Audit native transports and retain secure export diagnostics

docs/electron-best-practices.md

@@ -84,9 +84,55 @@ that the whole application is clean, fully optimized or independently audited.
 
 ## Latest reproducible checks
 
-- Full source suite: 749 tests passed, no failures or skips; see the ignored
-  `artifacts/mvp-final-startup-suite.log`. `npm run lint` passed again with
-  zero warnings on 2026-10-13.
+A subsequent full run after the Established-alarm regression added a test
+passed 764 of765 and exposed a real gateway cancellation race: the policy
+monitor aborted the provider but discarded its fixed409 error, producing500.
+The gateway now preserves the first fixed cancellation reason (policy409,
+caller403, deadline504). Fourteen focused tests and scoped lint passed. Actual
+collector trace `3b6b5e374da506f7ae5ffbb118933bf6` shows the provider aborted at
+101.6ms under the gateway and library parents. The earlier failed full run is
+retained in `artifacts/transport-owner-containment-final-suite.log`.
+
+The subsequent native clipboard/upload scenario passed all17 enforcement
+checks but failed diagnostics acceptance because lifetime exports recorded two
+errors. Collector rejected writes remained0; their exact causes cannot be
+reconstructed from the original counters. Failure instrumentation and a fresh
+acceptance run must resolve this separately from DLP transmission proof.
+
+The browser now retains at most32 cloned export-failure facts and lifetime
+totals by fixed reason. Facts include traces/logs, generation, duration, fixed
+HTTP status, retirement overlap and explicitly signalled cancellation. Raw
+error text, response bodies, credentials and collector URLs are excluded.
+Actual held HTTP exports prove that retirement cancellation remains counted
+as failure; the instrumentation does not silently reset or retry operations.
+Seventeen focused diagnostics tests passed, including timeout, refusal,503,
+bounded history and concurrent flush attribution.
+
+A fresh public-only native diagnostic run completed with four independently
+reviewed policy publications and four public HTTPS submissions. Every snapshot
+had zero current/lifetime failures and an empty failure history; actual exported
+trace `b5eefaf6bb8407f6917bd5cada6e8587` and collector rejectedWrites0 were
+verified. Reproduction: `node scripts/native-diagnostics-public.mjs` with the
+protected local collector already running. This does not retrospectively prove
+the cause of the earlier two failures or reset their historical evidence.
+
+A further quiet public-only native measurement delivered80 benign HTTPS
+responses across four reviewed publications: median59.53ms, p95 83.19ms,
+max88.17ms; observed main event-loop maximum drift328.29ms over637 samples.
+Current/lifetime failures remained0, collector rejectedWrites0. Trace
+`d4689e3d28ebe902b752500c0f79e30b` and
+`artifacts/public-backpressure-native-proof.json` are local evidence. This does
+not resolve or causally explain the semantic run's three timeouts and one
+concurrency failure. A bounded export queue, single-flight flush and collector
+commit-latency measurements are the next narrowly scoped diagnostics work;
+mandatory inspection and audit durability must remain intact.
+
+- Full source suite: 771 tests passed with `--test-concurrency=2`, no failures
+  or skips; see `artifacts/transport-owner-final-failure-ledger-suite.log`. An earlier
+  higher-concurrency run failed one evidence-key ACL check; its cause remains
+  unconfirmed and its log is retained. All 18 evidence tests passed separately.
+  No ACL protection or timeout was weakened. `npm run lint` passed with zero
+  warnings after the final source changes.
 - A fresh `npm audit --omit=dev --json` reported zero advisories. Development
   toolchain findings remain tracked separately in `dependency-audit.md`.
 - In the paired single module-load profiles, diagnostics require time changed
@@ -95,7 +141,11 @@ that the whole application is clean, fully optimized or independently audited.
   measurements do not establish full application startup or percentile gains.
 - Native Windows DLP fixtures delivered public data and blocked confidential
   literal and semantic payloads. Restart reused the protected device profile.
-  These are separate from final packaged-artifact acceptance.
+  These are separate from packaged-artifact acceptance. The final literal and
+  actual-restart fixtures pass17+5 checks with zero lifetime exports failed.
+  The latest semantic receiver/model checks pass, but diagnostics acceptance
+  fails on three measured2s timeouts and one concurrency rejection. These are
+  retained as real failures, not cancelled exports or successful delivery.
 - The protected local OpenTelemetry receiver reported zero rejected writes.
   Trace `33b46998b44c3179cccd2826d5790c00` correlates browser.request,
   browser.inspect.local, inspector.inspect, semantic load/inference and durable
@@ -111,6 +161,12 @@ that the whole application is clean, fully optimized or independently audited.
 - The full enrolled browser WebTransport receiver fixture now passes through
   reviewed DIRECT and fetched HTTPS PAC policies: zero managed packets/bytes,
   paired against 132 baseline bytes, with ordinary HTTPS submissions working.
-  It records source hashes and genuine operational traces. There is still no
-  per-attempt WebTransport security event because this path produces no
-  Electron webRequest callback; transport denial and audit coverage are separate.
+  It records source hashes and genuine operational traces. A fixed private
+  native channel now shares the existing clipboard debugger owner and records
+  six Created and six Closed security events across the tested window and
+  dedicated-worker attempts, with zero Established events. All twelve events
+  correlate with exported audit traces. No raw URL, payload or CDP identifier
+  enters these events. See [native transport observability](native-transport-observability.md)
+  for coverage limits, failure behavior and ECS/CEF mapping. The private relay
+  remains the transmission boundary; lifecycle observations alone do not prove
+  content inspection or universal realm coverage.