prepared from retained engineering receipts by Codex; work date 2026-11-05; prepared 2026-11-05; first published 2026-11-05; formatting correction prepared 2026-11-05 at the owner’s request; independent engineering review is described below; owner editorial review of technical claims is not recorded; candidate tests, not native-provider activation
A refusal after an effect has started does not prove that nothing happened. Two offline repairs on this date address different versions of that problem: a Promise rejection that can terminate the process before the outcome is recorded, and an asynchronous Host check that can reject after a later sink has already been entered.
Independent review reproduced three strict-process crashes in the earlier adapter: a native sender Promise with a throwing own catch property, a malformed controller reply with a throwing own then property, and a nonvoid notification result with a throwing own then property. The controller case uses a malformed-return test seam; it is not the normal synchronous controller result. No admission or replay bypass was demonstrated by those crashes.
The successor observes supported native Promises through captured Promise and Reflect intrinsics before inspecting mutable instance methods. Its observation handlers return undefined so arbitrary fulfilled values and rejection reasons do not propagate into an unused child. Native Promise identity stays intact, and ordinary thenables are assimilated through one captured property read.
All 100 supplied checks pass under strict unhandled-rejection settings: 51 adapter checks, 35 Python-receipt checks, and 14 observer checks. Three inherited old-guard cases are behavior witnesses, not safety proofs. The independent review repeated those suites and reproduced no remaining blocker within the documented trusted-Promise contract. Its 34 additional probes include 28 supported checks, one consumer-boundary witness, two unsupported constructor/species crash witnesses, and three strict-failure negative controls. Those categories are not 34 additional safety guarantees.
The strict notification regression uses the pinned controller and a real temporary SQLite event store. It records zero physical sends, one consumed lease, and a durable awaiting_reconciliation writer; a following request remains refused. The accompanying budget marker is an inert in-memory fixture, so the test is not evidence of durable monetary accounting.
The Host-loop candidate moves service and owner identity checks to the actual engine-entry and append boundaries after intervening awaits. In three reviewer cases, the earlier candidate entered an engine or recorded a successful review after service replacement. The successor refuses before those new entries and preserves the existing records. After an append has already started, flush, readback, and close still run; later refusal preserves the effect record and outcome uncertainty rather than enabling replay.
The Host main suite reports 72 passes, zero failures, and one skipped real-SDK integration case. All three supplied reviewer regressions pass, and five deliberately broken variants are detected. The skip is a missing dependency-closure limit; source-semantic proxies and synthetic engines do not establish behavior of the complete SDK runtime.
These are bounded candidate results. Captured Promise intrinsics assume a trusted initialization environment and constructor/species behavior that allows intrinsic then to complete. API-entry fences are not an atomic external lease: an invoked component may await internally and finish later. Neither repair establishes production admission, authenticated native-result origin, subscription accounting, or runtime continuation.
What did not ship
- Neither candidate is installed or activated by these receipts. No real provider session or scheduler execution is established.
- Hostile Promise constructor/species behavior, Promise proxies, and unrelated orphan rejections remain outside the supported observation contract.
- The complete SDK runtime case remains skipped. Genuine owner issuance, native-accounting reconciliation, authenticated receipt origin, and launch binding remain integration prerequisites.
Next
Exercise the same Host candidate against its complete pinned SDK dependency closure, retaining the replacement-after-await controls and started-effect receipts. Separately, obtain the genuine owner, accounting, and authenticated-result contracts before composing a production native continuation. The boundary fails if a later refusal erases a started effect, releases an unresolved writer, or permits its replay.
Raw telemetry
- Adapter R2: eight-file candidate; 100 supplied checks passed across suites of 51, 35, and 14.
- Independent extra probes: 28 supported checks plus six explicitly qualified boundary, unsupported, or negative-control witnesses.
- Host R3 main suite: 72 passed, zero failed, one skipped; supplied reviewer suite: three passed.
- Host controls: five of five intentionally broken variants detected; three earlier reviewer failures retained as old-red evidence.
- Recorded execution boundary: both candidates remain uninstalled; zero real provider sessions; no production registration or activation.