready to integrate the independently reviewed provider/cache milestone. Joined Weather/browser delivery, hosted decoder admission and native mobile execution remain follow-up work; no full alpha/C02 or arbitrary HTTPS cache claim. The ledger's instruction to join the pressure fixture to this PR has now been completed. See docs/IMPLEMENTATION_STATUS.md; existing dependency advisories remain tracked, not suppressed.

[erikleblansch]

Dependency triage (read-only; no alert suppression):

• Open alerts test(netns): verify anonymous namespace mappings #9/test(netns): prove fixed PID1 signal supervision #12 and test(netns): prove exact namespace PID one #10/test(netns): prove pre-GO bootstrap readiness #13 are two hickory-resolver advisories duplicated across Cargo.lock and fuzz/Cargo.lock. Both main (3175a4bf) and this PR currently use registry 0.25.2 through libp2p-dns; this PR does not change those dependencies.
• Upstream fixes are in 0.26.2: DNSSEC failure handling and CNAME query amplification. Existing hickory-proto backports address different advisories.

Track a compatible resolver backport or coordinated dependency/toolchain upgrade before a publicly exposed release. The current libp2p requirement and Rust 1.85 pin prevent treating this as a simple lockfile bump. No exploit was run, and these findings do not replace the pending real cache-recovery and joined-client proofs.

[erikleblansch]

Follow-up dependency reachability check at ebf0d07 (no dependency or alert-policy changes):

• The hosted dependency/license audit has passed, and strict workspace Clippy is now green. These results do not resolve the existing Hickory advisories.
• The two upstream CNAME repairs change the recursive resolver: answer-section restriction and matching-chain traversal. In 0.25.2 that implementation is in the separate hickory-recursor crate, which is absent from this lockfile. The actual libp2p DNS path uses the forwarding resolver; its caching client already walks the answer section with a matching current-chain name. This narrows demonstrated reachability of those specific fixes; it does not prove general safety or turn 0.25.2 into a patched version.
• DNSSEC failure handling remains a separate advisory. The currently selected forwarding configuration does not enable DNSSEC validation, but this is not a dependency repair.
• No released compatible 0.25 repair was found. Keep the resolver backport/coordinated upgrade tracked separately, with upstream regression evidence; do not suppress alerts or silently raise the toolchain during cache integration.

No real exploit was executed. The exact-head protected-network trial remains in progress: https://github.com/VOLPAROSSA/volparossa/actions/runs/38190664934 .