Independent canonical select-hook acceptance

ACCEPT unchanged candidate 9e09d9c7660948d00f022171b1edf36e2d2ef656, tree d877bcc4ff0d95bd004ec88c667e0a2523455fb2, based on 01c4a60d50afe394a0afc9fda1267e6a508e7821. This review authorizes conditional integration of the controlled qualification. No hook implementation changed.

The four added drivers, report and retained evidence were reviewed semantically. All 67 changed committed blobs match coordinator seals. All 140 canonical source/compiler manifest inputs and 17 dispatch pins match standing readonly inputs. The build uses production main.watx closure, overlays both transformed sources under all three aliases, strict production compiler options, unchanged compat trampoline and full span-inclusive layout stamping. Both sealed modules match their retained originals. No compiler or native execution was repeated.

Binary-only parsing passes complete imports/exports/types, memory and noStart: 291 imports, 2245 function exports and all 269 storage/span declarations derive 9a3bc9149d58209c. Both binaries preserve original memory/data and original globals, adding exactly 18 private mutable zero i32 globals. The independent check also examines trailing globals.

The retained native driver uses real production thunk/CALL/JMP dispatch and select with a controlled native socket/EOF fixture, WSA inactive, and explicit fixture/scheduler setters. Host select is not mocked. One instance and 20 run calls produce two parks (tokens1,2) and positive completion (token3/result1), after the actual EAX store; stale EAX is 0x5a170123. Pending-yield controls preserve API/host/register/diagnostic state. First completion freezes through later calls. Actual fixture byte intervals, counter starting values, exact normalized OFF/ON states/hostcalls/cache, terminal argv/driver seals and raw terminal result are checked independently.

Checks pass: six ABI controls, four source-order controls, two evidence controls, 16 model groups and 15 independent rejecting cases. Independent cases cover wrong module/input identity, forbidden start section, fixture overlap, one-sided EAX/fdset/counter/hostcall/cache corruption and forged/stale/wrong-source/wrong-owner/mutated/reused captures. Capture replay uses explicitly synthetic exports; source/JSON mutations are not native mutant runs. See candidate review and independent controls.

The first review model-test invocation omitted its required source-root argument and failed assert(root); the corrected command passed, with both captures retained. Producer guard identity was recorded after compiler dispatch, although the unchanged guard was preloaded in the recorded argv. The initial watcher lacked a regular-file guard and was corrected/reaped. Earlier compat-baseline and parenthesis checker errors remain retained; these qualifications are not converted into platform compliance.

Acceptance covers controlled qualification only. Zero-result diagnostic capture, same-frame retry completion, actual handler exceptions, compat instantiation, unobserved intra-invocation properties, overhead and original-game behavior remain unqualified. Later behavioral zeros occur after first-completion freeze. Original-game runtime remains a separate coordinator-assigned gate.

Owned recovery/evidence: /tmp/maelstrom-select-hook-native-independent-integrate-oct24/ops, including immutable bindings, bounded supervisors, resource accounting, candidate review and external merged-tested/publication receipts. The 64MiB cap includes owned files, external launcher/session, full WAL, positive SQLite growth, publication and future growth plus 8MiB reserve; standing readonly tools/inputs are reused in place. No box was touched: bx_69aem736 state/expiry unqueried, lifecycle/shutdown coordinator-owned. Root tracked/index/refs and donors readonly; append-only messageboard. STOP after verified publication.