Enigma bounded lossless capture encoding, 2026-10-24

Tested candidate only; the rejected batch30000 PNG was never retained. Synthetic success does not establish that the missing Enigma frame fits. No guest, native module, build, box operation, acquisition, deployment or main merge occurred. Coordinator stopped previous boxes before this task; no box is assigned here.

tools/lossless-capture-png.cjs is reusable with an injected installed PNG codec. It accepts bounded non-interlaced RGBA8 canvas PNGs, verifies structure, dimensions, complete bounded inflation and CRC via pngjs, and tries at most two level9 encodes, strategies3 then0. The first candidate within131072 bytes is decoded and checked for exact RGBA bytes and dimensions. It never quantizes, resizes, changes alpha or raises caps. Input<=2097152 bytes and dimensions<=800x600 /480000pixels bound decode memory; at most1920600 raw bytes per inflation. Codec errors propagate immediately. Two encodes are sequential; no unbounded search or concurrent codec jobs.

The pinned real capture source SHA256 6d64a146f2daf8b598dbf13e3c13f890dbc783d8f5286aacba6d343758d22079 is unchanged. The terminal adapter adds an explicit transformLosslessCapture and opt-in ENIGMA_LOSSLESS_CAPTURE=1, together with the existing ENIGMA_TERMINAL_CAPTURE_INSTALL=1 and MAELSTROM_CAPTURE_INSTALL=1. Retain the accepted FTQ/TFQ preload order, ENIGMA_RUNNER_ROOT, ENIGMA_CAPTURE_PATH and fresh absolute ENIGMA_TERMINAL_RECEIPT. Package the encoder beside the terminal adapter. Default behavior and transformSupervisor are unchanged; no copied report fixture is the production implementation. No runner flags or mount argv changed and no runtime mount was executed; conditional filename-mount validation is therefore inapplicable. Trusted Git SSH configuration is retained in task ops/admission.json.

The opt-in transformed actual writer preserves single131072, cumulative393216 and max3frames. It latches every encoding/accounting/write failure and rethrows the identical error before later intercepted writes (including ordinary files). Byte-limit failure retains the existing durable version1 capture-byte-limit receipt, original runner/capture identities, ERR_ASSERTION message and supervisor nonzero exit. Other validation/accounting failures retain their original error and produce an artifactAccepted:false receipt; the unchanged strict supervisor rejects non-byte-limit receipts with a nonzero validation failure. They are not reclassified as successful captures. Disabled/default mode remains the accepted historical behavior.

Synthetic deterministic640x480 tiled RGBA (including varying alpha): old strategy3=1103667 bytes; improved=4156 bytes. Decoded pixels byteequal, repeated encoding byteequal. Pixel SHA256 dc7ff430a2974dcece3a0231731980ff82d1eec3f57d9446c7494944e36ee3ea; improved PNG SHA256 fa31a1a0c83ad7373105cd525373c5d440f7f6da77929ae822f23d9ca281b2ff. Incompressible256x256 rejects the unchanged single cap with the real terminal receipt. Truncated/signature/CRC/trailing/dimension/interlace controls reject. Actual Module._compile installation using the environment opt-in executes the pinned original capture module and real fs.writeFileSync interception: success, incompressible rejection, fourth-frame rejection, malformed and oversized-dimension rejection, identity latch and no later writes all pass. Removing strategy0 from the actual encoder forces the formerly successful fixture to reject, establishing that the fallback is exercised.

Because3*131072=393216, an independent cumulative overrun is unreachable while the single/frame invariants hold. The test injects prior total393216 into the actual transformed writer without changing the threshold; its real cumulative assertion rejects with zero underlying writes and blocks subsequent writes. This is explicitly a state-injection control.

All23 standing pngjs files are verified against the accepted manifest and executed in place at /home/user/wine-assembly/scratch/usage-watch/shadow-man-codec-recovery-oct22/node_modules/pngjs. No install/download/copy. Fixtures are generated in memory and temporary PNGs are deleted; only compressed receipts/hashes remain. Fresh MemAvailable>=805306368, Node heap256, CPU60 and wall60 applied. All tests complete in seconds.

Passing commands, from this checkout (each preceded by ulimit -t 60):

timeout 60s node --max-old-space-size=256 test/test-lossless-capture-png.js
timeout 60s node --max-old-space-size=256 test/test-enigma-terminal-capture-guard.js
timeout 60s python3 -B test/test-enigma-supervisor-exit.py

The unchanged terminal suite covers actual runner catch fragments, rejection identity, seven rejecting mutations, ordinary errors and supervisor receipt validation. The complete supervisor regression executes the actual transformed try/finally through EOF and byte-exact stop function with fake OS/child interfaces; real shell AND propagation, denial receipt, cleanup and reverted-exit mutation all pass. Existing FTQ/TFQ historical acceptance receipts are reused: runner transformation, preload ordering and supervisor source are unchanged. This task does not repeat VFS or guest suites.

Initial development tests identified (and corrected) a texture period outside zlib's sliding window, an over-specific corrupt-PNG error regex, and a mutation hidden by Node's module cache. An initial Git read-tree lacked skip-worktree flags; a broad local diff emitted excess output, then explicit index flags were repaired without extra materialization. These are fixture/bookkeeping corrections, not cap changes. Final test receipts are adjacent compressed JSON. Resource checkpoints and publication/true-blob verification are in /tmp/enigma-lossless-capture-encoding-oct24/ops. Exact donor35a4a4e59fb2c76f9590b456ef7873e14271862a; read-only alternates and explicit NONCONE focused materialization. No original evidence changed. Independent acceptance plus fresh runtime admission is still required before another guest attempt.