Stabilize diagnostic export and preserve authorized policy continuity

docs/diagnostics-backpressure.md

@@ -0,0 +1,86 @@
+# Bounded diagnostics and policy continuity
+
+Browser diagnostics are optional and centrally authorized. They never replace
+the protected durable security audit. This change keeps inspection, release
+checks, audit encryption and `fsync` unchanged.
+
+## Browser exports
+
+Each signal has one active SDK export and a FIFO bounded by the signed
+`maxQueueSize` in waiting records, plus its active batch. Queue expiry uses the
+original record timestamps; waiting does not refresh authorization or age.
+Overflow, expiry, timeout and cancellation remain actual counted failures.
+The process retains lifetime totals, fixed reason counts and at most 32 cloned
+failure facts, including queue age. Error text, bodies, endpoints and credentials
+are absent. Completed callbacks cannot count twice.
+
+Flush calls share one promise per generation. Dispatch waits for the next event
+loop turn after completion because the SDK frees its internal concurrency slot
+after invoking the callback. Real successful HTTP drain tests cover that race,
+including exports arriving during the callback-to-settlement interval.
+
+An already verified, unexpired policy can keep diagnostics active through a
+publication when the full exporter configuration and device context remain
+identical, except for policy version. Policy and bookmark signatures and device
+assignment are checked first. Operation contexts are immutable snapshots:
+existing spans and logs keep their original version; new root operations use
+the new version. Explicit operation metadata still overrides defaults.
+
+Changed endpoint, mode, sampling, limits, identity or disabled diagnostics still
+cancel active requests and waiting callbacks immediately. Expired previous
+authority cannot use continuity. Cancellation remains visible in lifetime
+failure accounting; it is not silently relabeled as successful delivery.
+
+## Protected local development collector
+
+The loopback receiver bounds unfinished OTLP requests to eight and their shared
+body buffers to 8 MiB, with a 2 MiB per-body limit. Idle incomplete requests time
+out after ten seconds. Overload returns fixed503; oversized bodies return413.
+Aborts release reservations and remove waiting work. Commit work is serialized
+without changing the encryption, path guards, rotation or synchronous `fsync`.
+HTTP200 still follows actual encrypted persistence; storage failure returns507.
+
+Admission summaries expose counts, bytes, queue wait and commit duration. Native
+event-loop delay is metadata only. This is bounded admission and observability,
+not a claim that synchronous disk work has been moved into a worker.
+
+Startup verifies an existing exact private directory ACL without resetting it:
+current user owns it, inheritance is disabled, and its sole explicit rule grants
+that user FullControl with file/directory inheritance. Unsafe ACLs require a
+successful protection and verification step or prevent startup. This avoids a
+redundant owner-setting operation that failed under a non-elevated token.
+The existing DPAPI key and encrypted archives remain intact across restart.
+This developer receiver is not a production SIEM or remote collector.
+
+## Current Windows evidence
+
+The final frozen main/diagnostics source passed:
+
+- 784 source tests, zero failures or skips, and ESLint with zero warnings.
+- Actual native clipboard/upload enforcement:17 checks and five additional
+  checks after a real process restart;13 public requests, zero confidential
+  deliveries and two exactly received public files.
+- Real local Gemma: all four semantic receiver checks, with confidential
+  paraphrases blocked and no external model inspection.
+- Window and first-statement dedicated Worker WebTransport attempts through
+  three signed policy phases: six Created and six Closed security records,
+  zero managed packets/bytes, and three successful public HTTPS submissions.
+- Zero current and lifetime export failures in all those browser processes.
+
+Actual semantic file trace `e5ebf887a1ad8d90f065739a86cd2261` shows a9.04s
+request containing several independently inspected representations. Individual
+local stages took1.69–1.93s; semantic stages0.78–1.03s, with audit commit12–16ms.
+These are measured profiling targets, not permission to remove required checks.
+Collector checkpoint:578 commits, zero commit failures/rejections, max queue
+wait14.87ms and max commit42.18ms, with no active or waiting request at inspection.
+
+Ignored evidence: `artifacts/diagnostics-continuity-final-suite.log`,
+`context-reuse-{public,mvp,semantic,wt}-native.log`, the corresponding native
+proof JSON files and `diagnostics-continuity-collector-checkpoint.json`.
+Use `node --test --test-concurrency=2 tests/*.test.mjs` for the full Windows suite.
+
+Historical failed runs remain retained. Their earlier three2s export timeouts
+cannot be causally explained retroactively by these later successful runs.
+The separately measured SDK drain race and policy-retirement losses have direct
+regression coverage. The native WebRTC engine crash remains a separate open
+Windows MVP gate; see [the current scope](windows-dlp-mvp.md).

docs/electron-best-practices.md

@@ -84,6 +84,15 @@ that the whole application is clean, fully optimized or independently audited.
 
 ## Latest reproducible checks
 
+The latest final-source Windows acceptance supersedes the historical failed
+runs below:784 tests, lint, packaged-artifact verification, actual clipboard,
+upload, process restart, local Gemma and audited Window/Worker transport tests
+pass. All native browser lifetimes have zero export failures. Bounded exporter
+FIFO, an SDK completion barrier, single-flight flush, verified policy continuity,
+collector admission and idempotent private ACL startup are implemented.
+See [current evidence and limits](diagnostics-backpressure.md). The separate
+WebRTC engine crash remains reproducible in the official44.7.1 candidate too.
+
 A subsequent full run after the Established-alarm regression added a test
 passed 764 of765 and exposed a real gateway cancellation race: the policy
 monitor aborted the provider but discarded its fixed409 error, producing500.
@@ -127,8 +136,8 @@ concurrency failure. A bounded export queue, single-flight flush and collector
 commit-latency measurements are the next narrowly scoped diagnostics work;
 mandatory inspection and audit durability must remain intact.
 
-- Full source suite: 771 tests passed with `--test-concurrency=2`, no failures
-  or skips; see `artifacts/transport-owner-final-failure-ledger-suite.log`. An earlier
+- Full source suite: 784 tests passed with `--test-concurrency=2`, no failures
+  or skips; see `artifacts/diagnostics-continuity-final-suite.log`. An earlier
   higher-concurrency run failed one evidence-key ACL check; its cause remains
   unconfirmed and its log is retained. All 18 evidence tests passed separately.
   No ACL protection or timeout was weakened. `npm run lint` passed with zero
@@ -143,9 +152,9 @@ mandatory inspection and audit durability must remain intact.
   literal and semantic payloads. Restart reused the protected device profile.
   These are separate from packaged-artifact acceptance. The final literal and
   actual-restart fixtures pass17+5 checks with zero lifetime exports failed.
-  The latest semantic receiver/model checks pass, but diagnostics acceptance
-  fails on three measured2s timeouts and one concurrency rejection. These are
-  retained as real failures, not cancelled exports or successful delivery.
+  The latest semantic receiver/model and diagnostics checks pass with zero
+  lifetime failures. Earlier three measured2s timeouts and one concurrency
+  rejection remain retained as real failures, with no retrospective cause claim.
 - The protected local OpenTelemetry receiver reported zero rejected writes.
   Trace `33b46998b44c3179cccd2826d5790c00` correlates browser.request,
   browser.inspect.local, inspector.inspect, semantic load/inference and durable

docs/native-runtime/README.md

@@ -4,6 +4,25 @@ Status: source patch prepared and checked; **not compiled or runtime verified**.
 Do not distribute this patch as a proven security fix until the acceptance gates
 below pass against the resulting binary.
 
+## Latest stable candidate checked
+
+The official [Electron44.7.1 release](https://github.com/electron/electron/releases/tag/v44.7.1)
+uses Chromium152.0.7977.149. Its Windows x64 ZIP was downloaded into an isolated
+ignored directory, checked against the official SHA256 manifest and extracted
+with contained-path, symlink and size checks. ZIP SHA256:
+`ace7ce1580d33e9fe7284823d7e23ba687263c448d85d8dc4b5daa9bba73f97a`.
+
+Actual positive controls in fresh profiles transmitted synthetic RTC bytes and
+a benign HTTPS submission from both initial about:blank and srcdoc frames.
+The matching managed header cases still terminated their renderers with
+missing `network.mojom.MdnsResponder`, bad IPC123 and exit3. The tagged binder
+source also lacks `NoOpP2PSocketManager`. Therefore this available stable binary
+does not resolve the gate. Project dependencies remain unchanged.
+
+Ignored evidence: `artifacts/electron4471-binary-proof.json`. The first run's
+about:blank positive timeout remains retained; a separate profile-isolated
+paired run verified both controls without changing attempts or deadlines.
+
 ## Exact basis and provenance
 
 The adjacent patch targets Chromium `152.0.7977.130`, used by Electron `44.7.0`.

docs/native-transport-observability.md

@@ -61,9 +61,11 @@ hashes and `artifacts/cdp-webtransport-native-proof.json`. The latter additional
 checks real DevTools coexistence and verifies that observer disposal preserves
 clipboard ownership. Earlier literal/restart and real local Gemma regressions
 passed on the same source hashes. The later final-source literal/restart test
-also passes; the later semantic DLP checks pass but its debug acceptance records
-three export timeouts and one concurrency rejection. Those failures remain
-open and are separate from receiver containment. These scenarios do not prove every worker, iframe,
+also passes. Historical semantic debug runs recorded three export timeouts and
+one concurrency rejection. The latest semantic and audited transport runs now
+pass with zero lifetime failures after bounded exports and policy continuity;
+see [diagnostics evidence](diagnostics-backpressure.md). Historical failures
+remain retained without retrospective causal claims. These scenarios do not prove every worker, iframe,
 shared-worker attribution or future Chromium transport implementation.
 
 ## Measured limits

docs/requirements-audit.md

@@ -7,12 +7,14 @@ Die breiteren Anforderungen und Erweiterungen unten bleiben Roadmap.
 
 ## Aktuelle nächste Abnahmen
 
-**Aktualisierung des Windows-MVP:** 771 Tests bestehen mit begrenzter
+**Aktualisierung des Windows-MVP:** 784 Tests bestehen mit begrenzter
 Parallelität. Der aktuelle Windows-Build besteht Paket-, Fuse- und
 Manipulationsprüfungen, ist aber nicht signiert. Native Clipboard-/Upload-Tests,
 Prozessneustart bestehen auf dem finalen Quellstand. Die lokalen semantischen
-Gemma-DLP-Prüfungen bestehen, ihre Debug-Abnahme scheitert noch an drei
-Export-Timeouts und einer Concurrency-Ablehnung. WebTransport-Versuche in Fenster und Dedicated Worker sind nun
+Gemma-DLP-Prüfungen und ihre Debug-Abnahme bestehen nach begrenzten Exporten und
+Policy-Kontinuität erneut mit null aktuellen/lebenslangen Exportfehlern.
+Historische Fehler bleiben dokumentiert; siehe [Diagnostik](diagnostics-backpressure.md).
+WebTransport-Versuche in Fenster und Dedicated Worker sind nun
 als korrelierte Security-Events und OpenTelemetry-Traces nachgewiesen; siehe
 [Transport-Nachweise](native-transport-observability.md). Der bekannte native
 WebRTC-Absturz bleibt offen, bis ein korrigiertes Binary geprüft ist.

docs/windows-dlp-mvp.md

@@ -55,20 +55,24 @@ Requests und zwei exakt übertragenen Dateien. Aktuelle und lebenslange
 Exportfehler bleiben in diesen Prozessen0. Der frische öffentliche Diagnosetest
 mit vier geprüften Policy-Veröffentlichungen besteht ebenfalls.
 
-**Noch offen:** Die letzte echte lokale Gemma-Abnahme besteht alle vier
-DLP-/Empfängerprüfungen, scheitert aber an drei gemessenen2s-Export-Timeouts und
-einem `concurrency-limit`. Die neuen begrenzten Fehlerdaten belegen aktive
-Generation1 ohne Policy-Abbruch; sie beweisen noch nicht die Ursache der
-Antwortverzögerung. Kein Zähler wurde gelöscht oder eine Erwartung gelockert.
-Für die Debug-Abnahme sind begrenzte Export-Warteschlangen, ein gemeinsamer
-Flush und Latenz-/Eventloop-Nachweise zu prüfen. Ein weiterer geschützter
-Transporttest wurde nach diesem Fehler nicht einfach wiederholt.
+**Debug-Abnahme bestanden:** Nach begrenzter Export-FIFO, gemeinsamem Flush,
+SDK-Abschlussbarriere und signierter Policy-Kontinuität bestehen alle vier
+echten lokalen Gemma-Prüfungen und die vollständige WebTransport-Abnahme erneut
+mit null aktuellen und lebenslangen Exportfehlern. Native Clipboard-/Upload-
+und echte Neustarttests bestehen ebenfalls mit17+5 Prüfungen. Der Collector
+meldet578 Commits, null Fehler/Ablehnungen und maximal14.87ms Queue-Wartezeit.
+Timeout-Grenzen, Fehlerzähler und Abnahmeerwartungen wurden nicht gelockert.
+Historische Timeout- und Cancellation-Fehler bleiben als Nachweise erhalten;
+die früheren Timeout-Ursachen sind nicht rückwirkend bewiesen.
+Details und Reproduktion: [begrenzte Diagnostik](diagnostics-backpressure.md).
+
+**Noch offen:**
 Der native WebRTC-Absturz bleibt ein separater offener Stabilitäts-Gate.
 Das MVP ist deshalb weiterhin **nicht abgeschlossen**.
 
-771 Tests bestehen im letzten vollständigen Lauf mit zwei parallelen Testdateien;
+784 Tests bestehen im letzten vollständigen Lauf mit zwei parallelen Testdateien;
 ESLint verlangt null Fehler und null Warnungen. Nachweis:
-`artifacts/transport-owner-final-failure-ledger-suite.log`. Ein späterer
+`artifacts/diagnostics-continuity-final-suite.log`. Ein späterer
 Policy-Abbruch verlor ursprünglich seinen festen409-Fehler und lieferte500;
 dieser echte Gateway-Fehler ist mit deterministischen Tests und exportierten
 Traces behoben. Der stärker parallelisierte