[timomak]

Summary

• advances the execution contract from P00-R8 to the authorized packet-only P00-R9 correction
• remediates release-blocking P00-R8-B01 / active-anchor-run-id-contradiction: the closed immutable active anchor excludes runId, while the prior admission clause incorrectly required that later per-invocation value inside it
• defines a separate closed, non-selecting run-binding.json created only after controller-owned immutable-anchor selection, with exact CSPRNG identity derivation, exclusive root creation, controller ownership, JCS schema, descriptor validation, collision/crash/re-arm behavior, terminal binding, and final canonical reopen
• preserves the complete P00-R8 controller trust boundary, P00-R7 threat model, every unrelated packet contract, all frozen inventories, and the unchanged 401-byte P12 command row

Finding disposition

P00-R8-B01 / RELEASE_BLOCKING / active-anchor-run-id-contradiction

P00-R9 now requires:

1. the closed active-anchor schema contains no current runId; only arm-phase installs the anchor, and verify-phase never rewrites, augments, repairs, replaces, or re-arms it;
2. after independently selecting and validating the immutable active anchor and live PR head, the controller generates exactly 16 CSPRNG bytes encoded as 32 lowercase hex characters;
3. the run root is derived only from anchored commit/phase plus that generated ID and is exclusively created; collision, CSPRNG failure, unsafe ancestry, or metadata disagreement fails before candidate spawn and no existing or partial root is adopted;
4. canonical run-binding.json has exactly schemaVersion, kind, runId, anchorSha256, candidateCommitSha, phase, role, and createdAt; every repeated value must match the held anchor, and the binding is never selection authority;
5. the controller freezes the binding as controller-owned mode 0400, link-count-one, ACL/flag/write-free evidence, retains its descriptor, validates it before spawn and after each child group, and binds its digest into closed success/failure terminal records;
6. the phase/role anchor-slot lock prevents concurrent re-arm; any forced slot replacement or live-head drift fails final reopen; success is created only after canonical descriptor/byte/metadata revalidation and zero survivors;
7. controller crash or partial terminal state is non-accepting and never resumed/repaired/reused;
8. P12's three reporter invocations receive distinct controller IDs/bindings with terminal vector failure/success/success while preserving the existing qualification UUIDs, package/statement/evidence identity, producer counts, and exact aggregate vector 1/0/0.

The binding references the already-authoritative anchor digest. It is not a second candidate, checkout, plan, toolchain, role, writable-root, or evidence-root selector.

Identity and scope

• authority checkpoint: 63c550808a6623c6c4fba9c538514243989b8d1e
• finding: P00-R8-B01
• PR base branch / planning base: main / 9dcb4b2d39607273a8528a24657cdb4f5bfc3412
• P00-R8 parent: ce5e6ae533b65cde6d7996ec572c6d35315b5bde
• P00-R9 head: 02ee6ddec78d6e4ea9e2de3c0303ffd6bc9f45bf
• exactly one changed path: docs/implementation/phase-execution-packet.md
• design.md remains byte-identical, SHA-256 31819873972e1bc02650a1d6bfab1c7f8c687647a19731aa3881e0d71f7fe64a
• direct child and non-force fast-forward to existing phase/P00-execution-packet
• no product/test/workflow/dependency/lockfile/release-artifact/orchestration-ledger edit

Mechanical and structural proof

• changed-path gate and git diff --check: PASS
• structural/adversarial checker: 36/36 assertions
• frozen inventories: 12 phases; 117 criteria / 117 named-test owners; 96/96 decisions; 11 migrations; 40/40 prototype paths; phase DAG 12 nodes / 18 edges / 0 cycles; 25 bash blocks; 13 reporter plans; 15 controller invocation rows; 0 authoritative package-owned launcher rows; 13 hostile cases; 9 evidence members; 4 bundle members; evidence DAG 16 nodes / 28 edges / 0 cycles
• P12 command row: byte-for-byte unchanged, 401 bytes, SHA-256 9b7918fd7f37c56c2c265ac45a22cbae62d654a1090e59d847f3009920357f24
• closed-binding model: 3 valid distinct controller bindings; 8/8 invalid schema/identity variants rejected
• lifecycle model: collision, crash-before/after-binding, concurrent re-arm, forced slot replacement, and final reopen all fail closed
• P12 model: controller terminal vector failure.json, success.json, success.json; aggregate vector 1/0/0; qualification UUID schema unchanged
• current revision scan: all 18 execution/prompt/review references use P00-R9; the sole P00-R8 mention is the historical source-revision sentence
• Markdown check: pinned markdownlint-cli2@0.19.0 reports the exact inherited baseline, 343 findings before and after (MD013 231/231; MD060 112/112), so this revision adds zero Markdown findings

Authoring-check disclosure

No product test or controller binary was run: this is a one-document execution-contract correction. Checker iterations are disclosed rather than hidden:

1. the first inline structural checker stopped on an over-broad named-case regex; correcting checker logic only produced no packet change;
2. the next checker stopped because its crash-semantics assertion did not account for Markdown line wrapping; correcting that assertion only produced no packet change;
3. the final structural checker passed 36/36, followed by the independent binding/lifecycle model and baseline-equivalent Markdown check above.

Review requirement

Fresh P00/review-9 is mandatory against exact SHA 02ee6ddec78d6e4ea9e2de3c0303ffd6bc9f45bf. Review must independently verify the one-path diff, byte-identical design.md, immutable anchor exclusion, closed non-selecting binding schema, creation/ownership/descriptor lifecycle, collision/crash/re-arm/final-reopen behavior, P12 three-run separation, every frozen inventory, exact [7,0] negative-control contract, PR identity/checks, and absence of unresolved actionable feedback.

Do not merge this draft PR until the controller records the required exact-SHA review disposition.