fix(track-a): accept XRes returned client resource base

[blakinio]

Track A canonical RUNTIME — hosted XRes client-base helper correction

Task: OTC-20260816-track-a-canonical-runtime-e2e
Base: trusted main@c55e3523e6e9d50df511e65dce9145a8f951a5f5 after physical identity #457 and archive #459.

This is a GitHub-hosted-only follow-up for XRES-V2-AUD-001. It performs no Synology/X11/official-client/canonical-state access and authorizes no physical retry.

The retained v2 physical reply proved that QueryClientIds for resource 0x00c00011 may return owning client resource-base 0x00c00000 with LocalClientPid 13648. The persistent helper incorrectly required the returned client identifier to echo the exact queried resource XID.

Correction:

• keep one-spec exactly one record fail-closed cardinality;
• require a nonzero returned client identifier;
• require exact LocalClientPid mask;
• require exactly one positive CARD32 PID;
• do not require exact resource-XID echo;
• add the retained physical v2 raw reply as a deterministic regression fixture;
• keep all existing malformed/truncated/oversized/wrong-mask/multi-record negatives.

Expected deterministic suite after this change: 37 tests. Dedicated helper validation must remain transport-free. After protected promotion, downstream P0 work still requires its own fresh RUNTIME admission and may proceed only if a legal current IN_GAME lifecycle exists; no session bootstrap solely for P0 is authorized.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.