Combined local game registration independent review — 2026-10-24

Accepted for production JavaScript/filesystem integration. Reviewed exact Airstrike ccc8e0f9aede60031fdda706e1c5a73cd818c230 and Penguin b5320561b18381ce37e9a4344e3ff4fba4fc829d against main 3f75d7afdfc93819d4874b2cf126ca83e66d5bd2. All reviewed donor files match those Git blobs. Rehashed 13 Airstrike and 62 Penguin external evidence seals. Root tracked files/index/refs and immutable donors were read-only.

Both entries coexist through explicit semantic additions to apps and corpus. All 349 existing apps (including serialized function bodies under the same module resolver) and all 144 existing corpus entries are preserved. No generic loading behavior or public desktop membership is expanded.

Independent acceptance

Genuine retained Airstrike 89 files / 4,072,418 bytes and Penguin 91 files / 1,778,442 bytes pass. Pins equal the exact game subsets of accepted historical 261-file Airstrike and 287-file Penguin recovery inventories, with every genuine file hashed. Penguin recovery JSON SHA-256 is 3e26a3d5e575796eda295b4b418ce2c61e5086a85602866b2821a7d87073e274. No media was downloaded, patched or committed.

The focused ordinary tests execute exact extracted production CLI selector, resolver, preflight and VFS mount loop for registered app selection and canonical matched EXE selection. The browser tests execute the production resolver before init, production DLL resolver, Blob snapshot handoff and actual host.loadFiles method. The source passes dynamicExeBytes to wine.loadExe; EXE hashes, all companion destinations and DLL snapshots match genuine inputs. CLI snapshots survive each subsequent source mutation; actual browser host loading survives a post-validation SDL mutation and revokes every temporary Blob URL.

Both routes reject outside-fixture/external URLs, alternate guest destinations, duplicates, omissions, extra/optional/transformed rows, sizes, registry mutation, each missing and same-size-changed EXE/DLL/asset, changed inventory bytes and a wrong inventory digest before any destination writes. Generic overrides, installer registry metadata and CD track sizes remain supported without opt-in pins. Arbitrary external unregistered EXE paths retain their explicit-input contract; filenames do not infer registry identity.

The original independent reproduce-manifest-gap.js was copied unchanged and executed against five exact rejected fdd1e48 source blobs. Exit 0 with both ordinaryLoaderAccepted true establishes gap-present REJECT, never candidate PASS. Both acceptance conditions are false on the candidate in both ordinary tests. No producer summary substitutes for this control.

The added Penguin independent test adapts the Airstrike ordinary harness only for app/verifier/input/count identities and the accepted inventory's target field (Airstrike uses dest). Both harnesses additionally inject changed trusted inventory bytes and assert the real EXE handoff. Initial sparse missing-dependency and harness field/comparison mismatches were corrected without changing the oracle. Failed iteration logs are retained, including initial app comparisons whose separate module locations and function identity were inappropriate; the final comparison uses the same resolver and exact serialized function source.

Passing checks: both ordinary-route tests, both genuine local-registration preparation tests, unchanged Silver CLI (8), browser corpus (645 paths), local dropdown, all existing apps, and syntax for changed production files. Every Node check used old-space 256 MiB, fresh MemAvailable >=805306368 and CPU/wall <=60s. No build, Wasm instantiation, guest or real browser process ran. This acceptance makes no pixel/audio/current-VM/full-game or historical gameplay rerun claim.

Evidence and recovery

External receipts are retained in /tmp/local-game-manifest-independent-integrate-oct24/: admission.json, source-binding.json, seal-verification.json, excerpt-identities.json, each check's command/memory/exit JSON and log, unchanged control script and rejected source snapshot, resource-final.json, publication.json and cleanup.json. The adjacent review directory retains a portable focused receipt and all source extraction boundaries/byte counts/hashes. Rerun from this checkout:

python3 /tmp/local-game-manifest-independent-integrate-oct24/check.py

This requires the exact retained source locations named by the checker, fresh resource admission, and no existing task test-temp directories. The independent Penguin test also accepts ORIGINAL CRT directly; the Airstrike test accepts ORIGINAL ZLIB CRT. Neither downloads or executes a game.

Task allocation is <=64 MiB including checkout/Git/temp/transport, full launcher and session history with positive SQLite growth/future allowance, cumulative capture charge and an 8 MiB reserve inside the allocation. Installed Node and immutable donors are separately measured standing inputs. No payload staging is retained after tests. Private checkout/evidence remain for recovery; watcher is terminated and integration lock released on completion. No public hosting or deployment. Box ID/state/expiry N/A; no box action, lifecycle coordinator-owned.