diag(track-a): probe canonical P0 admission state

[blakinio]

Track A RUNTIME — fresh P0 canonical admission inventory

Task: OTC-20260816-track-a-canonical-runtime-e2e
Consumer: P0 Draft #302 (branch untouched)
Base: exact trusted main@1eb4a8edecba3966aa1e6155e241b404eb4d30cb.

This PR begins the fresh post-#461 P0 RUNTIME admission. It does not observe or mutate the Tibia client. The one-shot Synology workflow only reads existing canonical controller metadata under a nonblocking shared flock on the already-existing coordination.lock.

Corrected fail-closed discovery admission:

• execution_class: synology_physical_runtime
• runtime_access: canonical_bootstrap for transition discovery only
• runtime_owner_task: OTC-20260816-track-a-canonical-runtime-e2e
• runtime_namespace: canonical-live-runtime
• canonical_registration: UNKNOWN
• Gate A: REQUIRED_NOT_PROVEN
• generation rebind / ordinary Gate B: NOT_APPLICABLE
• bootstrap: REQUIRED_NOT_PROVEN
• target_uniqueness: UNKNOWN
• mutation_authorized:false
• bootstrap_for_p0_authorized:false; P0 bootstrap attempt limit = 0

The prior head 501c8ae5... was correctly refused by governance before any metadata observation because canonical_reuse_or_mutation cannot be admitted with registration UNKNOWN. Inventory run 32017661050 / job 95350478735 skipped the metadata step.

The corrected class is only the fail-closed pre-transition state that permits determining whether registration exists; it does not authorize bootstrap. The inventory is narrower than client/live observation: no /proc, X11, VNC/RFB, network/session, credentials, login, gameplay, client launch/stop/signal/attach, lease acquire/renew/release, registration write/rebind/bootstrap, or canonical file creation is permitted. Only whitelisted non-secret fields from existing lease.json / runtime-registration.json may be read.

If registration is absent, P0 stops fail-closed rather than bootstrapping a session solely for semantic validation. If registration is present, a separate fresh admission must establish Gate A / any required rebind / Gate B before any client observation or mutation.

[blakinio]

Terminal admission-probe checkpoint; this PR should remain unmerged and release ownership after closeout.

The first head (501c8ae5...) was correctly refused before controller metadata observation because canonical_reuse_or_mutation cannot be admitted with registration UNKNOWN. Run 32017661050 / job 95350478735 skipped its metadata step.

The corrected fail-closed discovery admission passed governance at head 04177dccd56ec54d7d4a57aa037fb7124168d3b4 (32017860971 = SUCCESS). The single legal Synology controller-plane inventory then completed as run 32017860986 / job 95351075477:

• lease record PRESENT, status released, generation 7, controller task/session null;
• authoritative runtime-registration.json ABSENT;
• control metadata unchanged across the shared-flock read;
• no process or X11 observation;
• no client/canonical metadata mutation.

The one-shot workflow was removed on head e86b0d72ed44e5d07e2034670772536255b85bd3, so this branch cannot repeat the Synology inventory through that workflow.

Conclusion: canonical ordinary reuse is unavailable and P0-specific bootstrap remains explicitly unauthorized. semantic_player_xyz = INCONCLUSIVE. Durable consumer handoff was posted to #302 as comment 5314603063.

A separate later-created hosted branch runtime/OTC-20260816-track-a-canonical-runtime-p0-xres-window now claims the same canonical task/owned paths for XRes worker integration. This admission branch must not compete with or take over that branch; close this Draft unmerged to release duplicate ownership. The fresh registration-absence observation remains a time-bounded RUNTIME fact and must be re-admitted if a later legitimate lifecycle creates a registration.