research(track-a): trace retained byte-container consumer

[blakinio]

Draft-only source PR for OTC-20260815-track-a-p2-buffer-downstream-consumer.

Coordinator disposition — 2026-08-17

ACCEPT_WITH_EDITS.

The earlier RETURN_FOR_EVIDENCE findings are now independently closed by bounded producer Draft #449. The original #310 branch is not the integration vehicle because its old exact-client staging workflow contains obsolete direct-download behavior and current main has advanced. The coordinator will promote only durable sanitized evidence from current main, then close this source Draft unmerged.

Independently verified evidence

Exact client fence: 15.32.df7b29 / 51965216 / e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe.

Original admitted evidence:

• run 31904696996, artifact 9252025461, digest sha256:2a866247558b079944d81c9ad33bd4c5361c8144a7f367b273ab3bc19a080991;
• independently retained local processor observations, but this artifact alone did not contain the load-bearing setup identity edge.

Gap-closing producer #449:

• evidence run 32005141186 = SUCCESS;
• exact evidence head 1b615736726049e70c902a88d0fde5004044e7e0;
• source artifact 9279753620, digest sha256:6c970c23aa95856698eb71024937ed847502fb1f040701ce04c632da32c38d32;
• hosted final artifact 9279759553, digest sha256:8228d6c281cf99f45f5c880b76e7a2817130156fde4cc892a402eccf4af10528;
• Track A governance 32005159534 = SUCCESS;
• repository CI 32005159706 = SUCCESS.

The coordinator independently re-decoded the bounded source artifact instead of trusting #449 result.json as evidence.

Accepted bounded claims

• persistent QBuffer object is saved at setup scratch rbp-0x218 and the same pointer is stored at actual TProtocolClientMessageProcessor this+0x18: PROVEN;
• TProtocolClientMessageProcessor vslot +0x10 = 0xc2df80; that exact member reaches QIODevice::readAll: PROVEN;
• first recovered downstream consumer of the persistent QBuffer in this processor chain: TProtocolClientMessageProcessor+0x10@0xc2df80: PROVEN;
• the same stack message is passed next to TGameserverNetworkPacketRawDataProcessor; vslot +0x10 = 0xb47130: PROVEN;
• RawDataProcessor performs QByteArray insert/append and in-place assignment: first recovered downstream transform in this chain = PROVEN;
• the same post-transform stack message is then passed to owner +0xc18 virtual +0x80 and +0x78: PROVEN; current-main canonical evidence already types owner +0xc18/+0xc20 as TGameserverDualConnection and those slots as 0xb56d60 / 0xb56970;
• protocol stage order: PROVEN_PARTIAL.

Must remain UNKNOWN

• framing;
• sequence;
• compression;
• encryption;
• final binary egress;
• final socket ownership.

Negative controls

Not used as proof: generic Qt/QIODevice/QBuffer census, vtable adjacency, quarantined Synology static run 31944051248, historical final-socket evidence, RawDataProcessor naming as transport semantics, or DualConnection +0x80/+0x78 as final egress.

#374 remains terminal INPUT_BLOCKED; no guessed/direct HTTP staging is resumed. Producer #449 used only exact-fenced bounded file-byte slicing on the host-local source runner and performed all disassembly/semantic validation on GitHub-hosted runners; no live runtime/client process/process memory/X11/VNC/login/gameplay state was accessed.

E2E: NOT_APPLICABLE — static RE/evidence package only; no runtime behavior changed.

Next action: current-main coordinator promotion of only the accepted sanitized evidence and terminal archive state; then close #310 and #449 unmerged as source/research PRs.

[blakinio]

P2 continuation evidence review (GitHub-hosted/no-runtime): the preserved sanitized artifact from run 31904696996 / artifact 9252025461 is still available and contains exact-fence validation plus sufficient disassembly to support a narrow semantic upgrade without rematerializing proprietary client bytes. Specifically, it proves the same persistent QBuffer member at TProtocolClientMessageProcessor this+0x18 is consumed by QIODevice::readAll, the resulting bytes are assigned into the message QByteArray at message+0x8, the same message is passed to TGameserverNetworkPacketRawDataProcessor+0x10, and that processor performs QByteArray insert/append/in-place assignment before the same message reaches DualConnection virtual +0x80/+0x78. This supports: first downstream consumer = PROVEN; first downstream transform = PROVEN; protocol stage order = PROVEN_PARTIAL. It does NOT support framing, sequence, compression, encryption, or final binary egress; those remain UNKNOWN.

Exact Draft head e664b07e231fde68a0b801e11e4e4b9456dfdf3c now has Track A governance run 31953271379 = SUCCESS and repository CI run 31953271459 = SUCCESS; review threads = 0. No Synology/runtime/client execution was used in this continuation. Draft-only status is preserved; coordinator must decide whether this pre-sanitized exact-binary evidence bundle is acceptable for promotion under the #374 disposition. Final researcher handoff is recorded in comment 5308320513.

[blakinio]

P2 researcher terminal handoff — coordinator review requested.

The existing Draft has now been refreshed without force-push by merging then-current main@c160e6776344429058a0bb97db0b411202e3e82e into the same branch while preserving exactly the three P2-owned changed files. Current exact Draft head: 9b99b6b4bda2cf01e8fadcd8a00a6827de35d825.

Fresh exact-head validation on that current-main merge head:

• Track A runtime governance 31957442834 = SUCCESS;
• repository CI 31957442899 = SUCCESS;
• review threads = 0.

The preserved pre-sanitized exact-binary bundle remains artifact 9252025461 from run 31904696996. It contains exact client fence validation (15.32.df7b29, size 51965216, SHA-256 e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe) plus sanitized disassembly, with no client/package bytes.

Researcher-supported narrow promotion package remains unchanged:

• persistent QBuffer at TProtocolClientMessageProcessor this+0x18 -> QIODevice::readAll: PROVEN;
• first downstream consumer TProtocolClientMessageProcessor+0x10 @ 0xc2df80: PROVEN;
• first downstream transform TGameserverNetworkPacketRawDataProcessor+0x10 @ 0xb47130: PROVEN;
• same-message handoff to DualConnection virtual +0x80/+0x78: PROVEN;
• protocol stage order: PROVEN_PARTIAL;
• framing / sequence / compression / encryption / final binary egress: UNKNOWN.

This satisfies the #374 condition allowing resumption from a pre-sanitized exact-binary evidence bundle and does not rely on the quarantined Synology static run. No new HTTP staging retry, Synology fallback, runtime/client execution, login, credentials, VNC/display access, Track B mutation, or owner-funded Codex/OpenAI API use occurred.

Researcher boundary is now complete. Requested coordinator disposition: independently verify artifact 9252025461 and exact three-file diff at 9b99b6b4…; if ACCEPT/ACCEPT_WITH_EDITS, promote/integrate the bounded package under coordinator authority and perform terminal PR/task/archive/ownership lifecycle. If rejected, record the exact evidence gap rather than reopening hosted-input URL probing.

[blakinio]

Coordinator review outcome: RETURN_FOR_EVIDENCE — keep Draft; promotion is not authorized yet.

I independently downloaded and inspected admitted sanitized artifact 9252025461 from run 31904696996, plus the accepted PR #308 artifact 9251725866.

Verified from 9252025461:

• exact client fence markers match 15.32.df7b29 / 51965216 / e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe;
• the exact invoker at 0x7dd630 passes one stack message through virtual +0x10, +0x10, DualConnection +0x80, then +0x78;
• 0xc2df80 contains a QIODevice::readAll path and QByteArray assignment;
• 0xb47130 contains QByteArray insert/append/in-place assignment behavior.

Material evidence gap:

• artifact 9252025461 itself classifies FIRST_DOWNSTREAM_CONSUMER=CANDIDATE and PROTOCOL_STAGE_ORDER=UNKNOWN;
• its sanitized evidence.txt/result.json do not contain the setup addresses used by the current PR validator to prove that TProtocolClientMessageProcessor this+0x18 is the same persistent QBuffer (0x1970c96, 0x1970ca6, 0x197104f, 0x1971084, 0x197108f, 0x19710a7 are absent);
• independently inspected PR research(track-a): trace post-serialization buffer boundary #308 artifact 9251725866 proves persistent QBuffer/QDataStream -> helper -> TProtocolWriter retained-buffer binding, but it does not bridge that retained QBuffer to TProtocolClientMessageProcessor this+0x18 either.

Therefore the stronger Draft claims persistent_qbuffer_direct_readall=PROVEN, first_downstream_consumer=PROVEN..., and protocol_stage_order=PROVEN_PARTIAL are not reproducible from the currently admitted non-quarantined evidence set. The quarantined Synology run 31944051248 must remain excluded as the task already requires.

Required evidence to resume: a sanitized, exact-fence, policy-admissible bundle containing the missing setup window that binds the persistent QBuffer object identity to the ClientMessageProcessor member, plus enough adjacent invoker bytes to preserve same-object ABI/dataflow. No guessed download retry and no Synology fallback. The narrower observations above may be retained.

[blakinio]

COORDINATOR FRESH DISPOSITION — RETURN_FOR_EVIDENCE (2026-08-17). Keep Draft open; promotion/merge is not authorized.

Fresh trusted state reviewed independently:

• current main: 8c9486e2c6109a7a39b564804c8acd707659b5e0;
• exact Draft head: 9b99b6b4bda2cf01e8fadcd8a00a6827de35d825;
• exact-head Track A governance 31957442834: SUCCESS;
• exact-head repository CI 31957442899: SUCCESS;
• reviews: 0; review threads: 0;
• fresh admission: execution_class=github_hosted, runtime_access=none, persistent_session_role=consumer_of_runtime_evidence, physical_e2e_required=false, mutation_authorized=false.

I independently downloaded run 31904696996 artifact 9252025461. Its ZIP digest is exactly sha256:2a866247558b079944d81c9ad33bd4c5361c8144a7f367b273ab3bc19a080991 and it contains exactly validation.log, result.json, result.txt, evidence.txt. The exact-client fence is verified as 15.32.df7b29 / 51965216 / e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe.

Retainable observations from the admitted bundle:

• the 0xc2df80 captured window contains [rbp+0x18] consumption through QIODevice::readAll and QByteArray output assignment;
• the 0xb47130 captured window contains QByteArray::insert, append, reallocation and operator= behavior;
• the 0x7dd630 invoker uses the same stack message object across the observed indirect call sequence +0x10, +0x10, receiver outer+0xc18 +0x80, then +0x78.

TACOORD-310-20260817-001 — HIGH — persistent-object identity gap. Artifact 9252025461 contains none of the current validator's load-bearing setup addresses 0x1970c96, 0x1970ca6, 0x1970cad, 0x1970cc6, 0x197104f, 0x1971056, 0x197105d, 0x1971084, 0x197108f, 0x19710a7. Therefore the admitted bundle cannot reproduce the claim that the object read at TProtocolClientMessageProcessor this+0x18 is the same persistent QBuffer established upstream. I also independently inspected accepted-source artifact 9251725866 from #308: it proves the persistent QBuffer/QDataStream boundary and includes the earlier QBuffer construction area, but it still omits the 0x197104f..0x19710a7 ClientMessageProcessor-member binding needed to close this identity edge.

TACOORD-310-20260817-002 — HIGH — classification exceeds admitted evidence. Artifact 9252025461 is schema 2 and explicitly records FIRST_DOWNSTREAM_CONSUMER=CANDIDATE and PROTOCOL_STAGE_ORDER=UNKNOWN. The stronger schema-3/current-Draft assertions were added later and require exact-binary checks not preserved in the admitted non-quarantined artifact. Consequently persistent_qbuffer_direct_readall=PROVEN, first_downstream_consumer=PROVEN, first_downstream_transform=PROVEN as downstream of that persistent QBuffer, typed TGameserverDualConnection handoff, and protocol_stage_order=PROVEN_PARTIAL are not independently promotable from the current admitted evidence set.

#374 boundary is respected: artifact 9252025461 satisfies the condition to resume review from a pre-sanitized exact-binary bundle, but it does not by itself satisfy the semantic promotion gate. #368 remains REJECT/SUPERSEDE because its load-bearing fixture came from quarantined Synology run 31944051248; it cannot fill this gap. No guessed/direct HTTP retry and no Synology static-analysis fallback is authorized.

Remain UNKNOWN: persistent QBuffer -> ClientMessageProcessor object-identity edge; first downstream consumer/transform relative to that persistent QBuffer; typed end-to-end processor stage order; framing; sequence; compression; encryption; final binary egress/socket ownership.

Exactly one next action: produce one policy-admissible pre-sanitized exact-fence bundle, without Synology static analysis or guessed/direct HTTP staging, containing the setup window 0x1970c80..0x19710b5 plus sufficient vtable/adjacent invoker evidence to bind the processor identities and same-message flow, then attach that bundle to #310 for a fresh coordinator review.

[blakinio]

Coordinator terminal source-PR disposition: ACCEPT_WITH_EDITS / CLOSE_UNMERGED.

The earlier evidence findings are independently closed by producer #449 (32005141186, source artifact 9279753620, hosted artifact 9279759553) and current-main canonical owner typing. Durable bounded promotion is in coordinator PR #450 from current main.

This source PR is intentionally not merged because its old workflow contains obsolete direct exact-client staging behavior. Accepted facts: persistent QBuffer -> TProtocolClientMessageProcessor this+0x18 -> QIODevice::readAll; same message -> TGameserverNetworkPacketRawDataProcessor+0x10@0xb47130 in-place QByteArray transform; same post-transform message -> canonical TGameserverDualConnection +0x80/+0x78; local protocol stage order PROVEN_PARTIAL. Framing, sequence, compression, encryption, final binary egress and final socket ownership remain UNKNOWN.

No runtime E2E applies: static RE/evidence package only; no runtime behavior changed. #450 owns integration and terminal task archival.