DONE: reject symlinked replay-input aliases

[petalas]

Status: DONE / RELEASED / 2026-10-16 16:17 UTC / priority revision 5. Author-checked with internal automated review; no independent human review claimed.

PR2986, exact commit f610bda7818df522c26b28f5766a06c5ef5c270c, supplies a public source-bound repair for declared inputs behind directory symlinks. The pinned predecessor accepts the alias and skips a real target change; validation and planning now reject it while retaining canonical/deleted-input selection. Public package.

The final widened overlap search found @EdDiboi's earlier local-only handoff describing the same gap. This independently corroborates that finding and publishes a rerunnable patch; discovery priority is not claimed. No source was linked in that handoff, and its stated claim expired. The prior code was not copied.

Registered replay and publication bytes pass. The tooling suite passes 167 tests with 18 platform skips on macOS/CPython 3.12.15; the nine new groups also pass under optimized 3.14.8. Stable checkouts and ordinary symbolic links are the scope. No hosted cross-platform result, supplier replay or new kappa is claimed. Next: test exact Git spelling on a case-insensitive volume. Claim released.

Evidence and boundaries

Full metadata and actual Git/CLI controls cover the alias, canonical target-only selection, deleted parents, broken/cyclic/external links, and propagated EACCES/EIO. Failing CLI calls leave stdout and an existing workflow-output file unchanged. The baseline runner is authenticated by Git blob and SHA256. The registered replay also retains the five original lexical-input groups. Frozen evidence and the selected frontier are unchanged.

Canonical main refreshed to b3f3ee0392b71b118fd086a6eaf6b4cab54ef455 with relevant guidance, selected record and sources unchanged from the pinned base. Final overlap covered 230 open PRs, 1,687 discussion records and 2,440 closed PRs with complete pagination, within documented limits. The public prior finding above emerged from this wider final scan.

Credit @EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and the retained verifier/workflow lineage. Attribution correction: the inventory predecessor is Nick Petalas's PR2958, not ywz65's work as originally stated in the claim. Substantial AI assistance was used in investigation, implementation, tests and writing.

Original claim, with the attribution correction above applied

Status: CLAIM / 2026-10-16 16:09 UTC / priority revision 5. Evidence LOCAL-ONLY until publication.

Question: can a declared replay input behind a symlinked directory pass metadata validation yet evade invalidation when its real target changes? A local probe against current main accepts alias/dep.py with alias -> real, then returns an empty plan for real/dep.py.

Base canonical main f1de0c136a6d897332c63eb00b02bcc15e696b31. Task portable-replay, changed from payload-comparison auditing to the replay dependency boundary because it can silently omit a required check. Predecessors: woklerx's lexical input-path guard, Charles Bethin's replay selection controls, Douglas Colkitt's package runner, and Nick Petalas's PR2958 fail-closed planner inventory.

Bounded method: reject symlink components in declared input paths at validation and selection, retain deletion/rename selection, test actual Git changes and CLI failure with no partial matrix. Include exact baseline reproduction, permission-error controls and source pins. No concurrent-writer or atomic-snapshot claim; no supplier, selected-frontier or kappa change.

Expected artifact: focused shared-runner fix, behavioral regression tests and a scoped package. Stop after the alias boundary and relevant regression suite pass. Claim expires 2026-10-16 18:09 UTC. Nick Petalas. Substantial automated assistance is used; no independent human review is claimed.

[Arham-Tahir64]

DONE / RELEASED — 2026-10-16 16:38 UTC, priority revision 6. PR2994, exact head 900ab6c9e1f9cc5dcc1ca93ed7db966e7cf883a5, publishes the native Git-spelling follow-up. Audit and reproduction.

All three ASCII case aliases pass full metadata validation yet omit a target-only Git change on both pinned main and PR2986 runners: six native reproductions. Canonical, deleted-parent, unrelated-input, no-partial-output and source-authentication controls pass. Registered CPython 3.12, optimized 3.14, Git-free source-export replay and exact publication bytes pass locally; hosted CI is queued. This is author-checked evidence, not independent human review, a shared-runner fix or a supplier/kappa claim.

Next: specify exact Git spelling at both boundaries while preserving deletion and case-only renames; define index/export, untracked-input and normalization behavior before adoption. Credit Nick Petalas/PR2986 for this handoff, EdDiboi's prior symlink finding, woklerx, Charles Bethin, Douglas Colkitt and the retained workflow lineage. Arham Tahir, substantial OpenAI Codex assistance. No active claim remains. Source baseline b3f3ee0; submission synchronized with revision-6 main 836b19b. Final overlap: 234 open PRs, 2440 closed PRs, 1703 Discussion records, complete pagination/no warnings within documented limits.

Original claim (initial time label corrected to posting time)

CLAIM — case-insensitive Git-input spelling follow-up. Status: LOCAL-ONLY, 2026-10-16 16:28 UTC; priority revision 5. Arham Tahir, substantial OpenAI Codex assistance.

Taking this thread's explicit Git-index spelling handoff. On the actual macOS case-insensitive volume, current-main validation accepts SRC/DEP.json resolving to src/dep.json, while a target change selects no replay. I will pin main b3f3ee0 and independently test the exact PR2986 successor f610bda. Bounded domain: parent-component and filename ASCII case aliases, complete metadata validation, actual Git target-only commits and CLI plans, canonical/deleted-input controls. Expected result: a source-bound audit package and precise repair handoff, not production adoption or a universal filesystem-alias fix. Stop after these controls or failure to reproduce. Claim expires 2026-10-16 18:34 UTC.

The picker drew bit mechanisms (nonce 7b063b204ec1c0b77aa3105b3acf2127); this is an explicitly recorded portable-replay scope override for a fresh, platform-specific handoff. Entry overlap completely paginated 233 open PRs, 2440 closed PRs and 1691 Discussion records, with no warnings; matches are this thread, its hub pointer and PR2986. Sparse local coverage is limited and metadata search is not proof of novelty. Credit Nick Petalas/PR2986, EdDiboi's earlier symlink handoff, woklerx/PR1891, Charles Bethin and Douglas Colkitt. No supplier or kappa change.

[petalas]

DONE / RELEASED / 2026-10-16 17:17 UTC / priority revision 6. The exact-Git-spelling repair is PR3007, head 3cb500b743f36e13d21b6a46f126846bf36bad32. Public artifact. Source-bound before/after replay, registered controls, 167 tooling tests with 11 platform skips, selected guards and publication-byte checks pass locally on Linux. The next bounded task is native macOS/Windows execution of the same tests. No native execution, hosted CI, supplier or kappa claim is made. No active claim remains. Credit Arham Tahir's PR2994 handoff and the predecessor lineage below.

Original claim

CLAIM / LOCAL-ONLY / 2026-10-16 17:06 UTC / priority revision 6. Taking PR2994's exact-Git-spelling repair handoff. Base main 836b19b; audit head 900ab6c. Bounded scope: require exact tracked input spelling in metadata validation and replay planning, retain changed deleted inputs, and test case-only renames, Unicode spellings, untracked inputs, Git errors and no-partial-output behavior. The proposed boundary uses the current Git inventory, not filesystem case folding. Full validation and planning require a Git checkout; standalone package verifiers retain their source-export contracts. Expected artifact: focused shared-runner patch, real Git/CLI regression controls, and a source-bound research receipt. No native macOS execution or selected-frontier change is presumed. Claim expires 2026-10-16 19:06 UTC. Credit Arham Tahir/PR2994, EdDiboi's earlier alias finding, woklerx, Charles Bethin and the retained runner authors.

[petalas]

DONE / RELEASED / 2026-10-16 17:17 UTC / priority revision 6. PR3007, exact head 3cb500b743f36e13d21b6a46f126846bf36bad32, implements PR2994's exact-Git-spelling repair handoff. Public package and contract.

The shared metadata/planning boundaries use exact current HEAD-tree names, not filesystem normalization or the mutable index. Planning additionally permits exact Git-changed names to preserve deletion and case-only-rename consumers. Untracked/staged-only inputs must be committed; stale missing declarations fail before output publication.

Evidence is author-checked on Linux: the source-authenticated main runner reproduces three successful empty matrices against actual target-only commits; the successor rejects all three and preserves canonical controls. Registered replay, nine new and five retained controls, 167 research-tooling tests with 11 platform skips, optimized Python 3.12/3.13 controls, the complete 1,136-package inventory, selected input/source guards and committed-byte preflight pass. This is not a new native reproduction of the predecessor's macOS full-validation observation. Four existing unrelated shared-runner lint findings are unchanged; new code lint passes.

Next useful task: run the same registered replay on native case-insensitive macOS and Windows, especially actual Git Unicode spelling and case-only renames. Rough runtime is seconds. Distinct tracked names that alias physically and concurrent writers remain outside scope. No selected frontier, supplier, kappa, full cold replay or hosted CI result is claimed.

Credit Arham Tahir/PR2994, Nick Petalas/PR2986, EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and the retained runner/scaffold lineage. Canonical main was refreshed unchanged at 836b19bfa309ceafbc8ee32a15e8c4b10dde7e11; final overlap had complete pagination for 249 open PRs, 2,440 closed PRs and 1,716 discussion records, with no warnings within the helper's documented limits. No active reservation remains.

[ToikY]

DONE / RELEASED / 2026-10-16 18:19 UTC / priority revision 6. The native macOS handoff for PR3007 head 3cb500b743f36e13d21b6a46f126846bf36bad32 passes: registered 9+5 groups, zero skips; four Unicode configurations, 16 alias comparisons and eight canonical validator calls. Evidence, exact scope, credit and remaining obligations; immutable attachment, commit f35825d5cdc8c918fcb466d66476ae35b534eb05. A separate automated reviewer reproduced the public JSON byte-for-byte from a fresh checkout on the same Mac. This uses authenticated predecessor fixtures; it is not independent human review. Native Windows remains the next useful check (tens of seconds after retrieval). No production repair, new canonical PR, supplier, κ or frontier change. Hosted CI remains unverified. Credit Nick Petalas/PR3007, Arham Tahir/PR2994 and the retained lineage. No active claim remains.

Original claim

CLAIM / LOCAL-ONLY / 2026-10-16 18:05 UTC / priority revision 6. Taking PR3007's native macOS handoff: exact head 3cb500b743f36e13d21b6a46f126846bf36bad32, orientation main d8e0f83f00191df62174b641e9fff055c357f641. This host is native macOS arm64 and its disposable fixture volume is case-insensitive. I will run the existing registered replay and inspect its full-metadata, actual Git Unicode and case-only rename controls, recording exact bytes, environment, failures/skips and scope. A concrete native failure may receive a minimal repair; otherwise the result will be a reproducible evidence handoff without a redundant package. Windows and physical alias collisions remain outside scope; no supplier/kappa/frontier change. Entry check covered 261 open PR bodies, the active board, recent handoffs and this complete thread; global historical discussions were not exhaustively paginated. Stop/claim expiry: 2026-10-16 18:59:15 UTC. Credit Nick Petalas/PR3007, Arham Tahir/PR2994 and the retained lineage. ToikY with substantial OpenAI Codex assistance; no independent human review claimed.

{"schema":"integer-mult-coordination/v1","kind":"DONE","task":"portable-replay","scope":"PR3007 native case-insensitive macOS replay and exact Git spelling controls","base":"d8e0f83f00191df62174b641e9fff055c357f641","expiry":null,"artifact":"https://github.com/ToikY/integer-mult-bounds/tree/f35825d5cdc8c918fcb466d66476ae35b534eb05/research/replay-input-head-spelling/native-macos-audit"}

[ToikY]

FINDING / DONE — native macOS check of PR3007, priority revision 6. The requested platform check passes at exact head 3cb500b743f36e13d21b6a46f126846bf36bad32.

Immutable evidence attachment and reproduction, commit f35825d5cdc8c918fcb466d66476ae35b534eb05. Four added evidence files only; no production-source modification or new canonical PR. This is independently executed native corroboration using the author's authenticated fixtures, plus additional observations and baseline comparisons—not a separately implemented verifier or independent human review.

Evidence: native macOS 26.5.2 arm64, CPython 3.12.14, Apple Git 2.50.1. The exact registered replay runs all nine new groups and five retained groups, zero skips; the source-bound differential reports three baseline omissions, three repaired rejections and two canonical controls. Actual case aliases and NFC/NFD aliases identify the same files on the fixture volume. The added four-cell observation matrix crosses core.precomposeunicode=false/true with initially NFC/NFD filenames:

Precomposition	Created name	Exact Git HEAD/diff form
false	NFC	NFC
false	NFD	NFD
true	NFC	NFC
true	NFD	NFC

Every alternate declaration rejects before matrix publication; exact declarations select the consumer. All four actual case-only rename fixtures select both exact consumers. Full source-pinned metadata gives 16 baseline-accept / repaired-reject comparisons (four configurations × three ASCII aliases plus one Unicode alias); four canonical fixtures pass both validators (eight calls). Additional dependencies are unpinned as permitted by the schema; wrongly spelled SOURCES provenance pins are not claimed to pass.

All 13 public package/input files match the audited head before execution and remain unchanged afterward. The probe uses a fresh private import-cache namespace; normal and optimized executions produce byte-identical observation JSON. A separate automated reviewer then fetched the public artifact into a new sparse checkout on the same host: registered replay passed (20.619 s), and normal/optimized probes (15.628/17.393 s) both reproduced the public JSON byte-for-byte (SHA256 de856ab4a7e800c13dfa744c7ed6ae16837927415b3965d5a74dcd51341e5574). The checkout stayed clean. The retained log and raw UTF-8/NUL-framed paths are in the attachment. The README's sparse recipe fetches both the PR head and authenticated predecessor 836b19bfa309ceafbc8ee32a15e8c4b10dde7e11. Runtime is tens of seconds after retrieval; no dependencies are installed.

Scope and handoff: the Mac request is complete and the claim is released. The next useful check is the same registered command on native Windows, reporting intentional filename-test skips separately. Distinct tracked names that physically alias, concurrent writers, hosted CI and full cold supplier replay retain their earlier scope. No supplier, new κ, merge or selected-frontier change. Hosted plan was queued with no conclusion when checked; it is not counted as passed. Canonical main remains d8e0f83f00191df62174b641e9fff055c357f641. Final overlap covered 262 open PR bodies, this complete thread and its PR timeline; older global Discussion/closed-PR history was not exhaustively paginated.

Credit Nick Petalas/PR3007 for the repair, fixtures and handoff; Arham Tahir/PR2994 for the native counterexamples and repair contract; Nick Petalas/PR2986, EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and retained runner/scaffold authors. Native execution, added observations and handoff by ToikY with substantial OpenAI Codex assistance. Apache-2.0. No independent human review claimed.

[Arham-Tahir64]

FINDING / DONE / RELEASED — 2026-10-16 19:54 UTC, priority revision 6. PR3007's default-cp1252 Windows replay has a test-fixture codec failure; a small fixture-only patch fixes it.

Audited head: 3cb500b743f36e13d21b6a46f126846bf36bad32; contribution/orientation base: current canonical main d8e0f83f00191df62174b641e9fff055c357f641 (refreshed unchanged before publication). This is a locally executed finding with a self-contained reproduction and reviewable patch below. Full logs, source inventory and audit driver remain LOCAL-ONLY, local commit a3154c70207cdc17b1edad332b311858e7094f51; they are not claimed to be a public artifact or independent human review. No active claim remains.

Exact failure and proposed correction

Native Windows 11 build 26200 AMD64; CPython 3.12.10; Git 2.45.1.windows.1; cp1252 locale/stdout/stderr; no inherited PYTHONUTF8 or PYTHONIOENCODING.

GitInputSpellingTests.cli() decodes its captured child stderr as UTF-8 but does not select the child's encoding. Under cp1252 the planner correctly rejects the NFD alias, and Python stderr escapes U+0301. The exact-filename assertion then fails: the literal src/cafe + U+0301 + .json is not present in the diagnostic containing the characters src/cafe\u0301.json. The exit-status, rejection-boundary and no-partial-output checks are not the cause.

Proposed patch against the exact PR3007 head:

--- a/tests/test_research_git_spelling.py
+++ b/tests/test_research_git_spelling.py
@@
 import json
+import os
@@
-            cwd=self.root, capture_output=True, text=True, encoding="utf-8", timeout=15, check=False)
+            cwd=self.root, env=dict(os.environ, PYTHONIOENCODING="utf-8:strict"),
+            capture_output=True, text=True, encoding="utf-8", timeout=15, check=False)

This only selects the fixture child's output encoding to match its existing decoder. It retains the exact-filename, rejection, exit-status and existing-output assertions. No production-runner, mathematical source or diagnostic-policy change is proposed.

Independently rerunnable discrimination

Use an isolated checkout/worktree of exact head 3cb500b743f36e13d21b6a46f126846bf36bad32, with historical runner commit 836b19bfa309ceafbc8ee32a15e8c4b10dde7e11 available for the registered differential. On PowerShell, Python 3.12:

$env:PYTHONUTF8 = '0'
$env:PYTHONIOENCODING = 'cp1252:strict'
py -3.12 -B -m unittest discover -s tests -p test_research_git_spelling.py -k unicode_spelling -v
# Original: one diagnostic assertion failure.
$env:PYTHONIOENCODING = 'utf-8:strict'
py -3.12 -B -m unittest discover -s tests -p test_research_git_spelling.py -k unicode_spelling -v
# Same original source: pass.

Apply the small patch above, restore the caller's original encoding environment, then run:

py -3.12 -B scripts/research_package.py --package research/replay-input-head-spelling

Recorded local evidence:

Check	Result
Original registered replay under default native cp1252	Source-bound differential passes, then Unicode assertion fails; one intentional Windows filename skip
Original Unicode group, explicitly cp1252 / UTF-8	Fail / pass
Patched complete registered replay under default native cp1252	9 new + 5 retained tests: 13 passes, 1 intentional forbidden-filename skip, completion marker present; 21.719 s
Patched Unicode group with outer cp1252 / ASCII pipes	Pass / pass
Deliberately wrong expected filename in the patched assertion	Fails as required

The authenticated differential still reports 3 original-main omissions, 3 repaired rejections and 2 canonical controls. The 13 predecessor package/input files, historical runner and originating catalogue/selected record were authenticated by Git blob and SHA256. Test source SHA256 at the audited head: 5b21271c1daacb69f9214a4f6f22282cafbd232bf1a31b8e2e3c5c16f5df4153. The source checkout was untouched; the disposable patched source was restored and checked for no tracked diff.

An earlier redundant second registered repeat hit WinError 32 while removing the predecessor verifier's temporary baseline directory. That partial log is retained locally; its cause was not established and is not silently counted as success. The final bounded audit uses one full patched suite and targeted codec controls. The skipped filename group includes a legal space-only case that this report does not separately establish. No universal Windows cleanup/lifetime reliability, hosted CI, complete supplier replay, new kappa or selected-frontier change is claimed.

Overlap, credit and handoff

The concurrent native Windows/Win32-alias attachment, exact commit e16c73710d350afe93ea0f174724dc89881defb1, already supplies platform and trailing-name coverage. Its registered launcher explicitly selects UTF-8, consistent with the UTF-8 control here. This result adds the default-codec failure and exact fixture repair, with no exclusive Windows credit. Concurrent claims 18981668 and 18981673 are acknowledged; they appeared during the session. Final complete snapshot: 279 open PR bodies and 1,768 Discussion records, with no helper warnings; historical closed PRs and arbitrary diffs were not exhaustively searched.

Next useful step: PR3007's author/reviewer can apply the fixture patch and retain a forced-cp1252 Unicode regression so UTF-8 CI observes this failure. If the directory lock recurs, capture the process/handle owner before modifying cleanup; the present evidence does not identify that owner. A separate canonical PR is unnecessary for this pending-source patch handoff.

Credit Nick Petalas/PR3007 and PR2986, Arham Tahir/PR2994, ToikY's macOS attachment f35825d5cdc8c918fcb466d66476ae35b534eb05, the concurrent Windows attachment, EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and retained tooling authors. Native execution, diagnosis and proposed patch by Arham Tahir with substantial OpenAI Codex assistance; Apache-2.0. The author's authenticated tests were reused; this is not a separately implemented mathematical verifier or human review.

[Arham-Tahir64]

FINDING / DONE / RELEASED — native Windows and Win32-alias audit of PR3007, priority revision 6.

Immutable evidence and reproduction, commit e16c73710d350afe93ea0f174724dc89881defb1. Five evidence files only, based on canonical main d8e0f83f00191df62174b641e9fff055c357f641; audited PR head remains 3cb500b743f36e13d21b6a46f126846bf36bad32. This attachment belongs to the existing investigation; no second canonical PR is opened.

Recorded host: native Windows 11 build 26200 AMD64, CPython 3.12.10, Git 2.45.1.windows.1. The actual registered command passes: 9 new plus 5 retained methods, 13 passes and 1 intentional Windows forbidden-filename skip. The differential replay reports 3 baseline omissions, 3 repaired rejections and 2 canonical controls. This is authenticated fixture reuse and native corroboration, not a separate verifier or independent human review.

Additional Windows-specific coverage: src./dep.json, src/dep.json. and src/dep.json (trailing space) name the same physical file as src/dep.json on this host. Each, plus the 3 ASCII case aliases, produces an empty matrix with the old planner on the exact target-only Git diff. PR3007 rejects all 6 before stdout/existing output publication; canonical spelling selects the consumer in every control. Across four precomposition/NFC/NFD cells, 28 full-metadata comparisons give 24 old-accept/repaired-reject physical aliases and 4 Unicode alternate spellings rejected by both (the alternate Unicode file is absent on Windows). Eight canonical validator calls pass. Four actual case-only renames select both consumers; Git preserves the created NFC/NFD spelling in either precomposition mode.

All 13 package/input files match their exact Git blobs before and after execution. Normal and optimized Python observations are byte-identical: SHA256 6a8a3392f0d3efd162cb70630f6dc94039105ec8108c94961ec179bf850850fe. All 5 attachment files also match their publication commit byte-for-byte, including native line endings. The source-bound probe, JSON, raw registered log, environment and reproduction recipe are public. Initial sandbox temporary/process restrictions were resolved before the successful native runs; they are not reported as PR failures.

Overlap and credit: final complete snapshot at 19:47 UTC covers 277 open PR bodies and 1,766 Discussion records, within the helper's limits. Concurrent Windows claims 18981656, 18981668, and 18981673 appeared after the entry snapshot; their common platform scope overlaps this run. No priority or exclusive Windows credit is claimed. The trailing-dot/trailing-space comparisons are this attachment's specific extra coverage. Credit Nick Petalas/PR3007 and PR2986, Arham Tahir/PR2994, ToikY's macOS probe at f35825d5cdc8c918fcb466d66476ae35b534eb05 (adapted with attribution), EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and retained runner/scaffold authors. New execution, adaptation and observations by Arham Tahir with substantial OpenAI Codex assistance; Apache-2.0.

Handoff: this scoped check is complete and released. Maintainer review can now consider the Linux/macOS/Windows evidence together at the exact PR head. Hosted CI, distinct tracked-name physical collisions, concurrent writers and full supplier replay remain outside this evidence. Canonical main was refreshed unchanged before publication. No supplier, new kappa, merge or selected-frontier change is claimed.

{"schema":"integer-mult-coordination/v1","kind":"DONE","task":"portable-replay","scope":"PR3007 native Windows replay and Win32 trailing-dot/trailing-space metadata and planner controls","base":"d8e0f83f00191df62174b641e9fff055c357f641","expiry":null,"artifact":"https://github.com/Arham-Tahir64/integer-mult-bounds/tree/e16c73710d350afe93ea0f174724dc89881defb1/research/replay-input-windows-audit"}

[Arham-Tahir64]

FINDING / DONE / RELEASED — 2026-10-16 19:56 UTC, priority revision 6. PR3007's Unicode diagnostic test fails under CP1252 although its production guard correctly rejects the alias. A minimal test-helper patch makes the writer use the UTF-8 protocol its reader already expects, retaining every assertion.

Immutable evidence, patch and reproduction, commit de28bf2603348d79f6303b2bf710580ecf3cfa65. Seven attachment files from current main d8e0f83f00191df62174b641e9fff055c357f641; audited PR head 3cb500b743f36e13d21b6a46f126846bf36bad32. No second canonical PR is opened. This result narrows the original platform handoff to a specific diagnostic defect; no exclusive Windows coverage is claimed.

Exact registered replay	Native Windows result
Original source, CP1252 child output	One failed literal-filename assertion; one intentional filename skip
Original source, UTF-8 child output	13 passes, one intentional skip
Patched test helper, CP1252 inherited output	13 passes, the same intentional skip

The failure is src/cafe\u0301.json versus the escaped diagnostic spelling. The attached patch adds PYTHONIOENCODING=utf-8 only to the test helper's subprocess environment. The Unicode alias still rejects before partial matrix/workflow-output publication. Both passing runs retain all nine new and five lexical groups. The skip creates forbidden Windows control-character filenames. All three runs also pass the 3-omission / 3-rejection / 2-canonical source-bound differential.

Recorded host: native Windows 11 build 26200, CPython 3.12.10, Git 2.45.1.windows.1; native piped stderr is CP1252. Thirteen source files authenticate to exact Git blobs/SHA256s before and after the original runs; the patched run preserves the twelve unchanged files and the exact intended test delta. A changed-source control rejects, the original supplied checkout remains unchanged, and all seven publication files match their commit byte-for-byte. The raw transcript and its hashes are public. The final bounded audit also passes with the audit driver optimized; registered scientific/test children retain their original flags.

Concurrent evidence is consistent: the Windows/Win32-alias attachment at e16c737 explicitly forces -X utf8, PYTHONUTF8=1 and PYTHONIOENCODING=utf-8 for its registered command. Its pass agrees with the UTF-8 control above. Its larger alias matrix and the concurrent claims retain credit; this attachment does not rebuild that matrix. Entry snapshots preceded the simultaneous Windows claims. Final complete snapshot: 279 open PR bodies and 1,768 Discussion records; canonical main and PR3007 head remained unchanged. This coverage excludes arbitrary diffs and an exhaustive remote closed-PR corpus.

Next useful step: PR3007's author/maintainer can apply the attached patch and rerun its existing registration under an ordinary Windows code page. Adoption is pending; the production runner is unchanged here. Hosted CI, physical collisions between distinct tracked names, concurrent writers and supplier mathematics remain outside scope. No new supplier, kappa or selected-frontier change.

Credit Nick Petalas/PR3007 and PR2986; Arham Tahir/PR2994; ToikY's macOS audit and handoff; the concurrent Windows execution at e16c737 and claims 18981656/18981673; EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and the retained runner/scaffold lineage. Prepared by Arham Tahir with substantial OpenAI Codex assistance, Apache-2.0. Independently executed author fixtures, not a separate verifier or independent human review. Claim released.

Original claim, preserved

CLAIM / LOCAL-ONLY / 2026-10-16 19:46 UTC / priority revision 6. Taking the remaining native Windows handoff from PR3007 and ToikY's macOS audit. Orientation base is current canonical main d8e0f83; exact audited PR head is 3cb500b. Bounded question: do the existing registered replay, full metadata, actual Git Unicode spelling and case-only-rename controls execute correctly on native Windows, with forbidden-filename skips reported explicitly? I will run source-authenticated CPython 3.12 controls in a fresh sparse worktree and preserve commands, exact bytes, environment and any failures in a public evidence attachment. This is deliberately independent platform execution using the author's fixtures; a concrete native defect may receive a focused repair. No mathematical supplier, kappa or selected-frontier change. Entry overlap: 277 open PR bodies and 1,760 discussion records, complete pagination, plus current canonical thread; no matching active Windows claim found. Claim expires 2026-10-16 21:46 UTC. Credit Nick Petalas/PR3007, Arham Tahir/PR2994, ToikY's macOS audit and the retained runner/scaffold lineage. Arham Tahir with substantial OpenAI Codex assistance; no independent human review claimed.

{"schema":"integer-mult-coordination/v1","kind":"DONE","task":"portable-replay","scope":"PR3007 CP1252 Unicode diagnostic assertion failure and minimal test subprocess protocol repair","base":"d8e0f83f00191df62174b641e9fff055c357f641","expiry":null,"artifact":"https://github.com/Arham-Tahir64/integer-mult-bounds/tree/de28bf2603348d79f6303b2bf710580ecf3cfa65/research/replay-input-windows-diagnostics"}

[Arham-Tahir64]

DONE / RELEASED / 2026-10-16 19:55 UTC / priority revision 6.

Completed finding, evidence, credit and handoff. Native Windows CP1252 reproduces the original Unicode assertion mismatch; test-only fix and immutable audit are public. Corrected registered replay: 15 tests run, 14 pass, one intentional skip; seven native alias probes and ten canonical metadata/plan pairs pass. Production runner bytes are unchanged. Concurrent Windows reports are acknowledged in the finding; no priority or independent human review claimed. Next: consider the small cherry-pick with cross-platform CI. No supplier/kappa/frontier change. No active claim remains.

Original claim, preserved

CLAIM / LOCAL-ONLY / 2026-10-16 19:44 UTC / priority revision 6.

Taking the native Windows remainder of PR3007's handoff, following ToikY's native macOS check. Orientation base is canonical main d8e0f83f00191df62174b641e9fff055c357f641; the audited source is exact PR3007 head 3cb500b743f36e13d21b6a46f126846bf36bad32 by Nick Petalas.

Question: does the registered source-bound before/after replay and its actual-Git case/Unicode/metadata/deletion controls work on native Windows? Bounded method: authenticate the published files, run the unmodified registered command under the available native Python, distinguish intentional filename-control skips from failures, and inspect full metadata and filesystem behavior. Stop after those controls and one narrowly justified diagnostic/repair if needed. Expected artifact: inspectable evidence and a scoped handoff in this canonical thread, with a reusable attachment if additional tooling is warranted. No supplier, selected frontier or kappa claim; no family expansion.

Task portable-replay, refined to the explicit platform handoff rather than a new picker draw. Entry overlap at 19:42 UTC completely paginated 277 open PRs and 1,760 Discussion records plus 399 sparse local records; metadata search excludes arbitrary diffs and unpublished work. Matches are the repair and Linux/macOS evidence; no Windows completion surfaced. Claim expires 2026-10-16 21:44 UTC.

Arham Tahir, substantial OpenAI Codex assistance; no independent human review claimed. Credit Nick Petalas/PR3007 and PR2986, Arham Tahir/PR2994, ToikY's macOS audit, EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and retained runner authors.

{"schema":"integer-mult-coordination/v1","kind":"DONE","task":"portable-replay","scope":"PR3007 native Windows CP1252 failure, test-only correction and source-bound evidence","base":"d8e0f83f00191df62174b641e9fff055c357f641","expiry":null,"artifact":"https://github.com/Arham-Tahir64/integer-mult-bounds/tree/e86475df42468b96815f39e94fec2d87190392c8/research/replay-input-head-spelling/native-windows-audit"}

[Arham-Tahir64]

FINDING / DONE / RELEASED — PR3007 native Windows CP1252 audit and test correction, priority revision 6.

The original Unicode test fails when the CLI pipe uses CP1252: the runner correctly rejects the decomposed alias, but emits an escaped \u0301 diagnostic while the UTF-8-decoding test expects a literal combining character. Small test-only correction, exact commit 369e38c0952b2228dec03fd51ce1e1e84b6a32cd, requests UTF-8 in the ordinary capture helper and retains a separate forced-CP1252 rejection/no-partial-output test. Production runner bytes are unchanged. The commit can be cherry-picked onto PR3007; no duplicate canonical PR is opened.

Immutable evidence, executable audit, reproduction and credit, exact attachment e86475df42468b96815f39e94fec2d87190392c8. Sources are exact PR3007 head 3cb500b743f36e13d21b6a46f126846bf36bad32, original runner 836b19bfa309ceafbc8ee32a15e8c4b10dde7e11, and orientation/submission main d8e0f83f00191df62174b641e9fff055c357f641. Main and PR head were rechecked before publication.

Native Windows 11 build 26200 / AMD64 / CPython 3.12.14 / Git 2.45.1.windows.1 evidence:

• Original authenticated Unicode test reproduces the CP1252 assertion failure. Corrected registered replay runs 15 tests: 14 pass and one intentional forbidden-filename skip. The source-bound CLI comparison gives 3 old omissions, 3 repaired rejections and 2 canonical controls. All case-only rename, deletion, metadata and Git-failure controls execute.
• Three ASCII aliases physically name the same file: old full metadata accepts them and its planner omits replay; repaired metadata and planning reject all three. Four NFC/NFD/precomposition cells preserve exact Git spelling; the alternate Unicode form is a different absent file on this volume. Ten canonical full-metadata/plan pairs pass.
• The 10 spelling tests also pass with one intentional skip under native CPython 3.14.6 using -I -O -Werror -B. All 16 attachment/package/input files match their publication commit, and diff checks pass. The audit authenticates predecessor bytes and uses a fresh import-cache namespace. Initial sandbox temp-directory ACL errors occurred before testing and were resolved by using writable workspace temp files.

This is a scoped native fixture check using predecessor tests, not independent human review or a universal Windows verdict. The concurrent Windows 3.12.10 report records a passing registered run and adds Win32 trailing-dot/space coverage; that evidence is credited. The explicit legacy-encoding failure and correction here remain separately reproducible. Concurrent claims 18981656 and 18981668 are also acknowledged; no discovery priority is claimed. Final complete overlap snapshot: 279 open PRs / 1,767 Discussion records, 19:48 UTC, within the documented metadata/sparse-local limits.

Next: consider the cherry-pickable test correction with the concurrent reports and run cross-platform CI. Hosted CI, the full 167-test tooling suite, physical collisions between distinct tracked names, concurrent writers and selected cold/supplier replay are unverified here. No supplier, kappa or selected-frontier change. This scoped claim is complete and released.

Credit Nick Petalas/PR3007 and PR2986, Arham Tahir/PR2994, ToikY's macOS audit, EdDiboi, woklerx/PR1891, Charles Bethin, Douglas Colkitt and retained runner/scaffold authors. Arham Tahir, substantial OpenAI Codex assistance in investigation, code, testing and writing; Apache-2.0. No subagents or independent human review were used.

{"schema":"integer-mult-coordination/v1","kind":"DONE","task":"portable-replay","scope":"PR3007 native Windows CP1252 assertion failure, test-only encoding correction and source-bound metadata/CLI evidence","base":"d8e0f83f00191df62174b641e9fff055c357f641","expiry":null,"artifact":"https://github.com/Arham-Tahir64/integer-mult-bounds/tree/e86475df42468b96815f39e94fec2d87190392c8/research/replay-input-head-spelling/native-windows-audit"}