Guard native patch targets and document verified WebRTC backport preparation

docs/native-runtime/README.md

@@ -177,6 +177,109 @@ and Node pins remain unchanged. Dawn, DevTools, ICU and Ink checkouts are presen
 V8 and WebRTC dependency checkouts are still absent. Free disk at this checkpoint
 was246.2GiB. This is a resumable preparation checkpoint, not a completed build.
 
+A subsequent bounded resume has checked out WebRTC at
+`6f37672d358475cd17544121a12494da454d85fb` and V8 at
+`fedd021b538607860f9c56e5c193ad8dcd4f2bb1`, each verified against its own Git
+root. A read-only snapshot found all nineteen required patch targets present
+and tracked-clean, with no patch imports yet. The post-import verifier's real
+negative control rejected all nineteen unpatched targets as expected. Ignored
+evidence: `artifacts/native-build/patch-readiness.json` and
+`patch-import-negative-control.json`. At this checkpoint synchronization is
+still active on VK-GL-CTS and WebGPU CTS; this was not full dependency completion,
+patch applicability, compilation or native acceptance.
+
+That same resume subsequently terminated with exit1 (`stopped:false`): Windows
+antivirus rejected CIPD package `chromium/third_party/updater/chrome_win_x86`,
+instance `NuXBEfKu8082d55WUbs6_3P0puTPCI4A1Df4BnQ1Z40C`, during fetch/install.
+This is a measured security-tool rejection, not a timeout or a completed sync.
+No antivirus exception, disabling, bypass or package retry was performed.
+Compilation remains unverified. The existing Git sources can be independently
+rechecked for the targeted Python patch import, which neither installs that
+package nor proves complete dependency readiness.
+
+The subsequent official patch import used normal host Python after the isolated
+embedded interpreter failed before entering patch code. The official import
+then terminated with exit1: the excluded `fontconfig` directory existed without
+its own Git root, so its target fell back to Chromium during parallel import.
+Its Git-Am invocation failed against Chromium's active import and overwrote
+Chromium's upstream patch references. Chromium has272 commits relative to the
+saved pristine baseline and no remaining Git-Am directory, but its overwritten
+references count only268 commits. This discrepancy is a real failed gate, not
+an accepted successful import. Preserve the original log and verification
+failure; verify the complete ordered series against the saved baseline before
+considering an explicit, evidence-backed reference repair. No reset, abort,
+patch replay or automatic reference repair has been performed at this checkpoint.
+
+The ordered-series verification subsequently proved all272 Chromium patches and
+all eighteen other required repositories. Each of the thirteen modified parent
+Gitlinks was checked against its registered, independently verified child's
+actual HEAD, own Git root and stage0 mode160000 entry; arbitrary source changes
+remain rejected. Only the two corrupted upstream references remained invalid.
+An explicit atomic compare-and-swap repair then restored both references to
+`2c592105bbcd9490a9894df48d0fe59b2c512651`, requiring their observed old value
+`619d23e60466caaa2b5f35e16f15a255b5c09ffa`. Chromium HEAD stayed
+`b33e21917a1ce686ca6134585cdaca88eaadf9f6`. A first transaction failed due to CRLF
+stdin; a synthetic/no-op protocol check proved literal LF bytes necessary, and
+the corrected start/prepare/commit transaction exited0. Original failures and
+both transaction journals remain retained. No patch replay, source reset or
+dependency staging occurred. The fresh post-repair verifier then passed all
+nineteen required targets with the thirteen explicitly matched Gitlinks, and
+`git apply --check` for the backport exited0 against Electron-patched Chromium.
+Evidence: `artifacts/native-build/patch-import-verification-post-cas.json` and
+the retained recovery journal. This proves combined source applicability, not
+a compiled or runtime-verified fix.
+
+The verified backport was then applied with `git apply --index` and committed as
+`6f8b80fef13bfdc9d9c70df567ebcad722d70467`, parent
+`b33e21917a1ce686ca6134585cdaca88eaadf9f6`, in the ignored native source checkout.
+Exactly the sixteen expected files were staged; no dependency Gitlinks were
+included. Thirteen structural source assertions passed, the index is clean and
+both official upstream references remain unchanged. The single-commit mailbox
+`artifacts/native-build/backport-applied.patch` has SHA256
+`070ece6ffbd5723aa8bb0c7e94f855c931be2b2277a6e69b5908cabb5881343b`;
+`backport-applied-journal.json` records provenance and exact files. This source
+checkpoint remains **uncompiled and runtime-unverified**. The shipped project
+runtime is unchanged; source assertions cannot substitute for the native gates.
+
+### Patch readiness before compilation
+
+ATL/MFC is required for the native toolchain, not for the Python patch import
+or a combined-source text check. After dependency synchronization is terminal,
+verify each required Windows repository's own Git root, pinned revision and clean
+working tree; `git -C <directory> rev-parse HEAD` alone can accidentally resolve
+the parent Chromium repository when a dependency has not yet checked out.
+
+The pinned official DEPS hook invokes the following action from
+`artifacts/native-build/electron44`:
+
+```powershell
+python3 src/electron/script/apply_all_patches.py src/electron/patches/config.json
+git -C src apply --check C:/Users/karl/Safetynet/docs/native-runtime/chromium-152-webrtc-binder-backport.patch
+```
+
+This identifies the upstream action; **do not rerun its unfiltered twenty-target
+config on Windows** after the measured ancestor collision. For a fresh checkout,
+first run `scripts/native-patch-preflight.mjs`, explicitly verify the Linux-only
+fontconfig exclusion, and use a reviewed config containing only the nineteen
+required targets with the same official Python importer. Never replay imports
+over an already patched tree. The hook does not invoke compilation.
+Its exit code is insufficient evidence: missing repositories are skipped with
+warnings. Verify imports and upstream references for each required target in
+`patches/config.json`. In this pinned checkout, nineteen targets are required:
+despite their names, `squirrel.mac` and `ReactiveObjC` are synchronized under
+`process_deps`, without a macOS condition. Only `fontconfig` is excluded by its
+Chromium `checkout_linux` condition. Do not infer exclusions from directory names.
+Save each repository's pre-import HEAD. Both the legacy and checkout-specific
+upstream references must resolve to that commit, and it must be an ancestor of
+the resulting HEAD. Compare imported commit counts and ordered subjects with
+the repository's `.patches` list. Reference existence alone is insufficient:
+the importer writes references before `git am`, which can subsequently fail.
+Do not blindly rerun the hook after partial failure or reset conflicting hunks.
+Seven existing Chromium patches touch backport paths, so the earlier pristine
+check does not prove compatibility with Electron's patches. Full `runhooks`, GN,
+compilation and native transport acceptance remain separate gates. The backport
+addresses denial stability; it does not provide WebRTC content inspection.
+
 ### Missing ATL/MFC: explicit administrator step
 
 Inspection found the existing installer at