[dnlrsls]

Summary

Related to #9. One root-correction source unit: 9 files, 326 additions / 15 deletions = 341 authored changed lines. Exact reviewed head 21b834723d68433a6beabc22d2779d785767f07a, parent 595ba91314207c08f6dbe29c8b514a0110d978f0, tree eae1499f880b9f4fddfc55ca56f6fcf625ec98f6. Target main is c4dce68b9fc867291ba5fe7ca9bbbd6d1242148a, with the same production baseline tree as595.

This is the single producer-to-report correction, not publication of the earlier local 0b364c8c diagnostic patch. That separate branch remains unchanged and unpublished.

Root cause and correction

The shared runner selected one legacy Reason: unverified cleanup could overwrite the primary execution failure before wrappers saw it. CleanupVerified=false also occurred on returns before Start; it did not prove a removal attempt or leaked container. Incrementally formatting the surviving reason could not recover discarded facts.

• Inside the existing runner.Result, retain optional internal facts: Start call requested, closed primary execution cause, and cleanup attempted. Derive cleanup result from the existing verified-absence flag instead of inventing a parallel authority.
• Produce these facts before cleanup wins the legacy rejection reason. Primary retains the existing non-cleanup execution priority; simultaneous execution and cleanup failures remain independently available.
• Forward the same facts through capture and source-change/cleanup/cancellation/expiry priorities into one allowlisted diagnostic projection, not a new error pipeline or post-hoc reconstruction from Reason.
• Keep legacy Reason/Outcome/Exit/Output/JSON, report-v1 fields/IDs, rejection/side-effect ordering, source/authentication/cleanup policy, pins/limits and Environment unchanged. Facts are JSON-excluded internal metadata, never consent or execution authority.
• Nil facts remain unavailable, not no-start. Requested Start does not attest container creation or Node execution. No-start does not fabricate verified cleanup. Unknown causes are UNSPECIFIED; no raw errors, streams, paths or tokens are copied.

The historical runs 39110730772, 39144702523 and 39148391145 remain FAILED/UNVERIFIABLE. Their physical runtime causes cannot be reconstructed from the retained aggregate reports. This fixes diagnostic fact loss, not a demonstrated Docker/Node defect or real sensitivity triad.

Observed local proof

• Test-first RED: four producer cases plus four composed report cases compiled and failed missing-fact assertions; existing decision/reason/call-count assertions held. GREEN: full runner and lintverify packages passed, empty stderr.
• The composed fake actually invokes shared Runner.Execute rather than returning a pre-shaped Result. Cases cover pre-start failure with no Start/Remove, start failure with verified cleanup, simultaneous start/cleanup failure retaining both, and cleanup failure after a successful Start return. Source/cancel/expiry priorities retain facts without promoting evidence. Legacy Result JSON is byte-exact; unknown-code privacy passes.
• Split captured transport has a separate compound-failure producer test. This is not a falsely claimed full split/public-report Cartesian matrix or real Docker/Node execution.
• Parent full Go suite: 28 packages (27 tested, one with no tests), uncached, exit0. Vet exit0; both stderr empty.
• Parent public differential: 34 comparisons, exact stdout/stderr/exit and no normalization. 33 cases cover existing CLI/lint control and shared smoke control; one additional proper smoke execute call with new-fact input and absent GitHub context returns the same exit2/empty stdout/fixed stderr on base and new code, leaving input/counter hashes unchanged. No target files were accessed. Protected inputs, dependencies, manifest, original fixture counter and two doc links passed.
• Independent verifier: PASS S1-S3 (local/fake scope), no blockers. Three separately invoked once-each bounded commands: six affected packages uncached exit0, vet exit0, preservation exit0. All stderr empty. Nine isolated source bytes/index/refs/private notes/dependencies/manifest/fixture counter matched; old0b branch remained unchanged.
• Parent read independent raw receipts and ran one exact reported vet command in the isolated copy: exit0/empty stdout+stderr. Guarded local source-only commit and final preservation exit0; no semantic source changes after the verified copy froze. Full-suite/differential results are parent evidence, not independent reruns.

Native assessment: HIGH via security item2, unassessable because private untracked notes prevent forming a candidate, candidate null, RDD off, outcome unknown. Not native approval. Its required independent verification was fulfilled. Risk: items2and3 (shared runner contract/security-sensitive disclosure).

Actual PR and NEW post-merge main Go CI links are recorded below. They verify owned Go source and contracts, not the real candidate runtime or security.

Scope and delivery

Owner separately authorized this exact source publication/integration only: one341-line PR, normal merge commit, exact reviewed head/tree, source branch retained, then fresh three-host main Go CI. Keep old0b local branch unchanged; no force/rebase/squash/delete, admin bypass, local main reset or private odd//.git/ publication.

Excluded: another protected plan, manual lint dispatch, candidate Node/npm/ESLint/actual launcher/Docker/loader/image/payload download/extraction/preparation, Environment approval/settings, #9 closure, version tag or release. No candidate was executed to implement or publish this unit. Future runtime consent is separate and exact-plan-specific; past approvals apply only to completed attempts. Full-MVP0.1.0 is not claimed ready. No automatic return to a per-message-patch/live-retry loop.

Observed owner integration

Maintainer merged as ba0274cb941a946ecaceea888f6e2d4e0d06f347, exact parents [c4dce68b9fc867291ba5fe7ca9bbbd6d1242148a, 21b834723d68433a6beabc22d2779d785767f07a], exact reviewed tree eae1499f880b9f4fddfc55ca56f6fcf625ec98f6. Source branch fix/lint-failure-facts retained unchanged; old0b local branch remains intact/unpublished. No agent merge/ready command was invoked or replayed.

Source evidence	Event / attempt	Linux	Windows	macOS
Exact source PR CI 39156313307	pull_request /1	SUCCESS	SUCCESS	SUCCESS
NEW post-merge main CI 39156452541	push /1	SUCCESS	SUCCESS	SUCCESS

All six actual Go host jobs passed on their first attempt. PR jobs completed by18:56:06Z; maintainer merge occurred18:56:18Z. The original observer exited1 only at its later OPEN/DRAFT PR-state predicate because the maintainer had already merged; the successful Go jobs were not rerun. That failure was retained; separate read-only owner-merge/tree/parent/source checks and new-main CI established the actual outcome. These source results do not convert earlier failed candidate attempts into passes or authorize a new protected plan, target runtime, #9 closure or release.