Native occurrence placement qualification client

Standalone Rust protocol verifier for R21's assembly contract plus operation-specific native-root-occurrence-translation-v1 header. One new task document, two empty native component definitions, three identity occurrences (A, B, shared A), and two local metadata updates. Then only the third occurrence moves to absolute root positions [25,-10,5] mm and [-5,20,10] mm, with one captured position per move. Complete pose, sibling and component preservation, explicit two-stage acknowledgments, pending false/true/false, snapshot membership/health and timeline increments are required. The second position replaces rather than adds to the first. The verifier separately checks every native add/set acknowledgment, retained identities, complete supported resource counts, JSON metadata encoding, shared quantities, purchasing flags, final published readback, durable records, stale refusal and known-success replay/conflict without SDK dispatch. A read through the prior dimension contract checks additive compatibility.

Invoke once with fusion-native-placement-verifier RUNTIME_JSON AUTHORITY_JSON NEW_RECEIPT_DIRECTORY. All paths are local to the runtime host; output must be new and absolute. Root separately establishes the exact Windows process lifetime, source/DLL hashes and current document roster. This executable validates runtime bytes/PID/epoch and authority binding but does not itself query Windows process creation time.

Authority has exactly these fields: schemaVersion:1; purpose:r21-native-placement-qualification; pid; epoch; processCreationTime100ns (decimal string); runtimeSha256 (exact file bytes); baselineSha256 (compact serde_json of runtime.before, insertion order preserved); campaignId (8..32 ASCII alphanumeric); baselineDocumentCount:1..3; priorTaskDocumentIds (0..2 unique, separately root-proven prior task IDs); fixture:two-definitions-three-occurrences-two-translations-v1; and true booleans allowCreateOneTaskDocument, allowTwoNativeComponentDefinitions, allowOneSharedOccurrence, allowTwoLocalMetadataUpdates, allowTwoAbsoluteOccurrenceTranslations and allowTwoPositionSnapshots (17 fields total). Runtime baseline must contain one pristine unsaved Untitled blank plus the authorized modified task documents, with exactly one active document. Metadata preservation excludes the expected active-flag change; it is not a geometry-wide preservation proof.

The request table is initialized privately after exact authority validation. Only fixed authored effects and known-success replay/conflict variations can be sent. No arbitrary operation, original-document mutation, online-metadata read, import/export, close, activation, cleanup, host call or screenshot is exposed. Stops after any uncertain/unsettled effect; no automatic retries. A pre-admission refusal requires a fresh successful exact empty journal lookup. Durably not-executed stale writes are distinct from unknown outcomes. Literal parsed response bodies are preserved before interpretation; unparseable responses preserve bounded error text. Every intent/result uses exclusive receipt creation and sync.

Hard limits: 112 requests, 300 seconds total, absolute 8-second exchange capped by campaign deadline, 2 MiB response. The successful campaign confirms eight distinct operations. Five deliberate known-success replay/conflict pairs must leave dispatch counters unchanged. All IDs come from this runtime and its exact newly returned task document.

This client is authored independently of the product implementation, but it observes product responses. A separate public-SDK observer is required for independent model truth. Online part number/description, BOM traversal/export, populated physical components, nested/external assemblies, rotation/general placement, solver constraints, rendering and full legacy parity remain unqualified. Test models remain for independently authorized archival/reopen/retirement; this client never grants cleanup authority.

The exact frozen 12-file C20 freeze2 baseline is archived under evidence/baseline-source with BASELINE-C20-FREEZE2.txt (SHA256 2fb37d2a9ba6e4988e6ff8119e75f7d0b82b777a6686e429d8d80739322fe0d4). Transport, durable-envelope and digest checks are inherited. Product code is not a dependency; only mechanical wire/schema core is. Source and dependency manifests must be frozen and independently reviewed before Windows/live use. serde_json preserve_order and float_roundtrip preserve baseline hashing and numeric receipts.

The inherited C20 freeze2 corrected centralized read epoch admission found by independent review. Dynamic reads require the exact runtime epoch; static capabilities may omit epoch but any present epoch must match. A mismatch latches uncertainty before any later effect/socket request. Freeze1 source and blocked review remain preserved.

Placement refuses old headers, axis/angle or grounding fields, foreign references, stale revisions and no-op positions. Protocol receipt verification does not replace independent SDK pose observations or semantic archive/reopen verification. Those remain separate gates.