{"op":"mcmaster_discover","sessionId":"<current 32-hex runtime epoch>","target":{"documentId":"<current opaque d:... ID>"}}

# Native McMaster discovery and read-target classification

R15 is based on the exact frozen R14 product manifest in `BASELINE-R14-PRODUCT-FREEZE1.txt` (SHA256 `01f0c503e58894d36c12b4de94e2acbbf3cc2e6aa6938d15283fbfb908139864`). Prior checkpoints are unchanged. This slice adds Rust read-only command discovery and typed document-selector refusal. It does not add supplier command execution, downloads, purchased-part insertion, material assignment, or full legacy parity.

Send `POST /v1/mechanical` with authenticated current transport epoch and `X-Adom-Mechanical-Contract: native-purchased-discovery-v1`:

```json
{"op":"mcmaster_discover","sessionId":"<current 32-hex runtime epoch>","target":{"documentId":"<current opaque d:... ID>"}}
```

The optional `target.revision` must match a prior discovery result. Target keys are limited to `documentId` and `revision`; active-document/name/index fallback is unavailable. `sessionId` is required even though this is a read. The operation takes no journal claim and creates no operation-history record. Existing operations still accept their original headers; the new header also accepts them. `mcmaster_open` and `cad_import` remain unsupported before queue/journal admission.

Rust requests two complete equal typed observations. The adapter reads the exact target's `Design.designIntent()` and looks up only `InsertMcMasterCarrComponentCommand` through `Application.userInterface().commandDefinitions().itemById(...)`. If present, its ID must equal that literal and `isNative()` must be true; its name must have at most4096 UTF-8 bytes and no NUL. Unknown intent values are refused. Registration can be absent without being an SDK error. No enumeration of all command definitions, execute call, GUI interaction, download, design conversion, activation, network request or material access occurs.

The result includes `target`, `revisionScope`, `commandId`, `available`, nullable `name`/`definitionIsNative`, `designIntent` (`part`, `assembly`, `hybrid`), `designIntentCode`, and `hybridTarget`. `available` means registered native command definition only. It never means the command applies to this target or the supplier is online. Explicit execution/download/applicability/online flags remain false. Requirements report hybrid design, supplier access and interactive selection. The revision is a SHA256 projection over current epoch, exact opaque document ID, intent and registration fields; it is not a model/geometry revision or durable command identity. A changed two-read projection fails; there is no stabilization retry.

The legacy reference is `exploded-preview-preparation/runtime-dev9-build-r1/source/addin/AdomBridge/commands/mechanical/purchased.py` functions `mcmaster_discover` and `mcmaster_open`. This port preserves the exact legacy command ID while distinguishing discovery from launch. Installed SDK headers used for the typed adapter: `Core/UserInterface/CommandDefinitions.h` (`itemById` returns null if missing), `CommandDefinition.h` (`id`, `name`, `isNative`), and `Fusion/Fusion/Design.h`/`Fusion/FusionTypeDefs.h` (`designIntent`, preview values0/1/2). The hidden applicability getter is intentionally not used. Immediate SDK errors are observed once with bounded ABI stage/code/text; no error reset is introduced. The adapter retains that diagnostic in its internal error, while the existing HTTP unknown-read path returns the generic `native_inspection_unavailable` response. Publishing richer bounded HTTP diagnostics remains a separate improvement.

Read-only target selection now distinguishes proven malformed IDs, foreign runtime epochs, never-published IDs and retired IDs. Error codes are `native_document_target_malformed`, `native_document_target_foreign_epoch`, `native_document_target_not_registered` and `native_document_target_retired`. Their HTTP400 result includes `readTargetRefused:true`, `readBackendInvoked:false`, `nativeExecutionStarted:false`, and `reconciliationRequired:false`; it does not invent an operation terminal or `not_executed` history record. Malformed/foreign/cached-absent IDs require no SDK call. A current ID removed during a successful full registry refresh is also refused before the operation backend, although that refresh necessarily performed registry SDK reads. Failed/incomplete refresh and backend errors remain unavailable/unknown rather than being relabeled as retirement. Write/effect paths still use their existing guarded `with_document` flow.

Meaningful checks cover bounded command registration, absent commands/all intents, two-pass changes and both failure positions, stale and document/epoch-bound revisions, pre-backend argument refusals, zero SDK/material-backend calls for known selectors, newly observed retirement, fault preservation, and actual authenticated loopback routing. The socket test proves old-header and unsupported-launch refusal before wake/queue, read-only task admission with the new header, and no operation journal record. Unit fixtures are not independent proof that the installed McMaster command is registered or available in a live Fusion build; actual Windows SDK build and read-only app qualification are still required.

Freeze2 now includes the separately reviewed M12-fix2 profile-getter ordering correction through exact copies and narrow merges. Parent authorized source integration/build work while actual-app qualification remains pending; the propagation receipt binds its source and preserved newer capabilities. Existing unknown operations remain untouched. The read-only client cannot qualify extrusion effects.