Audit native transports and retain secure export diagnostics

docs/native-runtime/README.md

@@ -105,3 +105,80 @@ attempts; its tagged binder source lacks the no-op implementation. A later
 binary is acceptable only after source inclusion checks and all native gates
 above. Current ignored artifacts retain the original crashes and positive
 controls; an upgrade must not overwrite that evidence.
+
+## Local setup started, 2026-10-13
+
+An isolated checkout now exists at
+`C:/Users/karl/Safetynet/artifacts/native-build/electron44`.
+Electron tag44.7.0 resolved to commit
+`61f55c4ce540416b3e43f75f6c0f125d22e5e908`; its DEPS pins152.0.7977.130.
+The adjacent depot_tools checkout is pinned at
+`52ae103994896b9ce7742a605de8f43b410e5515`.
+The ignored `run-sync.mjs` wrapper supplies process-only PATH/toolchain/Git
+configuration and runs `gclient.bat sync --nohooks --shallow --jobs=2
+--revision=src@2c592105bbcd9490a9894df48d0fe59b2c512651`.
+It records `source-sync.log`, stops its own process tree if free disk falls below
+150GiB, and bounds each run to30minutes. A live bootstrap is not source completion.
+Current depot_tools expects `git.bat`; the first sync failed because only
+`git.exe` was installed. An isolated `artifacts/native-build/bin/git.bat` now
+forwards to the existing signed `C:/Program Files/Git/cmd/git.exe`; only the
+wrapper's PATH includes that shim. The initial Chromium clone observed after
+retry did not include a depth argument, so the requested shallow option must
+not be treated as proof of a shallow fetch. Disk/deadline bounds still apply.
+Hooks, patch application against Electron's full source, compilation and native
+acceptance remain pending.
+
+The controlled tagged bootstrap completed on2026-10-14 with exit0. Chromium
+`152.0.7977.130` resolved to
+`2c592105bbcd9490a9894df48d0fe59b2c512651`; Git reports a shallow repository.
+Electron's pinned nested checkout was preserved. The backport's `git apply
+--check` also passed against this **complete pristine Chromium checkout**.
+Electron's dependency synchronization and native patch hooks have not yet
+completed, so this does not replace the required check after Electron patches.
+The bootstrap wrapper is `artifacts/native-build/run-bootstrap.mjs`; its log is
+`bootstrap.log`. Initial fetch transferred a1.43GB pack; free disk after checkout
+was259.3GiB. No compiler or native test was executed at this milestone.
+
+The first dependency-sync attempt after bootstrap attempted a broad Chromium
+remote fetch because the DEPS revision was a textual tag. That owned process
+tree was explicitly stopped; its terminal exit was1. The matching local tag
+was installed and the wrapper now overrides `src` with the exact existing
+commit above, without modifying DEPS. The next run advanced into dependencies:
+Node's `v24.21.0` checkout completed at
+`955266bfdd854cd280dffd47548673914484e4c0`, followed by other Chromium
+dependencies. At this documentation snapshot the bounded dependency run is
+still active: dependency completion, patch hooks and compilation are **not
+verified**. Gclient initial dependency clones may still fetch full histories
+despite the shallow option; the disk floor and run deadline remain mandatory.
+
+The same dependency sync was subsequently stopped deliberately to free resources
+for failed application-test diagnosis. Its terminal exit was1; the owned process
+tree was verified and stopped, without starting another sync. Chromium, Electron
+and Node pins remain unchanged. Dawn, DevTools, ICU and Ink checkouts are present;
+V8 and WebRTC dependency checkouts are still absent. Free disk at this checkpoint
+was246.2GiB. This is a resumable preparation checkpoint, not a completed build.
+
+### Missing ATL/MFC: explicit administrator step
+
+Inspection found the existing installer at
+`C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe`, version
+4.10.30.62513. Its Authenticode status was **Valid**, signer Microsoft Corporation.
+Existing installation:
+`C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools`.
+The official required component ID is
+`Microsoft.VisualStudio.Component.VC.ATLMFC`.
+
+The current agent process is not elevated. No UAC bypass or installer launch was
+attempted. To install only this missing component, a user can run the following
+in an **administrator PowerShell** and allow the normal installer flow:
+
+```powershell
+& 'C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe' modify `
+  --installPath 'C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools' `
+  --add Microsoft.VisualStudio.Component.VC.ATLMFC --passive --norestart
+```
+
+Verify afterward using `vswhere.exe -products '*' -requires
+Microsoft.VisualStudio.Component.VC.ATLMFC -property installationPath`.
+Treat installer exit3010 as restart required; do not claim build readiness until
+the component is detected and toolchain checks pass.