Approved execution

Implementation parent: Radio b933829cbe273d2f31fe75ca83125f3ddd8917a2. The immutable PLAN input is 8ae88f7dd21b5cc00228737e3cfb2abbb1e471810e5b524fd2f700cc7e45868f. Fresh Opus PLAN approved without blockers at 2026-10-12T23:47:49.084499Z; raw 897db280cd467938456149faa9b17c471198b694bfd29e4fed9be49bd2deed40. Exact review, invocation, completion and launcher are under the separate execution audit's plan-review directory. Frozen research and PLAN inputs remain unchanged.

Advice disposition: keep the approved opaque Parent event and Range-returning request; retransmission coordinates and a Copy view are unnecessary scope. Add explicit geometry-only admission rustdoc and one Display/core::error::Error oracle. VerifiedProof privately retains proof/root/size/block/request; successful validation establishes the fixed eight-byte replay header. Build and retain allocation fixtures outside the observer and exclude their later deallocation.

Correct advice 5's conflation using literal arithmetic: the log-0 full-range deep prefix is 8 + 52*64 + 4096 = 7432 bytes. Actions H + 52P + S + K = 55 succeed; action 56 attempts the next leaf setup, returning Truncated { offset:7432, needed:4096 }. Separately, u64::MAX/log51 first-group geometry on 64-bit has a 2^63-byte first group. Header plus one valid synthetic pair occupies 72 bytes; action 3 (H P S) fails Truncated { offset:72, needed:2^63 }. Neither fixture is a witnessed complete file. No large allocation or full-file enumeration is needed.

Files remain the approved three production paths plus focused integration tests and their support. Tests/fixtures freeze precedes the parent API-absence run, which must fail specifically at the unresolved new proof module. That compile absence is distinct from earlier real legacy carrier observations. Four tests/support files and 17 generated fixtures were frozen before production; parent compilation failed with E0432 for the absent module, and its matched traversal control passed 8 tests. The three production files now implement the approved machine and output view. Focused debug passed all 17 new tests. Allocation observation covers successful stages, output, terminal polls and cancellation, plus EOF and constructor geometry failures; it does not claim every error branch was observed.

The first Clippy invocation mixed Rustup rustc and Homebrew clippy-driver, producing E0514; retained as an invocation failure, not a source verdict. Matched Rustup 1.95 all-features Clippy reaches 11 legacy io/tree lints. No-default Clippy additionally found three drop_non_drop diagnostics in the new test. The tests-only correction uses lexical scopes instead of explicit drop; literal assertions remain unchanged. The original tests-first snapshot and all negative receipts remain immutable.

Final source freeze: audit/2026-10-12-bao-bounded-proof/source-final.json binds all seven Rust source/test files. The configured formatter added only one import separator and moved the std import ahead of the external crate import. The invalid range test has a local reversed_empty_ranges allowance, preserving its literal negative oracle. Final owner tests pass default 118, all-features 121 and no-default 45 in each debug/release mode; each Cargo run also checks its zero doctest cases. No-default all-target Clippy and scoped configured rustfmt pass. The final gate runner hashes all live Rust/TOML/lock/workflow inputs before and after each command.

Seven external negative compiler probes match their specific expected error classes, with a successful runtime control. Constructor/field/conversion/DeserializeOwned, proof drop/mutation and leaf mutation failures remain distinct. Host allocation is observed, not a final-link promise: the isolated thumb library compiles, while its binary and a current-parent pure ChunkNum control both fail for the existing Hemera allocator requirement. The owner no-default library passes Rust 1.89; this measured row does not establish the entire workspace MSRV.

source-ready.json is the final module-order bridge: move only pub mod proof; after the cfg-gated io declaration. The existing parent re-export formatting issue is intentionally unchanged. Earlier owner and workspace receipts retain their own source epochs; the bridge changes no cfg, public API, implementation or fixture. The first lib-only formatter check detected both the new placement and the inherited re-export difference; new module placement alone is corrected.

Workspace cache correction: the initial runner reused one target across parent and candidate. After the parent build, the candidate default test compiler observed a cyber-bao artifact without the new module (E0432). This contradicts the unchanged source and successful isolated owner witnesses, so that result is classified as a build-cache isolation failure, not a runtime source regression. The driver was paused while its parent command completed, then retired before another candidate started. That non-isolated parent run reported 563 run / 558 passed / 5 mDNS failures / 9 skipped; it is retained but not the accepted clean comparator. The completed mixed cache was removed after checking no compiler or test still used it. Fresh candidate and parent targets are disjoint for all later comparisons.

The earlier manual default count of 117 was an addition error: raw aggregate is 118 = prior 101 + 17 new tests. Final report counts are derived from raw results. The separate Deserialize<'static> probe strengthens DeserializeOwned's narrower compiler witness; source inspection also checks that no Deserialize implementation or raw-result constructor exists. Original seven probe receipts remain immutable.

The final broad candidate runs finished on source-ready: default and no-default workspace runs each reported 580 run / 575 passed / 5 mDNS failures / 9 skipped. Their parent comparison selects only those exact five cases with the same profile, features, environment and explicit timeout configuration. All-features build fails at the same gossip E0599 on both current inputs. Workspace Rust 1.89 and 51 doctests pass. Nightly docs retains its effective docsrs-only RUSTDOCFLAGS, actual warnings and matched rustdoc search-index failure; no unproven cache-cause claim is made.

Root's independent four-leaf fixture adds the missing parent-after-payload frontier case. Frozen original bytes and assembly source are in interleaved-oracle. A first cleanup guard matched its invoking shell text and refused; chained preparation continued without appending the test, so the complete-* receipts actually reran the original 17 tests. Those receipts and the old source-complete attempt are kept honestly. The corrected guard excludes its own process and invoking shell; a new source-complete freeze and final-interleaved-* gates will identify the real added 18th test. Production sources remain byte-identical.

Final source-complete contains exactly one tests-only change from source-ready: the independent interleaved four-leaf carrier. All four narrow debug/release and default/no-default runs pass 18 tests, with no-default all-target Clippy and scoped formatting green. Exact b933 semver comparisons pass both feature modes with (no change; assume minor); the public addition still requires minor acceptance. Both tag-v0.1.0 comparisons fail on the same absent archived relative hemera/rs path. No tag compatibility floor is established. All isolated broad gates and narrow runtime counterparts are complete; no further implementation edits planned.