Index changes.

1 source commit

1. 2c7efdda
   Problem: Intelligent-Tiering pages remain outside the shared read family

   ListBucketIntelligentTieringConfigurations is tracked by the pinned S3 model but lacks executable client and signed-corpus coverage. Implementing its continuation, bounded XML decoding, composable ownership, and evidence registration independently would repeat the same paginated read mechanics and leave future operations vulnerable to drift.

   Solution: Qualify Intelligent-Tiering through the paginated REST/XML family

   Add the model-verified Intelligent-Tiering page decoder and provider-centric synchronous and composable calls over the shared state machine. Register reviewed absence, continuation, exclusion, signed-socket, generated-negative, qualification, coverage, and documentation evidence while keeping page traversal caller-owned and preserving existing ownership, cancellation, bounds, and no-retry semantics.

1 source commit

1. 77811f75
   Problem: inventory pages remain outside the shared read family

   ListBucketInventoryConfigurations is tracked by the pinned S3 model but has no provider-owned one-page client or executable qualification. Callers cannot use the reviewed paginated configuration-read state machine for inventory pages, and the coverage ledger remains partial.

   Solution: qualify inventory pages through the shared family

   Add the strict page projection, exact low-level request and decoder, provider-owned synchronous and composable overloads, and typed Finish over the existing bounded state machine. Record the reviewed decisions in the operation manifest and regenerate model-derived negative XML, signed-socket, coverage, test-registration, and documentation evidence.

1 source commit

1. 21a19c53
   Problem: bucket metadata reads remain outside the shared read family

   GetBucketMetadataConfiguration is inventoried but lacks an executable provider-owned client, strict complete model projection, and generated qualification evidence. Callers cannot compose or synchronously read the current metadata destination and table state through the shared owner-driven transport, and the coverage ledger remains partial.

   Solution: qualify the complete bucket metadata read

   Add strict model-preserving metadata result types and decoding, exact low-level request, execute, and composable forms, and provider-owned limited, restart, Finish, and synchronous overloads over Bounded_REST_XML_Reads. Record reviewed endpoint and error policy and generate signed and negative evidence for the complete reachable shape graph.

1 source commit

1. d2781ffc
   Problem: Object annotation listings lack a qualified provider-owned client path

   The pinned S3 model tracks ListObjectAnnotations, but the client and signed
   corpus remain partial. The shared paginated REST/XML family only accepts
   flattened items and fixed page scalars, which would otherwise force this
   wrapper- and header-bearing object read to duplicate transport ownership and
   qualification plumbing.

   Solution: add ListObjectAnnotations through the shared read families

   Extend the internal paginated and bounded read families with explicit reviewed
   container, scalar, and same-response header hooks. Add the strict annotation
   codec, exact low-level preparation, provider-owned synchronous and composable
   forms, model-generated negative cases, and signed socket qualification. Update
   the evidence registry and greedy URI-label verifier while preserving caller-
   selected limits, read-only certainty, restart ownership, and typed Finish.

2 source commits

1. d5d4cbb2
   Problem: Repetitive mutation mechanics slow S3 client coverage

   Each REST/XML mutation currently duplicates one-shot source handling, bounded response collection, child drain, cancellation, restart, and Finish mechanics. The signed-socket registry also assumes bodyless requests, so new mutation qualification requires bespoke synchronization and cannot verify the exact signed payload hash.

   Solution: Add shared nonreplaying mutation infrastructure

   Introduce an internal generic that centralizes only transport and ownership mechanics while leaving serialization, admission classification, reconciliation, and public policy in reviewed provider actuals. Extend the pinned-model signed-socket generator to derive and verify request bodies and payload hashes, reject collisions with derived headers, and support mutation plans without response-XML negative templates.

2. 6fb5f95a
   Problem: Metrics replacement remains outside the qualified client surface

   PutBucketMetricsConfiguration has no exact prepared, synchronous, or provider-owned composable API despite its Get/List/Delete siblings being qualified. PutBucketReplication also retains a private copy of the same mutation lifetime machinery, leaving the new family without a retrospective equivalence canary.

   Solution: Qualify metrics replacement through the shared family

   Add strict bounded metrics serialization, exact id-query preparation, one-shot low-level execution, and provider-centric Set_Metrics_Configuration overloads with typed certainty and caller-directed reconciliation. Migrate PutBucketReplication onto the shared family without changing its public API or normalization, and add model-derived deterministic and signed-socket evidence for low-level, synchronous, composable, restart, duplicate-header, and bounded-response lanes.

1 source commit

1. 1193aa33
   Problem: Analytics replacement remains outside the qualified composable surface

   PutBucketAnalyticsConfiguration has no provider-owned operation, typed Finish path, or executable signed qualification. Callers cannot compose analytics replacement with the existing Get/List/Delete vocabulary, and the shared mutation preparer incorrectly conflates a required present-empty configuration id with absence.

   Solution: Route analytics replacement through the shared mutation family

   Add exact bounded analytics serialization, operation-specific low-level preparation and pre-admission checks, and provider-owned limited, restartable, typed, and synchronous forms over the existing one-shot REST/XML mutation state machine. Preserve conservative admission certainty and read-only reconciliation, retain present-empty modeled ids, and register deterministic and signed-socket evidence without introducing execution-policy defaults.

1 source commit

1. 0bf21f8c
   Problem: PutBucketIntelligentTieringConfiguration lacks complete client coverage

   Callers cannot use the intelligent-tiering configuration mutation through the provider-owned synchronous and composable API, and sibling analytics and metrics mutation qualifiers collapse conclusive authentication, authorization, and absence failures into a generic invalid-request result.

   Solution: add the shared-family mutation operation and preserve typed rejections

   Add strict intelligent-tiering XML serialization, low-level preparation, provider-centric synchronous/composable/restart/Finish lanes over the shared mutation state machine, signed and deterministic executable evidence, and generated coverage registration. Keep the request body one-shot and non-rewindable, prohibit replay, preserve conservative outcome certainty, and correct the sibling signed qualifiers to retain conclusive typed failures.

8 source commits

1. 08c974f8
   Problem: S3 operation scaffolding cannot emit strict model-derived codecs

   Future routine operations still require handwritten XML structure validation and lack one lossless operation-level inventory of implementation mode, generation eligibility, and executable evidence. That keeps review spread across many files and risks treating declarations as coverage.

   Solution: add strict codec generation and a reviewed generation registry

   Upgrade the 116-operation registry without changing existing Ada implementations, add deterministic inventory and documentation outputs, introduce a private shared strict XML runtime with caller-owned limits, and teach the uv scaffold to emit guarded generated descriptors only after human decisions are resolved.

2. b2dd0fa6
   Problem: generated XML mechanics lack a non-destructive semantic canary

   A prospective generator can be deterministic while still drifting from the reviewed provider API, strict Website codec, typed Finish lanes, or executable evidence. Replacing the existing handwritten operation would hide that distinction.

   Solution: verify prospective Website output against authoritative sources

   Generate a normalized GetBucketWebsite canary that hashes the untouched handwritten implementation, compares model, XML-negative, signed-socket, API, lifecycle, and coverage evidence, and records prospective descriptor hashes without committing or adopting that descriptor.

3. 634f81b8
   Problem: Signed read qualification repeats operation-lifetime mechanics

   Each bounded REST/XML read carries another Ada executable that repeats environment decoding, client setup, completion-set driving, typed Finish, restart, cancellation drain, and shutdown. This expands handwritten review surface even though only preparation and typed result observation differ by operation.

   Solution: Add a shared typed signed-socket read driver

   Introduce a test-only generic that owns the invariant low-level, synchronous, composable, restart, cancellation/drain/reuse, and cleanup lanes while retaining operation-specific typed callbacks. Allow the loopback runner to target a prospective adapter without replacing the committed authoritative adapter, and document the generated-versus-human boundary.

4. 197ab0e4
   Problem: Deprecated S3 reads appear eligible for generation

   The retrospective registry marks GetBucketLifecycle and GetBucketNotification as generator candidates even though the pinned model deprecates them and the maintained compatibility contract names their Configuration replacements. A scaffold could therefore create public APIs the repository intentionally excludes.

   Solution: Record the deprecated-operation exclusions

   Mark both legacy reads ineligible, remove their unresolved generation blocks, and regenerate the inventory, counts, and documentation without changing their preserved partial coverage state or generated-model provenance.

5. 490d7660
   Problem: Generated XML codecs omit modeled string patterns

   New S3 operations can carry Botocore string-pattern constraints that the strict descriptor runtime does not represent. Silently accepting those values would make generated codecs weaker than the pinned model and could admit malformed provider responses.

   Solution: Add fail-closed exact pattern validation

   Teach the generator and shared strict runtime to validate the modeled S3 and S3 Express bucket ARN domain, reject all unsupported pattern forms during generation, document the boundary, and cover the directory-bucket descriptor plus the no-enum generation edge case. Regenerated canary evidence records the expanded strict contract without replacing any handwritten operation.

6. b17b81cd
   Problem: Generated provider glue risks owning handwritten packages

   New operations must add public declarations and bodies to provider-centric parent packages, but treating those large packages as generated output would make existing reviewed operations vulnerable to unrelated churn.

   Solution: Materialize only delimited generated regions

   Add a deterministic source-region materializer that inserts or replaces one uniquely balanced generated block while preserving every surrounding byte. Reject missing anchors, duplicate markers, and unbalanced regions, cover insertion and replacement with negative oracles, and document the handwritten/generated ownership boundary.

7. 5d8a6921
   Problem: Paginated reads cannot carry collection policy

   The bounded REST/XML read family transports document limits but has no place for the distinct caller-selected collection limit required by generated list codecs. Copying its owner-driven lifecycle into every list operation would preserve the repeated mechanical work the automation is intended to remove.

   Solution: Add a shared paginated read family

   Add one provider-neutral family that retains the bounded response sink, child lifetime, cancellation, drain, restart, exception, and typed Finish behavior while carrying an explicit collection limit into response decoding. It introduces no defaults and changes no existing operation.

8. 76e39f44
   Problem: Directory bucket reads still require handwritten client slices

   ListDirectoryBuckets is absent from the client even though its request and strict XML response mechanics are derivable from the pinned Botocore model. Implementing it by hand would repeat low-level, provider, lifecycle, corpus, socket, documentation, and coverage bookkeeping across another large review surface.

   Solution: Generate and qualify ListDirectoryBuckets through the paginated read family

   Extend the authoritative generator to materialize exact low-level and provider-owned Ada regions, a strict bounded XML codec, and deterministic evidence from reviewed manifest decisions. Add the shared typed signed-socket adapter, verify mismatched prepared operations before admission, preserve caller-selected limits and owner-driven restart/cancellation semantics, and register executable coverage without claiming backend or server support.

2 source commits

1. 44636497
   Problem: Generated mutation codecs repeat bounded XML mechanics

   New S3 mutation serializers need strict escaping and caller-selected document, depth, element, and text enforcement. Repeating that machinery in every operation would keep the review surface large and could let model changes silently retain stale typed projections.

   Solution: Add a shared bounded XML writer and model-bound serializer projections

   The internal writer centralizes escaping and explicit resource-limit accounting without defaults. The generator now verifies full reachable-shape digests before emitting reviewed Inventory, Logging, and Website request projections, with deterministic negative oracles and maintainer documentation.

2. eb2e25e9
   Problem: Routine bucket configuration mutations repeat client mechanics

   New REST/XML configuration mutations still require large handwritten low-level, provider, serializer, and signed-socket slices even when their transport and lifecycle semantics match the reviewed shared family. This keeps the remaining S3 backlog expensive to implement and review.

   Solution: Generate three reviewed configuration mutations

   Generate PutBucketInventoryConfiguration, PutBucketLogging, and PutBucketWebsite serializers, exact prepared-operation bindings, provider-centric synchronous/composable/restart APIs, typed Finish results, and typed qualification adapters from one authoritative tool. Keep certainty, no-replay, reconciliation, ownership, cross-field, checksum, and compatibility decisions explicit in the human-owned registry while expanding one reviewed fixture into the common signed matrix.

1 source commit

1. 5eaf79cf
   Problem: ACL mutations still require handwritten operation plumbing

   Future S3 ACL mutation coverage repeats model-derived request serialization, prepared-request binding, provider state-machine glue, and signed-socket qualification. That review surface slows the remaining backlog and risks drift between synchronous, composable, and restart lanes.

   Solution: generate PutBucketAcl from reviewed model and policy inputs

   Extend the deterministic mutation generator with strict ACL XML serialization, modeled headers and checksums, exact-operation admission, provider-centric Set_ACL overloads, typed Finish, and shared qualification evidence. Keep ACL mode selection, certainty, no-replay, reconciliation, cross-field exclusions, and ownership decisions explicit in the human-owned operation manifest.

1 source commit

1. 2c7efdda
   Problem: Intelligent-Tiering pages remain outside the shared read family

   ListBucketIntelligentTieringConfigurations is tracked by the pinned S3 model but lacks executable client and signed-corpus coverage. Implementing its continuation, bounded XML decoding, composable ownership, and evidence registration independently would repeat the same paginated read mechanics and leave future operations vulnerable to drift.

   Solution: Qualify Intelligent-Tiering through the paginated REST/XML family

   Add the model-verified Intelligent-Tiering page decoder and provider-centric synchronous and composable calls over the shared state machine. Register reviewed absence, continuation, exclusion, signed-socket, generated-negative, qualification, coverage, and documentation evidence while keeping page traversal caller-owned and preserving existing ownership, cancellation, bounds, and no-retry semantics.

1 source commit

1. 77811f75
   Problem: inventory pages remain outside the shared read family

   ListBucketInventoryConfigurations is tracked by the pinned S3 model but has no provider-owned one-page client or executable qualification. Callers cannot use the reviewed paginated configuration-read state machine for inventory pages, and the coverage ledger remains partial.

   Solution: qualify inventory pages through the shared family

   Add the strict page projection, exact low-level request and decoder, provider-owned synchronous and composable overloads, and typed Finish over the existing bounded state machine. Record the reviewed decisions in the operation manifest and regenerate model-derived negative XML, signed-socket, coverage, test-registration, and documentation evidence.

1 source commit

1. 21a19c53
   Problem: bucket metadata reads remain outside the shared read family

   GetBucketMetadataConfiguration is inventoried but lacks an executable provider-owned client, strict complete model projection, and generated qualification evidence. Callers cannot compose or synchronously read the current metadata destination and table state through the shared owner-driven transport, and the coverage ledger remains partial.

   Solution: qualify the complete bucket metadata read

   Add strict model-preserving metadata result types and decoding, exact low-level request, execute, and composable forms, and provider-owned limited, restart, Finish, and synchronous overloads over Bounded_REST_XML_Reads. Record reviewed endpoint and error policy and generate signed and negative evidence for the complete reachable shape graph.

1 source commit

1. d2781ffc
   Problem: Object annotation listings lack a qualified provider-owned client path

   The pinned S3 model tracks ListObjectAnnotations, but the client and signed
   corpus remain partial. The shared paginated REST/XML family only accepts
   flattened items and fixed page scalars, which would otherwise force this
   wrapper- and header-bearing object read to duplicate transport ownership and
   qualification plumbing.

   Solution: add ListObjectAnnotations through the shared read families

   Extend the internal paginated and bounded read families with explicit reviewed
   container, scalar, and same-response header hooks. Add the strict annotation
   codec, exact low-level preparation, provider-owned synchronous and composable
   forms, model-generated negative cases, and signed socket qualification. Update
   the evidence registry and greedy URI-label verifier while preserving caller-
   selected limits, read-only certainty, restart ownership, and typed Finish.

2 source commits

1. d5d4cbb2
   Problem: Repetitive mutation mechanics slow S3 client coverage

   Each REST/XML mutation currently duplicates one-shot source handling, bounded response collection, child drain, cancellation, restart, and Finish mechanics. The signed-socket registry also assumes bodyless requests, so new mutation qualification requires bespoke synchronization and cannot verify the exact signed payload hash.

   Solution: Add shared nonreplaying mutation infrastructure

   Introduce an internal generic that centralizes only transport and ownership mechanics while leaving serialization, admission classification, reconciliation, and public policy in reviewed provider actuals. Extend the pinned-model signed-socket generator to derive and verify request bodies and payload hashes, reject collisions with derived headers, and support mutation plans without response-XML negative templates.

2. 6fb5f95a
   Problem: Metrics replacement remains outside the qualified client surface

   PutBucketMetricsConfiguration has no exact prepared, synchronous, or provider-owned composable API despite its Get/List/Delete siblings being qualified. PutBucketReplication also retains a private copy of the same mutation lifetime machinery, leaving the new family without a retrospective equivalence canary.

   Solution: Qualify metrics replacement through the shared family

   Add strict bounded metrics serialization, exact id-query preparation, one-shot low-level execution, and provider-centric Set_Metrics_Configuration overloads with typed certainty and caller-directed reconciliation. Migrate PutBucketReplication onto the shared family without changing its public API or normalization, and add model-derived deterministic and signed-socket evidence for low-level, synchronous, composable, restart, duplicate-header, and bounded-response lanes.

1 source commit

1. 1193aa33
   Problem: Analytics replacement remains outside the qualified composable surface

   PutBucketAnalyticsConfiguration has no provider-owned operation, typed Finish path, or executable signed qualification. Callers cannot compose analytics replacement with the existing Get/List/Delete vocabulary, and the shared mutation preparer incorrectly conflates a required present-empty configuration id with absence.

   Solution: Route analytics replacement through the shared mutation family

   Add exact bounded analytics serialization, operation-specific low-level preparation and pre-admission checks, and provider-owned limited, restartable, typed, and synchronous forms over the existing one-shot REST/XML mutation state machine. Preserve conservative admission certainty and read-only reconciliation, retain present-empty modeled ids, and register deterministic and signed-socket evidence without introducing execution-policy defaults.

1 source commit

1. 0bf21f8c
   Problem: PutBucketIntelligentTieringConfiguration lacks complete client coverage

   Callers cannot use the intelligent-tiering configuration mutation through the provider-owned synchronous and composable API, and sibling analytics and metrics mutation qualifiers collapse conclusive authentication, authorization, and absence failures into a generic invalid-request result.

   Solution: add the shared-family mutation operation and preserve typed rejections

   Add strict intelligent-tiering XML serialization, low-level preparation, provider-centric synchronous/composable/restart/Finish lanes over the shared mutation state machine, signed and deterministic executable evidence, and generated coverage registration. Keep the request body one-shot and non-rewindable, prohibit replay, preserve conservative outcome certainty, and correct the sibling signed qualifiers to retain conclusive typed failures.

8 source commits

1. 08c974f8
   Problem: S3 operation scaffolding cannot emit strict model-derived codecs

   Future routine operations still require handwritten XML structure validation and lack one lossless operation-level inventory of implementation mode, generation eligibility, and executable evidence. That keeps review spread across many files and risks treating declarations as coverage.

   Solution: add strict codec generation and a reviewed generation registry

   Upgrade the 116-operation registry without changing existing Ada implementations, add deterministic inventory and documentation outputs, introduce a private shared strict XML runtime with caller-owned limits, and teach the uv scaffold to emit guarded generated descriptors only after human decisions are resolved.

2. b2dd0fa6
   Problem: generated XML mechanics lack a non-destructive semantic canary

   A prospective generator can be deterministic while still drifting from the reviewed provider API, strict Website codec, typed Finish lanes, or executable evidence. Replacing the existing handwritten operation would hide that distinction.

   Solution: verify prospective Website output against authoritative sources

   Generate a normalized GetBucketWebsite canary that hashes the untouched handwritten implementation, compares model, XML-negative, signed-socket, API, lifecycle, and coverage evidence, and records prospective descriptor hashes without committing or adopting that descriptor.

3. 634f81b8
   Problem: Signed read qualification repeats operation-lifetime mechanics

   Each bounded REST/XML read carries another Ada executable that repeats environment decoding, client setup, completion-set driving, typed Finish, restart, cancellation drain, and shutdown. This expands handwritten review surface even though only preparation and typed result observation differ by operation.

   Solution: Add a shared typed signed-socket read driver

   Introduce a test-only generic that owns the invariant low-level, synchronous, composable, restart, cancellation/drain/reuse, and cleanup lanes while retaining operation-specific typed callbacks. Allow the loopback runner to target a prospective adapter without replacing the committed authoritative adapter, and document the generated-versus-human boundary.

4. 197ab0e4
   Problem: Deprecated S3 reads appear eligible for generation

   The retrospective registry marks GetBucketLifecycle and GetBucketNotification as generator candidates even though the pinned model deprecates them and the maintained compatibility contract names their Configuration replacements. A scaffold could therefore create public APIs the repository intentionally excludes.

   Solution: Record the deprecated-operation exclusions

   Mark both legacy reads ineligible, remove their unresolved generation blocks, and regenerate the inventory, counts, and documentation without changing their preserved partial coverage state or generated-model provenance.

5. 490d7660
   Problem: Generated XML codecs omit modeled string patterns

   New S3 operations can carry Botocore string-pattern constraints that the strict descriptor runtime does not represent. Silently accepting those values would make generated codecs weaker than the pinned model and could admit malformed provider responses.

   Solution: Add fail-closed exact pattern validation

   Teach the generator and shared strict runtime to validate the modeled S3 and S3 Express bucket ARN domain, reject all unsupported pattern forms during generation, document the boundary, and cover the directory-bucket descriptor plus the no-enum generation edge case. Regenerated canary evidence records the expanded strict contract without replacing any handwritten operation.

6. b17b81cd
   Problem: Generated provider glue risks owning handwritten packages

   New operations must add public declarations and bodies to provider-centric parent packages, but treating those large packages as generated output would make existing reviewed operations vulnerable to unrelated churn.

   Solution: Materialize only delimited generated regions

   Add a deterministic source-region materializer that inserts or replaces one uniquely balanced generated block while preserving every surrounding byte. Reject missing anchors, duplicate markers, and unbalanced regions, cover insertion and replacement with negative oracles, and document the handwritten/generated ownership boundary.

7. 5d8a6921
   Problem: Paginated reads cannot carry collection policy

   The bounded REST/XML read family transports document limits but has no place for the distinct caller-selected collection limit required by generated list codecs. Copying its owner-driven lifecycle into every list operation would preserve the repeated mechanical work the automation is intended to remove.

   Solution: Add a shared paginated read family

   Add one provider-neutral family that retains the bounded response sink, child lifetime, cancellation, drain, restart, exception, and typed Finish behavior while carrying an explicit collection limit into response decoding. It introduces no defaults and changes no existing operation.

8. 76e39f44
   Problem: Directory bucket reads still require handwritten client slices

   ListDirectoryBuckets is absent from the client even though its request and strict XML response mechanics are derivable from the pinned Botocore model. Implementing it by hand would repeat low-level, provider, lifecycle, corpus, socket, documentation, and coverage bookkeeping across another large review surface.

   Solution: Generate and qualify ListDirectoryBuckets through the paginated read family

   Extend the authoritative generator to materialize exact low-level and provider-owned Ada regions, a strict bounded XML codec, and deterministic evidence from reviewed manifest decisions. Add the shared typed signed-socket adapter, verify mismatched prepared operations before admission, preserve caller-selected limits and owner-driven restart/cancellation semantics, and register executable coverage without claiming backend or server support.

2 source commits

1. 44636497
   Problem: Generated mutation codecs repeat bounded XML mechanics

   New S3 mutation serializers need strict escaping and caller-selected document, depth, element, and text enforcement. Repeating that machinery in every operation would keep the review surface large and could let model changes silently retain stale typed projections.

   Solution: Add a shared bounded XML writer and model-bound serializer projections

   The internal writer centralizes escaping and explicit resource-limit accounting without defaults. The generator now verifies full reachable-shape digests before emitting reviewed Inventory, Logging, and Website request projections, with deterministic negative oracles and maintainer documentation.

2. eb2e25e9
   Problem: Routine bucket configuration mutations repeat client mechanics

   New REST/XML configuration mutations still require large handwritten low-level, provider, serializer, and signed-socket slices even when their transport and lifecycle semantics match the reviewed shared family. This keeps the remaining S3 backlog expensive to implement and review.

   Solution: Generate three reviewed configuration mutations

   Generate PutBucketInventoryConfiguration, PutBucketLogging, and PutBucketWebsite serializers, exact prepared-operation bindings, provider-centric synchronous/composable/restart APIs, typed Finish results, and typed qualification adapters from one authoritative tool. Keep certainty, no-replay, reconciliation, ownership, cross-field, checksum, and compatibility decisions explicit in the human-owned registry while expanding one reviewed fixture into the common signed matrix.

1 source commit

1. 5eaf79cf
   Problem: ACL mutations still require handwritten operation plumbing

   Future S3 ACL mutation coverage repeats model-derived request serialization, prepared-request binding, provider state-machine glue, and signed-socket qualification. That review surface slows the remaining backlog and risks drift between synchronous, composable, and restart lanes.

   Solution: generate PutBucketAcl from reviewed model and policy inputs

   Extend the deterministic mutation generator with strict ACL XML serialization, modeled headers and checksums, exact-operation admission, provider-centric Set_ACL overloads, typed Finish, and shared qualification evidence. Keep ACL mode selection, certainty, no-replay, reconciliation, cross-field exclusions, and ownership decisions explicit in the human-owned operation manifest.

1 source commit

1. 2c7efdda
   Problem: Intelligent-Tiering pages remain outside the shared read family

   ListBucketIntelligentTieringConfigurations is tracked by the pinned S3 model but lacks executable client and signed-corpus coverage. Implementing its continuation, bounded XML decoding, composable ownership, and evidence registration independently would repeat the same paginated read mechanics and leave future operations vulnerable to drift.

   Solution: Qualify Intelligent-Tiering through the paginated REST/XML family

   Add the model-verified Intelligent-Tiering page decoder and provider-centric synchronous and composable calls over the shared state machine. Register reviewed absence, continuation, exclusion, signed-socket, generated-negative, qualification, coverage, and documentation evidence while keeping page traversal caller-owned and preserving existing ownership, cancellation, bounds, and no-retry semantics.

1 source commit

1. 77811f75
   Problem: inventory pages remain outside the shared read family

   ListBucketInventoryConfigurations is tracked by the pinned S3 model but has no provider-owned one-page client or executable qualification. Callers cannot use the reviewed paginated configuration-read state machine for inventory pages, and the coverage ledger remains partial.

   Solution: qualify inventory pages through the shared family

   Add the strict page projection, exact low-level request and decoder, provider-owned synchronous and composable overloads, and typed Finish over the existing bounded state machine. Record the reviewed decisions in the operation manifest and regenerate model-derived negative XML, signed-socket, coverage, test-registration, and documentation evidence.

1 source commit

1. 21a19c53
   Problem: bucket metadata reads remain outside the shared read family

   GetBucketMetadataConfiguration is inventoried but lacks an executable provider-owned client, strict complete model projection, and generated qualification evidence. Callers cannot compose or synchronously read the current metadata destination and table state through the shared owner-driven transport, and the coverage ledger remains partial.

   Solution: qualify the complete bucket metadata read

   Add strict model-preserving metadata result types and decoding, exact low-level request, execute, and composable forms, and provider-owned limited, restart, Finish, and synchronous overloads over Bounded_REST_XML_Reads. Record reviewed endpoint and error policy and generate signed and negative evidence for the complete reachable shape graph.

1 source commit

1. d2781ffc
   Problem: Object annotation listings lack a qualified provider-owned client path

   The pinned S3 model tracks ListObjectAnnotations, but the client and signed
   corpus remain partial. The shared paginated REST/XML family only accepts
   flattened items and fixed page scalars, which would otherwise force this
   wrapper- and header-bearing object read to duplicate transport ownership and
   qualification plumbing.

   Solution: add ListObjectAnnotations through the shared read families

   Extend the internal paginated and bounded read families with explicit reviewed
   container, scalar, and same-response header hooks. Add the strict annotation
   codec, exact low-level preparation, provider-owned synchronous and composable
   forms, model-generated negative cases, and signed socket qualification. Update
   the evidence registry and greedy URI-label verifier while preserving caller-
   selected limits, read-only certainty, restart ownership, and typed Finish.

2 source commits

1. d5d4cbb2
   Problem: Repetitive mutation mechanics slow S3 client coverage

   Each REST/XML mutation currently duplicates one-shot source handling, bounded response collection, child drain, cancellation, restart, and Finish mechanics. The signed-socket registry also assumes bodyless requests, so new mutation qualification requires bespoke synchronization and cannot verify the exact signed payload hash.

   Solution: Add shared nonreplaying mutation infrastructure

   Introduce an internal generic that centralizes only transport and ownership mechanics while leaving serialization, admission classification, reconciliation, and public policy in reviewed provider actuals. Extend the pinned-model signed-socket generator to derive and verify request bodies and payload hashes, reject collisions with derived headers, and support mutation plans without response-XML negative templates.

2. 6fb5f95a
   Problem: Metrics replacement remains outside the qualified client surface

   PutBucketMetricsConfiguration has no exact prepared, synchronous, or provider-owned composable API despite its Get/List/Delete siblings being qualified. PutBucketReplication also retains a private copy of the same mutation lifetime machinery, leaving the new family without a retrospective equivalence canary.

   Solution: Qualify metrics replacement through the shared family

   Add strict bounded metrics serialization, exact id-query preparation, one-shot low-level execution, and provider-centric Set_Metrics_Configuration overloads with typed certainty and caller-directed reconciliation. Migrate PutBucketReplication onto the shared family without changing its public API or normalization, and add model-derived deterministic and signed-socket evidence for low-level, synchronous, composable, restart, duplicate-header, and bounded-response lanes.

1 source commit

1. 1193aa33
   Problem: Analytics replacement remains outside the qualified composable surface

   PutBucketAnalyticsConfiguration has no provider-owned operation, typed Finish path, or executable signed qualification. Callers cannot compose analytics replacement with the existing Get/List/Delete vocabulary, and the shared mutation preparer incorrectly conflates a required present-empty configuration id with absence.

   Solution: Route analytics replacement through the shared mutation family

   Add exact bounded analytics serialization, operation-specific low-level preparation and pre-admission checks, and provider-owned limited, restartable, typed, and synchronous forms over the existing one-shot REST/XML mutation state machine. Preserve conservative admission certainty and read-only reconciliation, retain present-empty modeled ids, and register deterministic and signed-socket evidence without introducing execution-policy defaults.

1 source commit

1. 0bf21f8c
   Problem: PutBucketIntelligentTieringConfiguration lacks complete client coverage

   Callers cannot use the intelligent-tiering configuration mutation through the provider-owned synchronous and composable API, and sibling analytics and metrics mutation qualifiers collapse conclusive authentication, authorization, and absence failures into a generic invalid-request result.

   Solution: add the shared-family mutation operation and preserve typed rejections

   Add strict intelligent-tiering XML serialization, low-level preparation, provider-centric synchronous/composable/restart/Finish lanes over the shared mutation state machine, signed and deterministic executable evidence, and generated coverage registration. Keep the request body one-shot and non-rewindable, prohibit replay, preserve conservative outcome certainty, and correct the sibling signed qualifiers to retain conclusive typed failures.

8 source commits

1. 08c974f8
   Problem: S3 operation scaffolding cannot emit strict model-derived codecs

   Future routine operations still require handwritten XML structure validation and lack one lossless operation-level inventory of implementation mode, generation eligibility, and executable evidence. That keeps review spread across many files and risks treating declarations as coverage.

   Solution: add strict codec generation and a reviewed generation registry

   Upgrade the 116-operation registry without changing existing Ada implementations, add deterministic inventory and documentation outputs, introduce a private shared strict XML runtime with caller-owned limits, and teach the uv scaffold to emit guarded generated descriptors only after human decisions are resolved.

2. b2dd0fa6
   Problem: generated XML mechanics lack a non-destructive semantic canary

   A prospective generator can be deterministic while still drifting from the reviewed provider API, strict Website codec, typed Finish lanes, or executable evidence. Replacing the existing handwritten operation would hide that distinction.

   Solution: verify prospective Website output against authoritative sources

   Generate a normalized GetBucketWebsite canary that hashes the untouched handwritten implementation, compares model, XML-negative, signed-socket, API, lifecycle, and coverage evidence, and records prospective descriptor hashes without committing or adopting that descriptor.

3. 634f81b8
   Problem: Signed read qualification repeats operation-lifetime mechanics

   Each bounded REST/XML read carries another Ada executable that repeats environment decoding, client setup, completion-set driving, typed Finish, restart, cancellation drain, and shutdown. This expands handwritten review surface even though only preparation and typed result observation differ by operation.

   Solution: Add a shared typed signed-socket read driver

   Introduce a test-only generic that owns the invariant low-level, synchronous, composable, restart, cancellation/drain/reuse, and cleanup lanes while retaining operation-specific typed callbacks. Allow the loopback runner to target a prospective adapter without replacing the committed authoritative adapter, and document the generated-versus-human boundary.

4. 197ab0e4
   Problem: Deprecated S3 reads appear eligible for generation

   The retrospective registry marks GetBucketLifecycle and GetBucketNotification as generator candidates even though the pinned model deprecates them and the maintained compatibility contract names their Configuration replacements. A scaffold could therefore create public APIs the repository intentionally excludes.

   Solution: Record the deprecated-operation exclusions

   Mark both legacy reads ineligible, remove their unresolved generation blocks, and regenerate the inventory, counts, and documentation without changing their preserved partial coverage state or generated-model provenance.

5. 490d7660
   Problem: Generated XML codecs omit modeled string patterns

   New S3 operations can carry Botocore string-pattern constraints that the strict descriptor runtime does not represent. Silently accepting those values would make generated codecs weaker than the pinned model and could admit malformed provider responses.

   Solution: Add fail-closed exact pattern validation

   Teach the generator and shared strict runtime to validate the modeled S3 and S3 Express bucket ARN domain, reject all unsupported pattern forms during generation, document the boundary, and cover the directory-bucket descriptor plus the no-enum generation edge case. Regenerated canary evidence records the expanded strict contract without replacing any handwritten operation.

6. b17b81cd
   Problem: Generated provider glue risks owning handwritten packages

   New operations must add public declarations and bodies to provider-centric parent packages, but treating those large packages as generated output would make existing reviewed operations vulnerable to unrelated churn.

   Solution: Materialize only delimited generated regions

   Add a deterministic source-region materializer that inserts or replaces one uniquely balanced generated block while preserving every surrounding byte. Reject missing anchors, duplicate markers, and unbalanced regions, cover insertion and replacement with negative oracles, and document the handwritten/generated ownership boundary.

7. 5d8a6921
   Problem: Paginated reads cannot carry collection policy

   The bounded REST/XML read family transports document limits but has no place for the distinct caller-selected collection limit required by generated list codecs. Copying its owner-driven lifecycle into every list operation would preserve the repeated mechanical work the automation is intended to remove.

   Solution: Add a shared paginated read family

   Add one provider-neutral family that retains the bounded response sink, child lifetime, cancellation, drain, restart, exception, and typed Finish behavior while carrying an explicit collection limit into response decoding. It introduces no defaults and changes no existing operation.

8. 76e39f44
   Problem: Directory bucket reads still require handwritten client slices

   ListDirectoryBuckets is absent from the client even though its request and strict XML response mechanics are derivable from the pinned Botocore model. Implementing it by hand would repeat low-level, provider, lifecycle, corpus, socket, documentation, and coverage bookkeeping across another large review surface.

   Solution: Generate and qualify ListDirectoryBuckets through the paginated read family

   Extend the authoritative generator to materialize exact low-level and provider-owned Ada regions, a strict bounded XML codec, and deterministic evidence from reviewed manifest decisions. Add the shared typed signed-socket adapter, verify mismatched prepared operations before admission, preserve caller-selected limits and owner-driven restart/cancellation semantics, and register executable coverage without claiming backend or server support.

2 source commits

1. 44636497
   Problem: Generated mutation codecs repeat bounded XML mechanics

   New S3 mutation serializers need strict escaping and caller-selected document, depth, element, and text enforcement. Repeating that machinery in every operation would keep the review surface large and could let model changes silently retain stale typed projections.

   Solution: Add a shared bounded XML writer and model-bound serializer projections

   The internal writer centralizes escaping and explicit resource-limit accounting without defaults. The generator now verifies full reachable-shape digests before emitting reviewed Inventory, Logging, and Website request projections, with deterministic negative oracles and maintainer documentation.

2. eb2e25e9
   Problem: Routine bucket configuration mutations repeat client mechanics

   New REST/XML configuration mutations still require large handwritten low-level, provider, serializer, and signed-socket slices even when their transport and lifecycle semantics match the reviewed shared family. This keeps the remaining S3 backlog expensive to implement and review.

   Solution: Generate three reviewed configuration mutations

   Generate PutBucketInventoryConfiguration, PutBucketLogging, and PutBucketWebsite serializers, exact prepared-operation bindings, provider-centric synchronous/composable/restart APIs, typed Finish results, and typed qualification adapters from one authoritative tool. Keep certainty, no-replay, reconciliation, ownership, cross-field, checksum, and compatibility decisions explicit in the human-owned registry while expanding one reviewed fixture into the common signed matrix.

1 source commit

1. 5eaf79cf
   Problem: ACL mutations still require handwritten operation plumbing

   Future S3 ACL mutation coverage repeats model-derived request serialization, prepared-request binding, provider state-machine glue, and signed-socket qualification. That review surface slows the remaining backlog and risks drift between synchronous, composable, and restart lanes.

   Solution: generate PutBucketAcl from reviewed model and policy inputs

   Extend the deterministic mutation generator with strict ACL XML serialization, modeled headers and checksums, exact-operation admission, provider-centric Set_ACL overloads, typed Finish, and shared qualification evidence. Keep ACL mode selection, certainty, no-replay, reconciliation, cross-field exclusions, and ownership decisions explicit in the human-owned operation manifest.

25 source commits

1. 94c0ee9c
   Problem: DeleteBucketLifecycle cannot join composed client workflows

   The exact lifecycle deletion remains limited to blocking convenience and prepared execution. Callers cannot own it in a completion set, preserve typed admission certainty, or reuse its state without a parallel wrapper.

   Solution: add the provider-owned lifecycle deletion operation

   Add the exact low-level initiator and colocated Client.Buckets constructor, operation-last initiation, typed Finish, and synchronous wait over one non-replaying state machine. Gate certainty, prepared-operation identity, physical headers, response bounds, restart, native/lightweight execution, and document the provider inventory.

2. 571522b3
   Problem: GetBucketPolicyStatus cannot join owner-driven client workflows

   The existing convenience client executes synchronously through its own path, so callers cannot compose the exact signed policy-status read with other provider operations or reuse its operation state safely.

   Solution: colocate a bounded composable policy-status operation

   Add the exact low-level initiator, provider-owned limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Drive the convenience overload through the same bounded state machine, reject malformed singleton headers and over-limit bodies, and qualify the result mapping and native/lightweight socket behavior.

3. 1c0455b9
   Problem: GetBucketRequestPayment cannot join owner-driven client workflows

   Requester-payment reads are available only through the blocking executor, so structured callers cannot own their deadline, cancellation, operation reuse, typed HTTP outcome, and bounded response lifecycle alongside other work.

   Solution: Colocate a bounded composable requester-payment read

   Add exact prepared-request admission, provider-owned limited construction and operation-last restart, typed Finish and synchronous wait, strict header and response bounds, full normalization and loopback corpora, and maintained API documentation. The established convenience call now waits on the same state machine without adding retry or billing-policy interpretation.

4. 6befc49a
   Problem: PutBucketRequestPayment cannot join composed client workflows

   The synchronous requester-payment mutation owns no reusable operation, exposes no admission certainty, and cannot participate in a caller-owned completion set.

   Solution: add a non-replaying provider-owned requester-payment operation

   Add the exact low-level initiator, limited constructor, operation-last restart, typed Finish and synchronous wait over one state machine. Own the signed payer bytes through terminal drain, preserve strict response bounds and headers, classify ambiguous outcomes without replay, and gate the contract with certainty, socket, model, documentation and repository checks.

5. 4664482f
   Problem: PutBucketAbac cannot join composed client workflows

   Callers can only execute PutBucketAbac synchronously, so owner-driven state machines cannot retain typed publication certainty or reconcile ambiguous outcomes without a parallel adapter.

   Solution: add a provider-owned non-replaying ABAC operation

   Expose exact low-level initiation and Client.Buckets limited-constructor, operation-last, typed Finish, and synchronous-wait forms over one state machine. Preserve the serialized status as a one-shot owned source, normalize admission certainty, extend exact-operation and socket corpora, and document the provider inventory and reconciliation contract.

6. cc04da27
   Problem: PutBucketAccelerateConfiguration cannot compose

   Callers can only execute the acceleration mutation synchronously, so owner-driven workflows cannot preserve typed admission certainty or reconcile ambiguous publication without a separate adapter.

   Solution: add the provider-owned acceleration operation

   Expose the exact one-shot low-level initiator and Client.Buckets limited-constructor, operation-last, typed Finish, and synchronous-wait forms over one state machine. Preserve the model's no-Content-MD5 rule, normalize mutation certainty, extend exact-operation and socket corpora, and document read reconciliation and the updated provider inventory.

7. 062f8119
   Problem: GetBucketAbac cannot join reconciliation workflows

   Callers can read the optional ABAC state only through a blocking convenience call, so a possibly admitted PutBucketAbac cannot compose its read-only reconciliation with other owner-driven operations. The low-level prepared-request boundary also has no exact reusable initiator for this operation.

   Solution: add one provider-owned bounded GetBucketAbac state machine

   Add the exact Low_Level initiator, limited constructor, operation-last reusable form, typed Finish, and typed synchronous wait in Client.Buckets. Drive the convenience call through that same state machine, preserve the caller-selected XML bound and inherited defaults, and qualify exact operation binding, restart, response normalization, singleton headers, limits, documentation, and ownership without adding retry or helper tasks.

8. 59ea351b
   Problem: acceleration reads cannot join reconciliation workflows

   Callers that need to reconcile PutBucketAccelerateConfiguration outcomes can only use the blocking convenience read. The exact prepared request has no reusable initiator, so owner-driven workflows cannot compose the bounded response without introducing a parallel state machine.

   Solution: colocate a bounded acceleration read with the Buckets provider

   Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Drive the existing convenience overload through the same provider-owned state machine, enforce caller-selected response bounds and singleton headers, and qualify request binding, restart, normalization, malformed headers, and overflow without retries or helper tasks.

9. 45564e81
   Problem: bucket ACL reads cannot join composed workflows

   GetBucketAcl has a strict typed low-level synchronous client and an authenticated server route, but no provider-owned limited operation. Callers cannot coordinate ACL reads with completion-set workflows without introducing a parallel execution path.

   Solution: colocate a bounded ACL read with the Buckets provider

   Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Retain the signed request and bounded response through terminal drain, preserve physical singleton headers and admission diagnostics, and qualify exact binding, restart, normalization, and response limits without retries or helper tasks.

10. 6b4e9836
    Problem: object ACL reads cannot join composed workflows

    GetObjectAcl has a strict typed synchronous client and authenticated server route, but it lacks the provider-owned limited operation needed by caller-driven completion sets. Callers otherwise need a second API shape and cannot reuse the exact signed request, bounded response, admission certainty, or failure mapping in a larger state machine.

    Solution: colocate a bounded ACL read with the Objects provider

    Add the exact Low_Level sink initiator and Client.Objects limited constructor, operation-last restart, typed Finish, and synchronous wait over one owner-driven state machine. Preserve exact version, requester-pays, expected-owner, singleton-header, caller-limit, cancellation, drain, and no-retry behavior, and gate the surface with preparation, restart, failure-normalization, socket, documentation, and full deterministic corpora.

11. 22a5e68d
    Problem: metadata-table reads cannot join composed workflows

    GetBucketMetadataTableConfiguration has strict preparation, decoding, and synchronous execution, but no provider-owned limited operation. Callers cannot compose the exact signed request, bounded response snapshot, admission certainty, or typed failure mapping into a larger completion-set state machine.

    Solution: colocate the bounded read with the Buckets provider

    Add the exact Low_Level sink initiator and Client.Buckets limited constructor, operation-last restart, typed Finish, and synchronous wait over one owner-driven state machine. Preserve the opaque provider status, expected-owner projection, singleton diagnostics, caller XML limits, cancellation, drain, and no-retry behavior, and gate the surface with exact preparation, restart, normalization, socket, documentation, and full deterministic corpora.

12. 0d0dbbac
    Problem: metadata-table creation cannot join composed workflows

    Callers can prepare and synchronously execute CreateBucketMetadataTableConfiguration, but they cannot initiate, restart, or consume it from a provider-owned completion set. The replayable prepared body also obscures the mutation certainty and read-before-retry contract after possible admission.

    Solution: add one-shot provider-owned metadata-table creation

    Move the prepared payload onto the existing non-rewindable owned-source path, add exact low-level admission gating, and colocate the limited constructor, operation-last restart, typed Finish, and typed synchronous wait in Client.Buckets. Preserve signed MD5/checksum and owner projection, expose conservative mutation certainty, require read-only reconciliation for unknown outcomes, and gate ownership, bounds, restart, cross-operation rejection, and the complete certainty matrix.

13. c457fcd8
    Problem: conditional annotation deletion cannot join composed workflows

    DeleteObjectAnnotation is limited to a synchronous low-level call, so owner-driven object workflows cannot schedule it beside other provider operations or retain typed admission certainty through terminal drain.

    Solution: colocate nonreplaying annotation deletion with objects

    Add an exact low-level initiator and provider-owned constructor, operation-last restart, typed Finish, and synchronous wait over one state machine. Copy all request identity, preserve one-shot mutation semantics, normalize publication certainty conservatively, and gate the API with exhaustive mapping and signed socket coverage.

14. f1cd6026
    Problem: replication deletion cannot join composed workflows

    DeleteBucketReplication is available only through synchronous convenience calls, so owner-driven callers cannot retain typed admission certainty, reuse an established operation, or compose it with sibling work.

    Solution: colocate composable replication deletion with the bucket provider

    Add the exact low-level initiator and provider-owned limited operation, operation-last initiation, typed Finish, and typed synchronous wait. Drive the convenience form through the same non-replaying state machine and gate its certainty, ownership, bounds, wire behavior, and documentation exhaustively.

15. 068b0a9a
    Problem: website deletion cannot join composed workflows

    DeleteBucketWebsite is available only through synchronous convenience calls, so owner-driven callers cannot retain typed admission certainty, reuse an established operation, or compose it with sibling work.

    Solution: colocate composable website deletion with the bucket provider

    Add the exact low-level initiator and provider-owned limited operation, operation-last initiation, typed Finish, and typed synchronous wait. Drive the convenience form through the same non-replaying state machine and gate its certainty, ownership, bounds, wire behavior, and documentation exhaustively.

16. 7fd0ffc1
    Problem: inventory deletion cannot join composed workflows

    DeleteBucketInventoryConfiguration is available only through a blocking convenience call, so callers cannot schedule it with other owner-driven operations or retain typed publication certainty after possible admission.

    Solution: add a provider-owned composable inventory deletion

    Add the exact low-level initiator, limited constructor, operation-last restart, typed Finish and synchronous wait over one non-replaying state machine. Extend identifier-copy, certainty, response-bound, signed socket, verifier, API documentation and compatibility evidence.

17. d71a924d
    Problem: CreateSession cannot join composed client workflows

    Directory-bucket callers must use a blocking scalar wrapper, cannot schedule the exchange beside other operations, and cannot inspect typed transport failure or admission certainty. The limited zeroizing credentials result also cannot safely live inside reusable operation storage.

    Solution: add a provider-owned composable CreateSession

    Retain the signed request, physically validated response metadata, and bounded raw response until typed Finish constructs credentials exactly once. Add same-name limited and operation-last forms, make both synchronous forms wait on the same state machine, and qualify cancellation, restart, request copying, response bounds, and malformed-response normalization.

18. 55460971
    Problem: intelligent-tiering deletion cannot join composed workflows

    DeleteBucketIntelligentTieringConfiguration is available only through the synchronous bucket client, so callers cannot place it in a shared completion set or inspect typed admission certainty after an ambiguous mutation result.

    Solution: add provider-owned composable intelligent-tiering deletion

    Add exact low-level initiation, a non-replaying Client.Buckets operation with operation-last restart and typed Finish, and route the synchronous forms through the same state machine. Qualify copied inputs, certainty normalization, response bounds, malformed headers, documentation, and the pinned operation inventory.

19. 4bf62837
    Problem: analytics deletion cannot join composed workflows

    DeleteBucketAnalyticsConfiguration is available only through the synchronous bucket client, so callers cannot share a completion set or retain typed certainty when deletion may have reached the service.

    Solution: add provider-owned composable analytics deletion

    Add an exact low-level initiator, a non-replaying Client.Buckets operation with copied request inputs, operation-last restart, typed Finish, and a synchronous wait over the same state machine. Extend the pinned verifier, certainty matrix, signed native/lightweight socket corpus, and maintained API documentation.

20. d50be24c
    Problem: metrics deletion cannot join composed workflows

    DeleteBucketMetricsConfiguration is available only through the synchronous bucket client, so callers cannot share a completion set or preserve typed certainty when the mutation result is ambiguous.

    Solution: add provider-owned composable metrics deletion

    Add exact low-level initiation, a copied-input non-replaying Client.Buckets operation, operation-last restart, typed Finish, and a synchronous wait over the same state machine. Extend pinned canonical-target verification, certainty normalization, signed native/lightweight sockets, bounded-response faults, and maintained documentation.

21. c12288e0
    Problem: metadata deletion cannot join composed workflows

    DeleteBucketMetadataConfiguration is available only through the synchronous convenience path, so owner-driven callers cannot compose it, inspect typed admission certainty, or reuse the provider operation without a parallel wrapper.

    Solution: add provider-owned composable metadata deletion

    Add the exact Low_Level initiator and Client.Buckets limited constructor, operation-last restart, typed Finish, and typed synchronous wait over one non-replaying state machine. Gate exact operation binding, copied owner input, certainty normalization, bounded physical responses, native/lightweight sockets, model inventory, and API documentation.

22. b6552934
    Problem: metadata-table deletion cannot join composed workflows

    DeleteBucketMetadataTableConfiguration remains on the last generic blocking bucket-configuration dispatcher. Owner-driven callers cannot compose it, inspect typed admission certainty, or reuse its operation without maintaining a parallel API path.

    Solution: add provider-owned composable metadata-table deletion

    Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and synchronous wait over one nonreplaying state machine. Rewrite the convenience call through it, gate exact wire and lifecycle behavior, document the provider surface, and remove the now-dead generic dispatcher.

23. 0cd84b09
    Problem: lifecycle configuration reads remain model-only

    The pinned S3 surface can prepare the request, but callers cannot compose or strictly decode the complete lifecycle configuration graph. This leaves a common retention and cost-control read outside the provider-owned client.

    Solution: add a complete provider-owned lifecycle read

    Add the strict full-graph codec, exact low-level preparation and decoding, limited constructor, reusable initiation, typed Finish, and synchronous wait over one state machine. Gate all 36 modeled members, strict limits, headers, ownership, and native/lightweight execution, and record the client-only coverage boundary.

24. c361be0d
    Problem: lifecycle configuration writes remain model-only

    The current PutBucketLifecycleConfiguration operation has no exact typed low-level or provider-owned composable client, leaving callers without bounded serialization, request-checksum projection, or mutation certainty.

    Solution: add the complete lifecycle configuration write client

    Serialize the pinned request graph, add explicit low-level and provider-owned one-shot APIs, and qualify model identity, limits, signing, certainty, native/lightweight sockets, documentation, and coverage.

25. 735fb607
    Problem: Current bucket notification configuration lacks a complete composable client

    The current GetBucketNotificationConfiguration and
    PutBucketNotificationConfiguration operations remain partial in the S3 ledger.
    Callers cannot preserve the full destination and filter graph or use the
    provider-owned limited constructor, reusable initiation, typed Finish, and
    same-state-machine synchronous forms with explicit mutation certainty.

    Solution: Add strict current notification GET and PUT clients

    Add the bounded presence-preserving REST/XML codec, exact signed low-level
    preparation and execution, provider-owned GET and non-replaying PUT state
    machines, typed certainty mapping, deterministic model and socket gates, and
    documented coverage. Keep the deprecated notification operations excluded.

1 source commit

1. 5876862c
   Problem: GetBucketReplication lacks a complete composable client contract

   Callers can prepare only part of the operation and cannot receive the pinned
   replication graph through the provider-owned synchronous and composable state
   machine. The coverage corpus therefore cannot qualify the current modeled
   response, strict bounds, or prepared-operation admission boundary.

   Solution: add the bounded provider-owned replication read

   Add a strict presence-preserving replication XML codec, exact low-level
   preparation and decoding, and synchronous, limited-constructor, reusable, and
   typed Finish forms in Client.Buckets. Gate the complete pinned structural
   graph, signed native/lightweight sockets, normalization, bounds, and coverage,
   and document the prose-only cross-field policy boundary.

1 source commit

1. 0673cdad
   Problem: PutBucketReplication lacks a typed bounded replacement API

   Clients can read bucket replication configuration but cannot replace the same complete graph through the provider-owned composable boundary. Callers would otherwise have to assemble signing, one-shot body ownership, response bounds, and mutation certainty themselves, risking replay or an unsound definite-outcome classification.

   Solution: Add nonreplaying provider-owned replication replacement

   Serialize the reviewed presence-sensitive replication graph under caller limits, prepare and sign the exact modeled request, and expose low-level, limited-constructor, operation-last, typed Finish, and synchronous forms over one state machine. Add deterministic model/XML/certainty coverage, native and lightweight signed socket evidence, maintained documentation, and coverage bookkeeping.

5 source commits

1. ded98183
   Problem: Consumer agent resources lag the shared policy

   This repository is pinned to an older flyology-ada/agents revision, so its generated instructions and installed skills omit the current shared assurance workflows.

   Solution: Update the shared agents dependency

   Advance the lockfile to agents revision aa7c026, reinstall the package graph, and regenerate the Codex instructions.

2. c268566a
   Merge pull request #1 from flyology-ada/codex/update-agents-aa7c026

   Update shared agents to aa7c026

3. 4da54070
   Problem: The agents lock retains foundation policy in the TLA+ skill

   This consumer remains pinned to the prior shared agents revision, whose TLA+ workflow includes repository architecture constraints unrelated to using the skill.

   Solution: Update the shared agents lock

   Advance flyology-ada/agents to revision 6a97e7a and record the refined agent-focused TLA+ skill deployment hashes.

4. 1ec12695
   Merge pull request #2 from flyology-ada/codex/update-agents-6a97e7a

   Update shared agents to 6a97e7a

5. aff992c0
   Problem: S3 operation qualification repeats unsynchronized mechanics

   Each new S3 operation manually repeats pinned-model parsing, coverage bookkeeping, verifier registration, corpus ordering, and documentation updates. The duplicated inventories have already drifted and make completing the remaining 116-operation surface slower and easier to misclassify.

   Solution: establish a reviewed operation and evidence registry

   Add a human-owned TOML inventory for all 116 pinned operations, a shared uv-driven model/audit/scaffold/qualify tool, generated coverage counts, test registration, and documentation, plus layer-specific executable-evidence checks and negative oracles. Preserve every existing coverage state and corpus order, use GetBucketReplication as the reviewed equivalence canary, and leave legacy Ada implementations unchanged for incremental family migration.

2 source commits

1. 06c6331a
   Problem: Bounded REST/XML reads duplicate lifecycle mechanics

   Provider operations repeat response buffering, singleton-header validation, hidden HTTP child drain, cancellation, restart cleanup, and typed terminal storage. This slows operation coverage and lets semantically equivalent read paths drift.

   Solution: Share the owner-driven bounded REST/XML read family

   Add an implementation generic for invariant transport and ownership mechanics, then migrate GetBucketReplication as the retrospective canary. Keep provider-owned public signatures, request preparation, decoding, classification, and synchronous-over-composable behavior unchanged, and record executable shared-family provenance in the operation registry.

2. ace67878
   Problem: Hosted tests cannot run the uv operation verifier

   The root test gate invokes the generated S3 operation registry checks through uv, but the hosted test jobs do not install uv. Both Linux and macOS therefore fail after a successful Ada build, leaving the automation foundation unqualified.

   Solution: Install and enforce the reviewed uv toolchain in CI

   Install exact uv 0.11.28 through immutable setup-uv v9.0.0 in the integrity and test jobs. Extend workflow policy and its negative oracle so both the action and tool version remain pinned.

1 source commit

1. f1a2a7b7
   Problem: Signed S3 qualification repeats model-owned mechanics

   Each bounded REST/XML operation manually duplicates exact HTTP targets, signed headers, malformed XML fixtures, socket sequencing, and test registration. Those copies can drift from the pinned Botocore model and make each operation expensive to qualify.

   Solution: Generate data-driven qualification from reviewed decisions

   Derive signed request plans and routine negative XML cases from the pinned model, run them through a shared uv loopback driver and small typed Ada adapter, and register executable evidence from the operation manifest. GetBucketReplication is the retrospective 23-case equivalence canary, while the prospective metrics query oracle verifies reusable canonical query generation.

1 source commit

1. f65afbf2
   Problem: New bounded S3 reads still repeat qualification mechanics

   The shared bounded REST/XML state machine and operation registry establish reusable transport and model evidence, but the first new operation must prove that reviewed API decisions, generated negative XML, signed requests, coverage registration, and documentation can advance without restoring per-operation shell bookkeeping. GetBucketMetricsConfiguration remains partial and invisible to callers until that path is exercised end to end.

   Solution: qualify GetBucketMetricsConfiguration through the shared family

   Add the strict presence-preserving metrics codec and provider-owned low-level, composable, restart, Finish, and synchronous forms over the shared state machine. Record only reviewed semantics and fixtures in the registry, derive the model-owned request and 17 malformed XML cases, run them through a small typed socket adapter, and make the independent coverage oracle discover test trees instead of a maintained filename list. Preserve explicit caller limits and the model's lack of an inferred filter-cardinality or identifier-content constraint.

1 source commit

1. 4e5af762
   Problem: named analytics reads lack composable coverage

   GetBucketAnalyticsConfiguration is tracked by the pinned S3 model but has no
   typed provider API or executable client evidence. Callers cannot perform one
   bounded named analytics read through the shared owner-driven state machine,
   and the operation registry therefore retains partial client coverage.

   Solution: qualify analytics reads through the shared REST/XML family

   Add a strict model-aligned analytics codec, exact low-level preparation and
   decoding, and provider-owned limited, restartable, typed Finish, and
   synchronous forms. Register reviewed signed cases and model-derived negative
   XML evidence, regenerate the coverage artifacts, and document the resulting
   client-only compatibility boundary.

1 source commit

1. 7cbcb44e
   Problem: named Intelligent-Tiering reads lack composable coverage

   GetBucketIntelligentTieringConfiguration is tracked by the pinned S3 model
   but has no typed provider API or executable client evidence. Callers cannot
   perform a bounded named configuration read through the shared owner-driven
   state machine, and registry coverage remains partial.

   Solution: qualify Intelligent-Tiering reads through the shared REST/XML family

   Add a strict model-aligned codec, exact low-level preparation and decoding,
   and provider-owned limited, restartable, typed Finish, and synchronous forms.
   Register reviewed signed cases and model-derived negatives, regenerate
   coverage artifacts, and document client-only compatibility.

1 source commit

1. 9fb63d01
   Problem: GetBucketInventoryConfiguration lacks a qualified client surface

   Callers cannot read named S3 inventory configurations through the provider-
   centric synchronous and composable APIs. The coverage registry therefore keeps
   the operation partial even though it belongs to the established bounded
   REST/XML read family.

   Solution: add the typed inventory read through the shared family

   Add the strict complete inventory codec, exact low-level preparation and
   decoding, provider-owned constructor/restart/Finish/synchronous forms, and
   model-derived negative and signed-socket qualification. Record the reviewed
   model decisions and executable evidence without claiming backend, server, or
   external-provider support.

1 source commit

1. 10d46346
   Problem: GetBucketLogging remains outside the qualified shared read family

   The current development line leaves bucket logging as a partial generated client with no provider-owned composable operation or executable corpus. Its modeled payload also uses a wire-root alias, a nonflattened grant list, and required namespaced attributes that the operation verifier cannot yet qualify without manual negative-case work.

   Solution: Add the strict logging client and extend model-driven qualification

   Add the provider-centric low-level, composable, and synchronous Get_Logging forms over the shared bounded REST/XML read state machine. Decode the complete presence-preserving logging graph, disabled state, exact grantee attributes and enum domains, and modeled errors without adding defaults or replay policy. Extend the uv tool to verify structurally equivalent payload aliases, namespaced attributes, and nonflattened list members, then generate and execute the signed and negative XML evidence and update the coverage and architecture records.

1 source commit

1. f5618821
   Problem: GetBucketWebsite remains outside the qualified shared read family

   The public client and signed corpus leave bucket website configuration unreadable, and the model verifier rejects the operation's documented payload alias even though its wire structure matches the reviewed WebsiteConfiguration shape. Repeating another handwritten bounded REST/XML read would also preserve the rollout bottleneck.

   Solution: Add a strict provider-owned website read and model-driven evidence

   Add the presence-preserving Website configuration codec, low-level and provider-owned composable/synchronous calls, generated negative XML and signed-socket qualification, and registry coverage. Verify payload aliases structurally while ignoring documentation-only differences and retaining all wire traits, so the shared bounded read family can qualify the operation without semantic drift.

1 source commit

1. d0fd10d7
   Problem: Paginated configuration reads repeat an unqualified XML envelope

   The remaining bucket-configuration list operations share strict REST/XML page mechanics, request continuation projection, bounded response ownership, and signed qualification structure. Reimplementing those mechanics operation by operation slows coverage work and risks semantic or evidence drift.

   Solution: Add a shared strict page family and qualify Metrics as its canary

   Add a private paginated REST/XML envelope generic, reuse the reviewed metrics item codec, and expose provider-owned one-page synchronous and composable ListBucketMetricsConfigurations calls over the existing bounded read state machine. Record reviewed manifest decisions and generate the model-derived negative XML, signed socket, coverage, registration, and documentation evidence, while keeping continuation caller-driven and public policy unchanged.

1 source commit

1. f28a3fb6
   Problem: Analytics configuration pages remain outside the shared read family

   ListBucketAnalyticsConfigurations is still represented only by model inventory, so callers lack a qualified one-page provider API and each future implementation risks repeating page-envelope, ownership, and evidence mechanics.

   Solution: Qualify Analytics through the paginated REST/XML family

   Reuse the reviewed analytics item decoder inside the shared strict page envelope, add exact low-level and provider-owned synchronous/composable calls over the existing bounded state machine, and generate the model-derived negative, signed-socket, coverage, registration, and documentation evidence from reviewed manifest decisions.

25 source commits

1. 94c0ee9c
   Problem: DeleteBucketLifecycle cannot join composed client workflows

   The exact lifecycle deletion remains limited to blocking convenience and prepared execution. Callers cannot own it in a completion set, preserve typed admission certainty, or reuse its state without a parallel wrapper.

   Solution: add the provider-owned lifecycle deletion operation

   Add the exact low-level initiator and colocated Client.Buckets constructor, operation-last initiation, typed Finish, and synchronous wait over one non-replaying state machine. Gate certainty, prepared-operation identity, physical headers, response bounds, restart, native/lightweight execution, and document the provider inventory.

2. 571522b3
   Problem: GetBucketPolicyStatus cannot join owner-driven client workflows

   The existing convenience client executes synchronously through its own path, so callers cannot compose the exact signed policy-status read with other provider operations or reuse its operation state safely.

   Solution: colocate a bounded composable policy-status operation

   Add the exact low-level initiator, provider-owned limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Drive the convenience overload through the same bounded state machine, reject malformed singleton headers and over-limit bodies, and qualify the result mapping and native/lightweight socket behavior.

3. 1c0455b9
   Problem: GetBucketRequestPayment cannot join owner-driven client workflows

   Requester-payment reads are available only through the blocking executor, so structured callers cannot own their deadline, cancellation, operation reuse, typed HTTP outcome, and bounded response lifecycle alongside other work.

   Solution: Colocate a bounded composable requester-payment read

   Add exact prepared-request admission, provider-owned limited construction and operation-last restart, typed Finish and synchronous wait, strict header and response bounds, full normalization and loopback corpora, and maintained API documentation. The established convenience call now waits on the same state machine without adding retry or billing-policy interpretation.

4. 6befc49a
   Problem: PutBucketRequestPayment cannot join composed client workflows

   The synchronous requester-payment mutation owns no reusable operation, exposes no admission certainty, and cannot participate in a caller-owned completion set.

   Solution: add a non-replaying provider-owned requester-payment operation

   Add the exact low-level initiator, limited constructor, operation-last restart, typed Finish and synchronous wait over one state machine. Own the signed payer bytes through terminal drain, preserve strict response bounds and headers, classify ambiguous outcomes without replay, and gate the contract with certainty, socket, model, documentation and repository checks.

5. 4664482f
   Problem: PutBucketAbac cannot join composed client workflows

   Callers can only execute PutBucketAbac synchronously, so owner-driven state machines cannot retain typed publication certainty or reconcile ambiguous outcomes without a parallel adapter.

   Solution: add a provider-owned non-replaying ABAC operation

   Expose exact low-level initiation and Client.Buckets limited-constructor, operation-last, typed Finish, and synchronous-wait forms over one state machine. Preserve the serialized status as a one-shot owned source, normalize admission certainty, extend exact-operation and socket corpora, and document the provider inventory and reconciliation contract.

6. cc04da27
   Problem: PutBucketAccelerateConfiguration cannot compose

   Callers can only execute the acceleration mutation synchronously, so owner-driven workflows cannot preserve typed admission certainty or reconcile ambiguous publication without a separate adapter.

   Solution: add the provider-owned acceleration operation

   Expose the exact one-shot low-level initiator and Client.Buckets limited-constructor, operation-last, typed Finish, and synchronous-wait forms over one state machine. Preserve the model's no-Content-MD5 rule, normalize mutation certainty, extend exact-operation and socket corpora, and document read reconciliation and the updated provider inventory.

7. 062f8119
   Problem: GetBucketAbac cannot join reconciliation workflows

   Callers can read the optional ABAC state only through a blocking convenience call, so a possibly admitted PutBucketAbac cannot compose its read-only reconciliation with other owner-driven operations. The low-level prepared-request boundary also has no exact reusable initiator for this operation.

   Solution: add one provider-owned bounded GetBucketAbac state machine

   Add the exact Low_Level initiator, limited constructor, operation-last reusable form, typed Finish, and typed synchronous wait in Client.Buckets. Drive the convenience call through that same state machine, preserve the caller-selected XML bound and inherited defaults, and qualify exact operation binding, restart, response normalization, singleton headers, limits, documentation, and ownership without adding retry or helper tasks.

8. 59ea351b
   Problem: acceleration reads cannot join reconciliation workflows

   Callers that need to reconcile PutBucketAccelerateConfiguration outcomes can only use the blocking convenience read. The exact prepared request has no reusable initiator, so owner-driven workflows cannot compose the bounded response without introducing a parallel state machine.

   Solution: colocate a bounded acceleration read with the Buckets provider

   Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Drive the existing convenience overload through the same provider-owned state machine, enforce caller-selected response bounds and singleton headers, and qualify request binding, restart, normalization, malformed headers, and overflow without retries or helper tasks.

9. 45564e81
   Problem: bucket ACL reads cannot join composed workflows

   GetBucketAcl has a strict typed low-level synchronous client and an authenticated server route, but no provider-owned limited operation. Callers cannot coordinate ACL reads with completion-set workflows without introducing a parallel execution path.

   Solution: colocate a bounded ACL read with the Buckets provider

   Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Retain the signed request and bounded response through terminal drain, preserve physical singleton headers and admission diagnostics, and qualify exact binding, restart, normalization, and response limits without retries or helper tasks.

10. 6b4e9836
    Problem: object ACL reads cannot join composed workflows

    GetObjectAcl has a strict typed synchronous client and authenticated server route, but it lacks the provider-owned limited operation needed by caller-driven completion sets. Callers otherwise need a second API shape and cannot reuse the exact signed request, bounded response, admission certainty, or failure mapping in a larger state machine.

    Solution: colocate a bounded ACL read with the Objects provider

    Add the exact Low_Level sink initiator and Client.Objects limited constructor, operation-last restart, typed Finish, and synchronous wait over one owner-driven state machine. Preserve exact version, requester-pays, expected-owner, singleton-header, caller-limit, cancellation, drain, and no-retry behavior, and gate the surface with preparation, restart, failure-normalization, socket, documentation, and full deterministic corpora.

11. 22a5e68d
    Problem: metadata-table reads cannot join composed workflows

    GetBucketMetadataTableConfiguration has strict preparation, decoding, and synchronous execution, but no provider-owned limited operation. Callers cannot compose the exact signed request, bounded response snapshot, admission certainty, or typed failure mapping into a larger completion-set state machine.

    Solution: colocate the bounded read with the Buckets provider

    Add the exact Low_Level sink initiator and Client.Buckets limited constructor, operation-last restart, typed Finish, and synchronous wait over one owner-driven state machine. Preserve the opaque provider status, expected-owner projection, singleton diagnostics, caller XML limits, cancellation, drain, and no-retry behavior, and gate the surface with exact preparation, restart, normalization, socket, documentation, and full deterministic corpora.

12. 0d0dbbac
    Problem: metadata-table creation cannot join composed workflows

    Callers can prepare and synchronously execute CreateBucketMetadataTableConfiguration, but they cannot initiate, restart, or consume it from a provider-owned completion set. The replayable prepared body also obscures the mutation certainty and read-before-retry contract after possible admission.

    Solution: add one-shot provider-owned metadata-table creation

    Move the prepared payload onto the existing non-rewindable owned-source path, add exact low-level admission gating, and colocate the limited constructor, operation-last restart, typed Finish, and typed synchronous wait in Client.Buckets. Preserve signed MD5/checksum and owner projection, expose conservative mutation certainty, require read-only reconciliation for unknown outcomes, and gate ownership, bounds, restart, cross-operation rejection, and the complete certainty matrix.

13. c457fcd8
    Problem: conditional annotation deletion cannot join composed workflows

    DeleteObjectAnnotation is limited to a synchronous low-level call, so owner-driven object workflows cannot schedule it beside other provider operations or retain typed admission certainty through terminal drain.

    Solution: colocate nonreplaying annotation deletion with objects

    Add an exact low-level initiator and provider-owned constructor, operation-last restart, typed Finish, and synchronous wait over one state machine. Copy all request identity, preserve one-shot mutation semantics, normalize publication certainty conservatively, and gate the API with exhaustive mapping and signed socket coverage.

14. f1cd6026
    Problem: replication deletion cannot join composed workflows

    DeleteBucketReplication is available only through synchronous convenience calls, so owner-driven callers cannot retain typed admission certainty, reuse an established operation, or compose it with sibling work.

    Solution: colocate composable replication deletion with the bucket provider

    Add the exact low-level initiator and provider-owned limited operation, operation-last initiation, typed Finish, and typed synchronous wait. Drive the convenience form through the same non-replaying state machine and gate its certainty, ownership, bounds, wire behavior, and documentation exhaustively.

15. 068b0a9a
    Problem: website deletion cannot join composed workflows

    DeleteBucketWebsite is available only through synchronous convenience calls, so owner-driven callers cannot retain typed admission certainty, reuse an established operation, or compose it with sibling work.

    Solution: colocate composable website deletion with the bucket provider

    Add the exact low-level initiator and provider-owned limited operation, operation-last initiation, typed Finish, and typed synchronous wait. Drive the convenience form through the same non-replaying state machine and gate its certainty, ownership, bounds, wire behavior, and documentation exhaustively.

16. 7fd0ffc1
    Problem: inventory deletion cannot join composed workflows

    DeleteBucketInventoryConfiguration is available only through a blocking convenience call, so callers cannot schedule it with other owner-driven operations or retain typed publication certainty after possible admission.

    Solution: add a provider-owned composable inventory deletion

    Add the exact low-level initiator, limited constructor, operation-last restart, typed Finish and synchronous wait over one non-replaying state machine. Extend identifier-copy, certainty, response-bound, signed socket, verifier, API documentation and compatibility evidence.

17. d71a924d
    Problem: CreateSession cannot join composed client workflows

    Directory-bucket callers must use a blocking scalar wrapper, cannot schedule the exchange beside other operations, and cannot inspect typed transport failure or admission certainty. The limited zeroizing credentials result also cannot safely live inside reusable operation storage.

    Solution: add a provider-owned composable CreateSession

    Retain the signed request, physically validated response metadata, and bounded raw response until typed Finish constructs credentials exactly once. Add same-name limited and operation-last forms, make both synchronous forms wait on the same state machine, and qualify cancellation, restart, request copying, response bounds, and malformed-response normalization.

18. 55460971
    Problem: intelligent-tiering deletion cannot join composed workflows

    DeleteBucketIntelligentTieringConfiguration is available only through the synchronous bucket client, so callers cannot place it in a shared completion set or inspect typed admission certainty after an ambiguous mutation result.

    Solution: add provider-owned composable intelligent-tiering deletion

    Add exact low-level initiation, a non-replaying Client.Buckets operation with operation-last restart and typed Finish, and route the synchronous forms through the same state machine. Qualify copied inputs, certainty normalization, response bounds, malformed headers, documentation, and the pinned operation inventory.

19. 4bf62837
    Problem: analytics deletion cannot join composed workflows

    DeleteBucketAnalyticsConfiguration is available only through the synchronous bucket client, so callers cannot share a completion set or retain typed certainty when deletion may have reached the service.

    Solution: add provider-owned composable analytics deletion

    Add an exact low-level initiator, a non-replaying Client.Buckets operation with copied request inputs, operation-last restart, typed Finish, and a synchronous wait over the same state machine. Extend the pinned verifier, certainty matrix, signed native/lightweight socket corpus, and maintained API documentation.

20. d50be24c
    Problem: metrics deletion cannot join composed workflows

    DeleteBucketMetricsConfiguration is available only through the synchronous bucket client, so callers cannot share a completion set or preserve typed certainty when the mutation result is ambiguous.

    Solution: add provider-owned composable metrics deletion

    Add exact low-level initiation, a copied-input non-replaying Client.Buckets operation, operation-last restart, typed Finish, and a synchronous wait over the same state machine. Extend pinned canonical-target verification, certainty normalization, signed native/lightweight sockets, bounded-response faults, and maintained documentation.

21. c12288e0
    Problem: metadata deletion cannot join composed workflows

    DeleteBucketMetadataConfiguration is available only through the synchronous convenience path, so owner-driven callers cannot compose it, inspect typed admission certainty, or reuse the provider operation without a parallel wrapper.

    Solution: add provider-owned composable metadata deletion

    Add the exact Low_Level initiator and Client.Buckets limited constructor, operation-last restart, typed Finish, and typed synchronous wait over one non-replaying state machine. Gate exact operation binding, copied owner input, certainty normalization, bounded physical responses, native/lightweight sockets, model inventory, and API documentation.

22. b6552934
    Problem: metadata-table deletion cannot join composed workflows

    DeleteBucketMetadataTableConfiguration remains on the last generic blocking bucket-configuration dispatcher. Owner-driven callers cannot compose it, inspect typed admission certainty, or reuse its operation without maintaining a parallel API path.

    Solution: add provider-owned composable metadata-table deletion

    Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and synchronous wait over one nonreplaying state machine. Rewrite the convenience call through it, gate exact wire and lifecycle behavior, document the provider surface, and remove the now-dead generic dispatcher.

23. 0cd84b09
    Problem: lifecycle configuration reads remain model-only

    The pinned S3 surface can prepare the request, but callers cannot compose or strictly decode the complete lifecycle configuration graph. This leaves a common retention and cost-control read outside the provider-owned client.

    Solution: add a complete provider-owned lifecycle read

    Add the strict full-graph codec, exact low-level preparation and decoding, limited constructor, reusable initiation, typed Finish, and synchronous wait over one state machine. Gate all 36 modeled members, strict limits, headers, ownership, and native/lightweight execution, and record the client-only coverage boundary.

24. c361be0d
    Problem: lifecycle configuration writes remain model-only

    The current PutBucketLifecycleConfiguration operation has no exact typed low-level or provider-owned composable client, leaving callers without bounded serialization, request-checksum projection, or mutation certainty.

    Solution: add the complete lifecycle configuration write client

    Serialize the pinned request graph, add explicit low-level and provider-owned one-shot APIs, and qualify model identity, limits, signing, certainty, native/lightweight sockets, documentation, and coverage.

25. 735fb607
    Problem: Current bucket notification configuration lacks a complete composable client

    The current GetBucketNotificationConfiguration and
    PutBucketNotificationConfiguration operations remain partial in the S3 ledger.
    Callers cannot preserve the full destination and filter graph or use the
    provider-owned limited constructor, reusable initiation, typed Finish, and
    same-state-machine synchronous forms with explicit mutation certainty.

    Solution: Add strict current notification GET and PUT clients

    Add the bounded presence-preserving REST/XML codec, exact signed low-level
    preparation and execution, provider-owned GET and non-replaying PUT state
    machines, typed certainty mapping, deterministic model and socket gates, and
    documented coverage. Keep the deprecated notification operations excluded.

1 source commit

1. 5876862c
   Problem: GetBucketReplication lacks a complete composable client contract

   Callers can prepare only part of the operation and cannot receive the pinned
   replication graph through the provider-owned synchronous and composable state
   machine. The coverage corpus therefore cannot qualify the current modeled
   response, strict bounds, or prepared-operation admission boundary.

   Solution: add the bounded provider-owned replication read

   Add a strict presence-preserving replication XML codec, exact low-level
   preparation and decoding, and synchronous, limited-constructor, reusable, and
   typed Finish forms in Client.Buckets. Gate the complete pinned structural
   graph, signed native/lightweight sockets, normalization, bounds, and coverage,
   and document the prose-only cross-field policy boundary.

1 source commit

1. 0673cdad
   Problem: PutBucketReplication lacks a typed bounded replacement API

   Clients can read bucket replication configuration but cannot replace the same complete graph through the provider-owned composable boundary. Callers would otherwise have to assemble signing, one-shot body ownership, response bounds, and mutation certainty themselves, risking replay or an unsound definite-outcome classification.

   Solution: Add nonreplaying provider-owned replication replacement

   Serialize the reviewed presence-sensitive replication graph under caller limits, prepare and sign the exact modeled request, and expose low-level, limited-constructor, operation-last, typed Finish, and synchronous forms over one state machine. Add deterministic model/XML/certainty coverage, native and lightweight signed socket evidence, maintained documentation, and coverage bookkeeping.

5 source commits

1. ded98183
   Problem: Consumer agent resources lag the shared policy

   This repository is pinned to an older flyology-ada/agents revision, so its generated instructions and installed skills omit the current shared assurance workflows.

   Solution: Update the shared agents dependency

   Advance the lockfile to agents revision aa7c026, reinstall the package graph, and regenerate the Codex instructions.

2. c268566a
   Merge pull request #1 from flyology-ada/codex/update-agents-aa7c026

   Update shared agents to aa7c026

3. 4da54070
   Problem: The agents lock retains foundation policy in the TLA+ skill

   This consumer remains pinned to the prior shared agents revision, whose TLA+ workflow includes repository architecture constraints unrelated to using the skill.

   Solution: Update the shared agents lock

   Advance flyology-ada/agents to revision 6a97e7a and record the refined agent-focused TLA+ skill deployment hashes.

4. 1ec12695
   Merge pull request #2 from flyology-ada/codex/update-agents-6a97e7a

   Update shared agents to 6a97e7a

5. aff992c0
   Problem: S3 operation qualification repeats unsynchronized mechanics

   Each new S3 operation manually repeats pinned-model parsing, coverage bookkeeping, verifier registration, corpus ordering, and documentation updates. The duplicated inventories have already drifted and make completing the remaining 116-operation surface slower and easier to misclassify.

   Solution: establish a reviewed operation and evidence registry

   Add a human-owned TOML inventory for all 116 pinned operations, a shared uv-driven model/audit/scaffold/qualify tool, generated coverage counts, test registration, and documentation, plus layer-specific executable-evidence checks and negative oracles. Preserve every existing coverage state and corpus order, use GetBucketReplication as the reviewed equivalence canary, and leave legacy Ada implementations unchanged for incremental family migration.

2 source commits

1. 06c6331a
   Problem: Bounded REST/XML reads duplicate lifecycle mechanics

   Provider operations repeat response buffering, singleton-header validation, hidden HTTP child drain, cancellation, restart cleanup, and typed terminal storage. This slows operation coverage and lets semantically equivalent read paths drift.

   Solution: Share the owner-driven bounded REST/XML read family

   Add an implementation generic for invariant transport and ownership mechanics, then migrate GetBucketReplication as the retrospective canary. Keep provider-owned public signatures, request preparation, decoding, classification, and synchronous-over-composable behavior unchanged, and record executable shared-family provenance in the operation registry.

2. ace67878
   Problem: Hosted tests cannot run the uv operation verifier

   The root test gate invokes the generated S3 operation registry checks through uv, but the hosted test jobs do not install uv. Both Linux and macOS therefore fail after a successful Ada build, leaving the automation foundation unqualified.

   Solution: Install and enforce the reviewed uv toolchain in CI

   Install exact uv 0.11.28 through immutable setup-uv v9.0.0 in the integrity and test jobs. Extend workflow policy and its negative oracle so both the action and tool version remain pinned.

1 source commit

1. f1a2a7b7
   Problem: Signed S3 qualification repeats model-owned mechanics

   Each bounded REST/XML operation manually duplicates exact HTTP targets, signed headers, malformed XML fixtures, socket sequencing, and test registration. Those copies can drift from the pinned Botocore model and make each operation expensive to qualify.

   Solution: Generate data-driven qualification from reviewed decisions

   Derive signed request plans and routine negative XML cases from the pinned model, run them through a shared uv loopback driver and small typed Ada adapter, and register executable evidence from the operation manifest. GetBucketReplication is the retrospective 23-case equivalence canary, while the prospective metrics query oracle verifies reusable canonical query generation.

1 source commit

1. f65afbf2
   Problem: New bounded S3 reads still repeat qualification mechanics

   The shared bounded REST/XML state machine and operation registry establish reusable transport and model evidence, but the first new operation must prove that reviewed API decisions, generated negative XML, signed requests, coverage registration, and documentation can advance without restoring per-operation shell bookkeeping. GetBucketMetricsConfiguration remains partial and invisible to callers until that path is exercised end to end.

   Solution: qualify GetBucketMetricsConfiguration through the shared family

   Add the strict presence-preserving metrics codec and provider-owned low-level, composable, restart, Finish, and synchronous forms over the shared state machine. Record only reviewed semantics and fixtures in the registry, derive the model-owned request and 17 malformed XML cases, run them through a small typed socket adapter, and make the independent coverage oracle discover test trees instead of a maintained filename list. Preserve explicit caller limits and the model's lack of an inferred filter-cardinality or identifier-content constraint.

1 source commit

1. 4e5af762
   Problem: named analytics reads lack composable coverage

   GetBucketAnalyticsConfiguration is tracked by the pinned S3 model but has no
   typed provider API or executable client evidence. Callers cannot perform one
   bounded named analytics read through the shared owner-driven state machine,
   and the operation registry therefore retains partial client coverage.

   Solution: qualify analytics reads through the shared REST/XML family

   Add a strict model-aligned analytics codec, exact low-level preparation and
   decoding, and provider-owned limited, restartable, typed Finish, and
   synchronous forms. Register reviewed signed cases and model-derived negative
   XML evidence, regenerate the coverage artifacts, and document the resulting
   client-only compatibility boundary.

1 source commit

1. 7cbcb44e
   Problem: named Intelligent-Tiering reads lack composable coverage

   GetBucketIntelligentTieringConfiguration is tracked by the pinned S3 model
   but has no typed provider API or executable client evidence. Callers cannot
   perform a bounded named configuration read through the shared owner-driven
   state machine, and registry coverage remains partial.

   Solution: qualify Intelligent-Tiering reads through the shared REST/XML family

   Add a strict model-aligned codec, exact low-level preparation and decoding,
   and provider-owned limited, restartable, typed Finish, and synchronous forms.
   Register reviewed signed cases and model-derived negatives, regenerate
   coverage artifacts, and document client-only compatibility.

1 source commit

1. 9fb63d01
   Problem: GetBucketInventoryConfiguration lacks a qualified client surface

   Callers cannot read named S3 inventory configurations through the provider-
   centric synchronous and composable APIs. The coverage registry therefore keeps
   the operation partial even though it belongs to the established bounded
   REST/XML read family.

   Solution: add the typed inventory read through the shared family

   Add the strict complete inventory codec, exact low-level preparation and
   decoding, provider-owned constructor/restart/Finish/synchronous forms, and
   model-derived negative and signed-socket qualification. Record the reviewed
   model decisions and executable evidence without claiming backend, server, or
   external-provider support.

1 source commit

1. 10d46346
   Problem: GetBucketLogging remains outside the qualified shared read family

   The current development line leaves bucket logging as a partial generated client with no provider-owned composable operation or executable corpus. Its modeled payload also uses a wire-root alias, a nonflattened grant list, and required namespaced attributes that the operation verifier cannot yet qualify without manual negative-case work.

   Solution: Add the strict logging client and extend model-driven qualification

   Add the provider-centric low-level, composable, and synchronous Get_Logging forms over the shared bounded REST/XML read state machine. Decode the complete presence-preserving logging graph, disabled state, exact grantee attributes and enum domains, and modeled errors without adding defaults or replay policy. Extend the uv tool to verify structurally equivalent payload aliases, namespaced attributes, and nonflattened list members, then generate and execute the signed and negative XML evidence and update the coverage and architecture records.

1 source commit

1. f5618821
   Problem: GetBucketWebsite remains outside the qualified shared read family

   The public client and signed corpus leave bucket website configuration unreadable, and the model verifier rejects the operation's documented payload alias even though its wire structure matches the reviewed WebsiteConfiguration shape. Repeating another handwritten bounded REST/XML read would also preserve the rollout bottleneck.

   Solution: Add a strict provider-owned website read and model-driven evidence

   Add the presence-preserving Website configuration codec, low-level and provider-owned composable/synchronous calls, generated negative XML and signed-socket qualification, and registry coverage. Verify payload aliases structurally while ignoring documentation-only differences and retaining all wire traits, so the shared bounded read family can qualify the operation without semantic drift.

1 source commit

1. d0fd10d7
   Problem: Paginated configuration reads repeat an unqualified XML envelope

   The remaining bucket-configuration list operations share strict REST/XML page mechanics, request continuation projection, bounded response ownership, and signed qualification structure. Reimplementing those mechanics operation by operation slows coverage work and risks semantic or evidence drift.

   Solution: Add a shared strict page family and qualify Metrics as its canary

   Add a private paginated REST/XML envelope generic, reuse the reviewed metrics item codec, and expose provider-owned one-page synchronous and composable ListBucketMetricsConfigurations calls over the existing bounded read state machine. Record reviewed manifest decisions and generate the model-derived negative XML, signed socket, coverage, registration, and documentation evidence, while keeping continuation caller-driven and public policy unchanged.

1 source commit

1. f28a3fb6
   Problem: Analytics configuration pages remain outside the shared read family

   ListBucketAnalyticsConfigurations is still represented only by model inventory, so callers lack a qualified one-page provider API and each future implementation risks repeating page-envelope, ownership, and evidence mechanics.

   Solution: Qualify Analytics through the paginated REST/XML family

   Reuse the reviewed analytics item decoder inside the shared strict page envelope, add exact low-level and provider-owned synchronous/composable calls over the existing bounded state machine, and generate the model-derived negative, signed-socket, coverage, registration, and documentation evidence from reviewed manifest decisions.

25 source commits

1. 94c0ee9c
   Problem: DeleteBucketLifecycle cannot join composed client workflows

   The exact lifecycle deletion remains limited to blocking convenience and prepared execution. Callers cannot own it in a completion set, preserve typed admission certainty, or reuse its state without a parallel wrapper.

   Solution: add the provider-owned lifecycle deletion operation

   Add the exact low-level initiator and colocated Client.Buckets constructor, operation-last initiation, typed Finish, and synchronous wait over one non-replaying state machine. Gate certainty, prepared-operation identity, physical headers, response bounds, restart, native/lightweight execution, and document the provider inventory.

2. 571522b3
   Problem: GetBucketPolicyStatus cannot join owner-driven client workflows

   The existing convenience client executes synchronously through its own path, so callers cannot compose the exact signed policy-status read with other provider operations or reuse its operation state safely.

   Solution: colocate a bounded composable policy-status operation

   Add the exact low-level initiator, provider-owned limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Drive the convenience overload through the same bounded state machine, reject malformed singleton headers and over-limit bodies, and qualify the result mapping and native/lightweight socket behavior.

3. 1c0455b9
   Problem: GetBucketRequestPayment cannot join owner-driven client workflows

   Requester-payment reads are available only through the blocking executor, so structured callers cannot own their deadline, cancellation, operation reuse, typed HTTP outcome, and bounded response lifecycle alongside other work.

   Solution: Colocate a bounded composable requester-payment read

   Add exact prepared-request admission, provider-owned limited construction and operation-last restart, typed Finish and synchronous wait, strict header and response bounds, full normalization and loopback corpora, and maintained API documentation. The established convenience call now waits on the same state machine without adding retry or billing-policy interpretation.

4. 6befc49a
   Problem: PutBucketRequestPayment cannot join composed client workflows

   The synchronous requester-payment mutation owns no reusable operation, exposes no admission certainty, and cannot participate in a caller-owned completion set.

   Solution: add a non-replaying provider-owned requester-payment operation

   Add the exact low-level initiator, limited constructor, operation-last restart, typed Finish and synchronous wait over one state machine. Own the signed payer bytes through terminal drain, preserve strict response bounds and headers, classify ambiguous outcomes without replay, and gate the contract with certainty, socket, model, documentation and repository checks.

5. 4664482f
   Problem: PutBucketAbac cannot join composed client workflows

   Callers can only execute PutBucketAbac synchronously, so owner-driven state machines cannot retain typed publication certainty or reconcile ambiguous outcomes without a parallel adapter.

   Solution: add a provider-owned non-replaying ABAC operation

   Expose exact low-level initiation and Client.Buckets limited-constructor, operation-last, typed Finish, and synchronous-wait forms over one state machine. Preserve the serialized status as a one-shot owned source, normalize admission certainty, extend exact-operation and socket corpora, and document the provider inventory and reconciliation contract.

6. cc04da27
   Problem: PutBucketAccelerateConfiguration cannot compose

   Callers can only execute the acceleration mutation synchronously, so owner-driven workflows cannot preserve typed admission certainty or reconcile ambiguous publication without a separate adapter.

   Solution: add the provider-owned acceleration operation

   Expose the exact one-shot low-level initiator and Client.Buckets limited-constructor, operation-last, typed Finish, and synchronous-wait forms over one state machine. Preserve the model's no-Content-MD5 rule, normalize mutation certainty, extend exact-operation and socket corpora, and document read reconciliation and the updated provider inventory.

7. 062f8119
   Problem: GetBucketAbac cannot join reconciliation workflows

   Callers can read the optional ABAC state only through a blocking convenience call, so a possibly admitted PutBucketAbac cannot compose its read-only reconciliation with other owner-driven operations. The low-level prepared-request boundary also has no exact reusable initiator for this operation.

   Solution: add one provider-owned bounded GetBucketAbac state machine

   Add the exact Low_Level initiator, limited constructor, operation-last reusable form, typed Finish, and typed synchronous wait in Client.Buckets. Drive the convenience call through that same state machine, preserve the caller-selected XML bound and inherited defaults, and qualify exact operation binding, restart, response normalization, singleton headers, limits, documentation, and ownership without adding retry or helper tasks.

8. 59ea351b
   Problem: acceleration reads cannot join reconciliation workflows

   Callers that need to reconcile PutBucketAccelerateConfiguration outcomes can only use the blocking convenience read. The exact prepared request has no reusable initiator, so owner-driven workflows cannot compose the bounded response without introducing a parallel state machine.

   Solution: colocate a bounded acceleration read with the Buckets provider

   Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Drive the existing convenience overload through the same provider-owned state machine, enforce caller-selected response bounds and singleton headers, and qualify request binding, restart, normalization, malformed headers, and overflow without retries or helper tasks.

9. 45564e81
   Problem: bucket ACL reads cannot join composed workflows

   GetBucketAcl has a strict typed low-level synchronous client and an authenticated server route, but no provider-owned limited operation. Callers cannot coordinate ACL reads with completion-set workflows without introducing a parallel execution path.

   Solution: colocate a bounded ACL read with the Buckets provider

   Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and typed synchronous wait. Retain the signed request and bounded response through terminal drain, preserve physical singleton headers and admission diagnostics, and qualify exact binding, restart, normalization, and response limits without retries or helper tasks.

10. 6b4e9836
    Problem: object ACL reads cannot join composed workflows

    GetObjectAcl has a strict typed synchronous client and authenticated server route, but it lacks the provider-owned limited operation needed by caller-driven completion sets. Callers otherwise need a second API shape and cannot reuse the exact signed request, bounded response, admission certainty, or failure mapping in a larger state machine.

    Solution: colocate a bounded ACL read with the Objects provider

    Add the exact Low_Level sink initiator and Client.Objects limited constructor, operation-last restart, typed Finish, and synchronous wait over one owner-driven state machine. Preserve exact version, requester-pays, expected-owner, singleton-header, caller-limit, cancellation, drain, and no-retry behavior, and gate the surface with preparation, restart, failure-normalization, socket, documentation, and full deterministic corpora.

11. 22a5e68d
    Problem: metadata-table reads cannot join composed workflows

    GetBucketMetadataTableConfiguration has strict preparation, decoding, and synchronous execution, but no provider-owned limited operation. Callers cannot compose the exact signed request, bounded response snapshot, admission certainty, or typed failure mapping into a larger completion-set state machine.

    Solution: colocate the bounded read with the Buckets provider

    Add the exact Low_Level sink initiator and Client.Buckets limited constructor, operation-last restart, typed Finish, and synchronous wait over one owner-driven state machine. Preserve the opaque provider status, expected-owner projection, singleton diagnostics, caller XML limits, cancellation, drain, and no-retry behavior, and gate the surface with exact preparation, restart, normalization, socket, documentation, and full deterministic corpora.

12. 0d0dbbac
    Problem: metadata-table creation cannot join composed workflows

    Callers can prepare and synchronously execute CreateBucketMetadataTableConfiguration, but they cannot initiate, restart, or consume it from a provider-owned completion set. The replayable prepared body also obscures the mutation certainty and read-before-retry contract after possible admission.

    Solution: add one-shot provider-owned metadata-table creation

    Move the prepared payload onto the existing non-rewindable owned-source path, add exact low-level admission gating, and colocate the limited constructor, operation-last restart, typed Finish, and typed synchronous wait in Client.Buckets. Preserve signed MD5/checksum and owner projection, expose conservative mutation certainty, require read-only reconciliation for unknown outcomes, and gate ownership, bounds, restart, cross-operation rejection, and the complete certainty matrix.

13. c457fcd8
    Problem: conditional annotation deletion cannot join composed workflows

    DeleteObjectAnnotation is limited to a synchronous low-level call, so owner-driven object workflows cannot schedule it beside other provider operations or retain typed admission certainty through terminal drain.

    Solution: colocate nonreplaying annotation deletion with objects

    Add an exact low-level initiator and provider-owned constructor, operation-last restart, typed Finish, and synchronous wait over one state machine. Copy all request identity, preserve one-shot mutation semantics, normalize publication certainty conservatively, and gate the API with exhaustive mapping and signed socket coverage.

14. f1cd6026
    Problem: replication deletion cannot join composed workflows

    DeleteBucketReplication is available only through synchronous convenience calls, so owner-driven callers cannot retain typed admission certainty, reuse an established operation, or compose it with sibling work.

    Solution: colocate composable replication deletion with the bucket provider

    Add the exact low-level initiator and provider-owned limited operation, operation-last initiation, typed Finish, and typed synchronous wait. Drive the convenience form through the same non-replaying state machine and gate its certainty, ownership, bounds, wire behavior, and documentation exhaustively.

15. 068b0a9a
    Problem: website deletion cannot join composed workflows

    DeleteBucketWebsite is available only through synchronous convenience calls, so owner-driven callers cannot retain typed admission certainty, reuse an established operation, or compose it with sibling work.

    Solution: colocate composable website deletion with the bucket provider

    Add the exact low-level initiator and provider-owned limited operation, operation-last initiation, typed Finish, and typed synchronous wait. Drive the convenience form through the same non-replaying state machine and gate its certainty, ownership, bounds, wire behavior, and documentation exhaustively.

16. 7fd0ffc1
    Problem: inventory deletion cannot join composed workflows

    DeleteBucketInventoryConfiguration is available only through a blocking convenience call, so callers cannot schedule it with other owner-driven operations or retain typed publication certainty after possible admission.

    Solution: add a provider-owned composable inventory deletion

    Add the exact low-level initiator, limited constructor, operation-last restart, typed Finish and synchronous wait over one non-replaying state machine. Extend identifier-copy, certainty, response-bound, signed socket, verifier, API documentation and compatibility evidence.

17. d71a924d
    Problem: CreateSession cannot join composed client workflows

    Directory-bucket callers must use a blocking scalar wrapper, cannot schedule the exchange beside other operations, and cannot inspect typed transport failure or admission certainty. The limited zeroizing credentials result also cannot safely live inside reusable operation storage.

    Solution: add a provider-owned composable CreateSession

    Retain the signed request, physically validated response metadata, and bounded raw response until typed Finish constructs credentials exactly once. Add same-name limited and operation-last forms, make both synchronous forms wait on the same state machine, and qualify cancellation, restart, request copying, response bounds, and malformed-response normalization.

18. 55460971
    Problem: intelligent-tiering deletion cannot join composed workflows

    DeleteBucketIntelligentTieringConfiguration is available only through the synchronous bucket client, so callers cannot place it in a shared completion set or inspect typed admission certainty after an ambiguous mutation result.

    Solution: add provider-owned composable intelligent-tiering deletion

    Add exact low-level initiation, a non-replaying Client.Buckets operation with operation-last restart and typed Finish, and route the synchronous forms through the same state machine. Qualify copied inputs, certainty normalization, response bounds, malformed headers, documentation, and the pinned operation inventory.

19. 4bf62837
    Problem: analytics deletion cannot join composed workflows

    DeleteBucketAnalyticsConfiguration is available only through the synchronous bucket client, so callers cannot share a completion set or retain typed certainty when deletion may have reached the service.

    Solution: add provider-owned composable analytics deletion

    Add an exact low-level initiator, a non-replaying Client.Buckets operation with copied request inputs, operation-last restart, typed Finish, and a synchronous wait over the same state machine. Extend the pinned verifier, certainty matrix, signed native/lightweight socket corpus, and maintained API documentation.

20. d50be24c
    Problem: metrics deletion cannot join composed workflows

    DeleteBucketMetricsConfiguration is available only through the synchronous bucket client, so callers cannot share a completion set or preserve typed certainty when the mutation result is ambiguous.

    Solution: add provider-owned composable metrics deletion

    Add exact low-level initiation, a copied-input non-replaying Client.Buckets operation, operation-last restart, typed Finish, and a synchronous wait over the same state machine. Extend pinned canonical-target verification, certainty normalization, signed native/lightweight sockets, bounded-response faults, and maintained documentation.

21. c12288e0
    Problem: metadata deletion cannot join composed workflows

    DeleteBucketMetadataConfiguration is available only through the synchronous convenience path, so owner-driven callers cannot compose it, inspect typed admission certainty, or reuse the provider operation without a parallel wrapper.

    Solution: add provider-owned composable metadata deletion

    Add the exact Low_Level initiator and Client.Buckets limited constructor, operation-last restart, typed Finish, and typed synchronous wait over one non-replaying state machine. Gate exact operation binding, copied owner input, certainty normalization, bounded physical responses, native/lightweight sockets, model inventory, and API documentation.

22. b6552934
    Problem: metadata-table deletion cannot join composed workflows

    DeleteBucketMetadataTableConfiguration remains on the last generic blocking bucket-configuration dispatcher. Owner-driven callers cannot compose it, inspect typed admission certainty, or reuse its operation without maintaining a parallel API path.

    Solution: add provider-owned composable metadata-table deletion

    Add the exact Low_Level initiator, limited constructor, operation-last restart, typed Finish, and synchronous wait over one nonreplaying state machine. Rewrite the convenience call through it, gate exact wire and lifecycle behavior, document the provider surface, and remove the now-dead generic dispatcher.

23. 0cd84b09
    Problem: lifecycle configuration reads remain model-only

    The pinned S3 surface can prepare the request, but callers cannot compose or strictly decode the complete lifecycle configuration graph. This leaves a common retention and cost-control read outside the provider-owned client.

    Solution: add a complete provider-owned lifecycle read

    Add the strict full-graph codec, exact low-level preparation and decoding, limited constructor, reusable initiation, typed Finish, and synchronous wait over one state machine. Gate all 36 modeled members, strict limits, headers, ownership, and native/lightweight execution, and record the client-only coverage boundary.

24. c361be0d
    Problem: lifecycle configuration writes remain model-only

    The current PutBucketLifecycleConfiguration operation has no exact typed low-level or provider-owned composable client, leaving callers without bounded serialization, request-checksum projection, or mutation certainty.

    Solution: add the complete lifecycle configuration write client

    Serialize the pinned request graph, add explicit low-level and provider-owned one-shot APIs, and qualify model identity, limits, signing, certainty, native/lightweight sockets, documentation, and coverage.

25. 735fb607
    Problem: Current bucket notification configuration lacks a complete composable client

    The current GetBucketNotificationConfiguration and
    PutBucketNotificationConfiguration operations remain partial in the S3 ledger.
    Callers cannot preserve the full destination and filter graph or use the
    provider-owned limited constructor, reusable initiation, typed Finish, and
    same-state-machine synchronous forms with explicit mutation certainty.

    Solution: Add strict current notification GET and PUT clients

    Add the bounded presence-preserving REST/XML codec, exact signed low-level
    preparation and execution, provider-owned GET and non-replaying PUT state
    machines, typed certainty mapping, deterministic model and socket gates, and
    documented coverage. Keep the deprecated notification operations excluded.

1 source commit

1. 5876862c
   Problem: GetBucketReplication lacks a complete composable client contract

   Callers can prepare only part of the operation and cannot receive the pinned
   replication graph through the provider-owned synchronous and composable state
   machine. The coverage corpus therefore cannot qualify the current modeled
   response, strict bounds, or prepared-operation admission boundary.

   Solution: add the bounded provider-owned replication read

   Add a strict presence-preserving replication XML codec, exact low-level
   preparation and decoding, and synchronous, limited-constructor, reusable, and
   typed Finish forms in Client.Buckets. Gate the complete pinned structural
   graph, signed native/lightweight sockets, normalization, bounds, and coverage,
   and document the prose-only cross-field policy boundary.

1 source commit

1. 0673cdad
   Problem: PutBucketReplication lacks a typed bounded replacement API

   Clients can read bucket replication configuration but cannot replace the same complete graph through the provider-owned composable boundary. Callers would otherwise have to assemble signing, one-shot body ownership, response bounds, and mutation certainty themselves, risking replay or an unsound definite-outcome classification.

   Solution: Add nonreplaying provider-owned replication replacement

   Serialize the reviewed presence-sensitive replication graph under caller limits, prepare and sign the exact modeled request, and expose low-level, limited-constructor, operation-last, typed Finish, and synchronous forms over one state machine. Add deterministic model/XML/certainty coverage, native and lightweight signed socket evidence, maintained documentation, and coverage bookkeeping.

5 source commits

1. ded98183
   Problem: Consumer agent resources lag the shared policy

   This repository is pinned to an older flyology-ada/agents revision, so its generated instructions and installed skills omit the current shared assurance workflows.

   Solution: Update the shared agents dependency

   Advance the lockfile to agents revision aa7c026, reinstall the package graph, and regenerate the Codex instructions.

2. c268566a
   Merge pull request #1 from flyology-ada/codex/update-agents-aa7c026

   Update shared agents to aa7c026

3. 4da54070
   Problem: The agents lock retains foundation policy in the TLA+ skill

   This consumer remains pinned to the prior shared agents revision, whose TLA+ workflow includes repository architecture constraints unrelated to using the skill.

   Solution: Update the shared agents lock

   Advance flyology-ada/agents to revision 6a97e7a and record the refined agent-focused TLA+ skill deployment hashes.

4. 1ec12695
   Merge pull request #2 from flyology-ada/codex/update-agents-6a97e7a

   Update shared agents to 6a97e7a

5. aff992c0
   Problem: S3 operation qualification repeats unsynchronized mechanics

   Each new S3 operation manually repeats pinned-model parsing, coverage bookkeeping, verifier registration, corpus ordering, and documentation updates. The duplicated inventories have already drifted and make completing the remaining 116-operation surface slower and easier to misclassify.

   Solution: establish a reviewed operation and evidence registry

   Add a human-owned TOML inventory for all 116 pinned operations, a shared uv-driven model/audit/scaffold/qualify tool, generated coverage counts, test registration, and documentation, plus layer-specific executable-evidence checks and negative oracles. Preserve every existing coverage state and corpus order, use GetBucketReplication as the reviewed equivalence canary, and leave legacy Ada implementations unchanged for incremental family migration.

2 source commits

1. 06c6331a
   Problem: Bounded REST/XML reads duplicate lifecycle mechanics

   Provider operations repeat response buffering, singleton-header validation, hidden HTTP child drain, cancellation, restart cleanup, and typed terminal storage. This slows operation coverage and lets semantically equivalent read paths drift.

   Solution: Share the owner-driven bounded REST/XML read family

   Add an implementation generic for invariant transport and ownership mechanics, then migrate GetBucketReplication as the retrospective canary. Keep provider-owned public signatures, request preparation, decoding, classification, and synchronous-over-composable behavior unchanged, and record executable shared-family provenance in the operation registry.

2. ace67878
   Problem: Hosted tests cannot run the uv operation verifier

   The root test gate invokes the generated S3 operation registry checks through uv, but the hosted test jobs do not install uv. Both Linux and macOS therefore fail after a successful Ada build, leaving the automation foundation unqualified.

   Solution: Install and enforce the reviewed uv toolchain in CI

   Install exact uv 0.11.28 through immutable setup-uv v9.0.0 in the integrity and test jobs. Extend workflow policy and its negative oracle so both the action and tool version remain pinned.

1 source commit

1. f1a2a7b7
   Problem: Signed S3 qualification repeats model-owned mechanics

   Each bounded REST/XML operation manually duplicates exact HTTP targets, signed headers, malformed XML fixtures, socket sequencing, and test registration. Those copies can drift from the pinned Botocore model and make each operation expensive to qualify.

   Solution: Generate data-driven qualification from reviewed decisions

   Derive signed request plans and routine negative XML cases from the pinned model, run them through a shared uv loopback driver and small typed Ada adapter, and register executable evidence from the operation manifest. GetBucketReplication is the retrospective 23-case equivalence canary, while the prospective metrics query oracle verifies reusable canonical query generation.

1 source commit

1. f65afbf2
   Problem: New bounded S3 reads still repeat qualification mechanics

   The shared bounded REST/XML state machine and operation registry establish reusable transport and model evidence, but the first new operation must prove that reviewed API decisions, generated negative XML, signed requests, coverage registration, and documentation can advance without restoring per-operation shell bookkeeping. GetBucketMetricsConfiguration remains partial and invisible to callers until that path is exercised end to end.

   Solution: qualify GetBucketMetricsConfiguration through the shared family

   Add the strict presence-preserving metrics codec and provider-owned low-level, composable, restart, Finish, and synchronous forms over the shared state machine. Record only reviewed semantics and fixtures in the registry, derive the model-owned request and 17 malformed XML cases, run them through a small typed socket adapter, and make the independent coverage oracle discover test trees instead of a maintained filename list. Preserve explicit caller limits and the model's lack of an inferred filter-cardinality or identifier-content constraint.

1 source commit

1. 4e5af762
   Problem: named analytics reads lack composable coverage

   GetBucketAnalyticsConfiguration is tracked by the pinned S3 model but has no
   typed provider API or executable client evidence. Callers cannot perform one
   bounded named analytics read through the shared owner-driven state machine,
   and the operation registry therefore retains partial client coverage.

   Solution: qualify analytics reads through the shared REST/XML family

   Add a strict model-aligned analytics codec, exact low-level preparation and
   decoding, and provider-owned limited, restartable, typed Finish, and
   synchronous forms. Register reviewed signed cases and model-derived negative
   XML evidence, regenerate the coverage artifacts, and document the resulting
   client-only compatibility boundary.

1 source commit

1. 7cbcb44e
   Problem: named Intelligent-Tiering reads lack composable coverage

   GetBucketIntelligentTieringConfiguration is tracked by the pinned S3 model
   but has no typed provider API or executable client evidence. Callers cannot
   perform a bounded named configuration read through the shared owner-driven
   state machine, and registry coverage remains partial.

   Solution: qualify Intelligent-Tiering reads through the shared REST/XML family

   Add a strict model-aligned codec, exact low-level preparation and decoding,
   and provider-owned limited, restartable, typed Finish, and synchronous forms.
   Register reviewed signed cases and model-derived negatives, regenerate
   coverage artifacts, and document client-only compatibility.

1 source commit

1. 9fb63d01
   Problem: GetBucketInventoryConfiguration lacks a qualified client surface

   Callers cannot read named S3 inventory configurations through the provider-
   centric synchronous and composable APIs. The coverage registry therefore keeps
   the operation partial even though it belongs to the established bounded
   REST/XML read family.

   Solution: add the typed inventory read through the shared family

   Add the strict complete inventory codec, exact low-level preparation and
   decoding, provider-owned constructor/restart/Finish/synchronous forms, and
   model-derived negative and signed-socket qualification. Record the reviewed
   model decisions and executable evidence without claiming backend, server, or
   external-provider support.

1 source commit

1. 10d46346
   Problem: GetBucketLogging remains outside the qualified shared read family

   The current development line leaves bucket logging as a partial generated client with no provider-owned composable operation or executable corpus. Its modeled payload also uses a wire-root alias, a nonflattened grant list, and required namespaced attributes that the operation verifier cannot yet qualify without manual negative-case work.

   Solution: Add the strict logging client and extend model-driven qualification

   Add the provider-centric low-level, composable, and synchronous Get_Logging forms over the shared bounded REST/XML read state machine. Decode the complete presence-preserving logging graph, disabled state, exact grantee attributes and enum domains, and modeled errors without adding defaults or replay policy. Extend the uv tool to verify structurally equivalent payload aliases, namespaced attributes, and nonflattened list members, then generate and execute the signed and negative XML evidence and update the coverage and architecture records.

1 source commit

1. f5618821
   Problem: GetBucketWebsite remains outside the qualified shared read family

   The public client and signed corpus leave bucket website configuration unreadable, and the model verifier rejects the operation's documented payload alias even though its wire structure matches the reviewed WebsiteConfiguration shape. Repeating another handwritten bounded REST/XML read would also preserve the rollout bottleneck.

   Solution: Add a strict provider-owned website read and model-driven evidence

   Add the presence-preserving Website configuration codec, low-level and provider-owned composable/synchronous calls, generated negative XML and signed-socket qualification, and registry coverage. Verify payload aliases structurally while ignoring documentation-only differences and retaining all wire traits, so the shared bounded read family can qualify the operation without semantic drift.

1 source commit

1. d0fd10d7
   Problem: Paginated configuration reads repeat an unqualified XML envelope

   The remaining bucket-configuration list operations share strict REST/XML page mechanics, request continuation projection, bounded response ownership, and signed qualification structure. Reimplementing those mechanics operation by operation slows coverage work and risks semantic or evidence drift.

   Solution: Add a shared strict page family and qualify Metrics as its canary

   Add a private paginated REST/XML envelope generic, reuse the reviewed metrics item codec, and expose provider-owned one-page synchronous and composable ListBucketMetricsConfigurations calls over the existing bounded read state machine. Record reviewed manifest decisions and generate the model-derived negative XML, signed socket, coverage, registration, and documentation evidence, while keeping continuation caller-driven and public policy unchanged.

1 source commit

1. f28a3fb6
   Problem: Analytics configuration pages remain outside the shared read family

   ListBucketAnalyticsConfigurations is still represented only by model inventory, so callers lack a qualified one-page provider API and each future implementation risks repeating page-envelope, ownership, and evidence mechanics.

   Solution: Qualify Analytics through the paginated REST/XML family

   Reuse the reviewed analytics item decoder inside the shared strict page envelope, add exact low-level and provider-owned synchronous/composable calls over the existing bounded state machine, and generate the model-derived negative, signed-socket, coverage, registration, and documentation evidence from reviewed manifest decisions.

1 source commit

1. b03cb81d
   Problem: process-isolated consumers require private trace codecs

   The public trace API only accepts paths and only writes prefixes to files, while result artifacts can be encoded but not strictly decoded. Consumers embedding shared evidence in their own process envelopes must use temporary files or duplicate the versioned JSON contracts, and the schema invalid-trace verdict is not representable in Ada.

   Solution: expose strict in-memory trace and result boundaries

   Add bounded trace Parse and canonical Image operations with the file APIs delegating to them. Add strict result decoding with trace identity binding, represent every schema verdict, document the envelope workflow, and cover canonical round trips plus unknown and duplicate member rejection.

1 source commit

1. e75b8483
   Problem: trace provenance omits resolved model inputs

   Trace version 1 binds only one caller-supplied source digest and a configuration name. Consumers with EXTENDS closures can therefore regenerate evidence after a helper or configuration change without changing the recorded model identity. Typed generation and trace normalization also compute provenance through different paths.

   Solution: bind the resolved model closure and configuration bytes

   Add trace version 2 and an authoritative SANY-backed model identity command. Share the constrained semantic export across normalization and typed generation, retain strict trace version 1 reads, and cover deterministic closure hashing, configuration hashing, schemas, compatibility, and the actual TLC/Ada/TLAPM example.

1 source commit

1. faf06c48
   Problem: Replay results lose observations after adapters exit

   The result/1 contract records the exact trace and stable failure identity, but a process holding only those artifacts cannot report the adapter outcome and state at the completed divergent comparison. Current consumers must remain able to emit and strictly parse result/1 while they migrate independently.

   Solution: Add an explicit bounded result/2 comparison contract

   Introduce a source-compatible Replay_Result_V2 API with typed initial and step observations, strict version-specific encoding and decoding, canonical embedded JSON, schema and fixtures, human reporting, and replay/CLI overloads. Keep expected values authoritative in the SHA-256-bound trace, reject impossible observation/verdict combinations, and leave adapter errors and invalid traces observation-free.

3 source commits

1. f639c4bf
   Problem: Lifecycle observers can leak retained wait capacity on abort

   Supervisor monitor registration and scoped task-result attachment can publish a retained runtime resource before their Ada controlled guards own it. Abort in that boundary can strand a monitor slot or sidecar reference, preventing later exact-generation observation and making remoting lifecycle cleanup unsafe.

   Solution: Publish lifecycle wait ownership atomically

   Move supervisor guard ownership into the protected monitor-registration cut, defer abort through task-result retain publication, and add statically elided deterministic abort barriers. The focused fixtures prove exact cleanup and capacity reuse for Static, Families, task-id waits, and retained-monitor waits while production builds contain no hook references.

2. 954a4392
   Problem: Supervised task starts cannot remain blocked through authorization

   Remoting needs a bounded one-shot admission owner and an exact lifecycle observation that survive abort, shutdown, restart, and slot reuse. Families currently queue accepted requests immediately, while ordinary generation waits cannot retain one admission epoch across replacement publication.

   Solution: Add prepared family admissions and scoped exact observation

   Add the optional Prepared_Admissions child over existing Family slots and monitor capacity, abort-safe prepare/commit/release/cancel ownership cuts, coherent exact-epoch lifecycle observation, bounded wake publication, deterministic fault/lifetime/generation coverage, and public architecture documentation.

3. ca8c23a8
   Merge pull request #85 from flyology-ada/codex/remoting-prepared-admissions

   Add prepared family admissions and scoped lifecycle observation

2 source commits

1. 49960169
   Problem: Prepared admissions hide the reserved handle before commit

   Callers that must authorize, bind, or publish an exact supervised child identity while a request remains prepared cannot inspect its Child_Handle until ownership moves into Started_Admission. Remoting task admission therefore cannot validate the reserved controller, child, and generation before committing the launch.

   Solution: Expose the prepared claim's exact first handle

   Add the Start_Claim overload of First_Handle with the active-owner precondition used by Started_Admission. Document that Commit_Start transfers admission ownership while preserving the handle identity, and verify exact identity plus rollback/reprepare generation advancement.

2. bd95746d
   Merge pull request #86 from flyology-ada/codex/prepared-admission-first-handle

   Expose prepared admission handle before commit

3 source commits

1. f639c4bf
   Problem: Lifecycle observers can leak retained wait capacity on abort

   Supervisor monitor registration and scoped task-result attachment can publish a retained runtime resource before their Ada controlled guards own it. Abort in that boundary can strand a monitor slot or sidecar reference, preventing later exact-generation observation and making remoting lifecycle cleanup unsafe.

   Solution: Publish lifecycle wait ownership atomically

   Move supervisor guard ownership into the protected monitor-registration cut, defer abort through task-result retain publication, and add statically elided deterministic abort barriers. The focused fixtures prove exact cleanup and capacity reuse for Static, Families, task-id waits, and retained-monitor waits while production builds contain no hook references.

2. 954a4392
   Problem: Supervised task starts cannot remain blocked through authorization

   Remoting needs a bounded one-shot admission owner and an exact lifecycle observation that survive abort, shutdown, restart, and slot reuse. Families currently queue accepted requests immediately, while ordinary generation waits cannot retain one admission epoch across replacement publication.

   Solution: Add prepared family admissions and scoped exact observation

   Add the optional Prepared_Admissions child over existing Family slots and monitor capacity, abort-safe prepare/commit/release/cancel ownership cuts, coherent exact-epoch lifecycle observation, bounded wake publication, deterministic fault/lifetime/generation coverage, and public architecture documentation.

3. ca8c23a8
   Merge pull request #85 from flyology-ada/codex/remoting-prepared-admissions

   Add prepared family admissions and scoped lifecycle observation

2 source commits

1. 49960169
   Problem: Prepared admissions hide the reserved handle before commit

   Callers that must authorize, bind, or publish an exact supervised child identity while a request remains prepared cannot inspect its Child_Handle until ownership moves into Started_Admission. Remoting task admission therefore cannot validate the reserved controller, child, and generation before committing the launch.

   Solution: Expose the prepared claim's exact first handle

   Add the Start_Claim overload of First_Handle with the active-owner precondition used by Started_Admission. Document that Commit_Start transfers admission ownership while preserving the handle identity, and verify exact identity plus rollback/reprepare generation advancement.

2. bd95746d
   Merge pull request #86 from flyology-ada/codex/prepared-admission-first-handle

   Expose prepared admission handle before commit

3 source commits

1. f639c4bf
   Problem: Lifecycle observers can leak retained wait capacity on abort

   Supervisor monitor registration and scoped task-result attachment can publish a retained runtime resource before their Ada controlled guards own it. Abort in that boundary can strand a monitor slot or sidecar reference, preventing later exact-generation observation and making remoting lifecycle cleanup unsafe.

   Solution: Publish lifecycle wait ownership atomically

   Move supervisor guard ownership into the protected monitor-registration cut, defer abort through task-result retain publication, and add statically elided deterministic abort barriers. The focused fixtures prove exact cleanup and capacity reuse for Static, Families, task-id waits, and retained-monitor waits while production builds contain no hook references.

2. 954a4392
   Problem: Supervised task starts cannot remain blocked through authorization

   Remoting needs a bounded one-shot admission owner and an exact lifecycle observation that survive abort, shutdown, restart, and slot reuse. Families currently queue accepted requests immediately, while ordinary generation waits cannot retain one admission epoch across replacement publication.

   Solution: Add prepared family admissions and scoped exact observation

   Add the optional Prepared_Admissions child over existing Family slots and monitor capacity, abort-safe prepare/commit/release/cancel ownership cuts, coherent exact-epoch lifecycle observation, bounded wake publication, deterministic fault/lifetime/generation coverage, and public architecture documentation.

3. ca8c23a8
   Merge pull request #85 from flyology-ada/codex/remoting-prepared-admissions

   Add prepared family admissions and scoped lifecycle observation

2 source commits

1. 49960169
   Problem: Prepared admissions hide the reserved handle before commit

   Callers that must authorize, bind, or publish an exact supervised child identity while a request remains prepared cannot inspect its Child_Handle until ownership moves into Started_Admission. Remoting task admission therefore cannot validate the reserved controller, child, and generation before committing the launch.

   Solution: Expose the prepared claim's exact first handle

   Add the Start_Claim overload of First_Handle with the active-owner precondition used by Started_Admission. Document that Commit_Start transfers admission ownership while preserving the handle identity, and verify exact identity plus rollback/reprepare generation advancement.

2. bd95746d
   Merge pull request #86 from flyology-ada/codex/prepared-admission-first-handle

   Expose prepared admission handle before commit

3 source commits

1. f639c4bf
   Problem: Lifecycle observers can leak retained wait capacity on abort

   Supervisor monitor registration and scoped task-result attachment can publish a retained runtime resource before their Ada controlled guards own it. Abort in that boundary can strand a monitor slot or sidecar reference, preventing later exact-generation observation and making remoting lifecycle cleanup unsafe.

   Solution: Publish lifecycle wait ownership atomically

   Move supervisor guard ownership into the protected monitor-registration cut, defer abort through task-result retain publication, and add statically elided deterministic abort barriers. The focused fixtures prove exact cleanup and capacity reuse for Static, Families, task-id waits, and retained-monitor waits while production builds contain no hook references.

2. 954a4392
   Problem: Supervised task starts cannot remain blocked through authorization

   Remoting needs a bounded one-shot admission owner and an exact lifecycle observation that survive abort, shutdown, restart, and slot reuse. Families currently queue accepted requests immediately, while ordinary generation waits cannot retain one admission epoch across replacement publication.

   Solution: Add prepared family admissions and scoped exact observation

   Add the optional Prepared_Admissions child over existing Family slots and monitor capacity, abort-safe prepare/commit/release/cancel ownership cuts, coherent exact-epoch lifecycle observation, bounded wake publication, deterministic fault/lifetime/generation coverage, and public architecture documentation.

3. ca8c23a8
   Merge pull request #85 from flyology-ada/codex/remoting-prepared-admissions

   Add prepared family admissions and scoped lifecycle observation

2 source commits

1. 49960169
   Problem: Prepared admissions hide the reserved handle before commit

   Callers that must authorize, bind, or publish an exact supervised child identity while a request remains prepared cannot inspect its Child_Handle until ownership moves into Started_Admission. Remoting task admission therefore cannot validate the reserved controller, child, and generation before committing the launch.

   Solution: Expose the prepared claim's exact first handle

   Add the Start_Claim overload of First_Handle with the active-owner precondition used by Started_Admission. Document that Commit_Start transfers admission ownership while preserving the handle identity, and verify exact identity plus rollback/reprepare generation advancement.

2. bd95746d
   Merge pull request #86 from flyology-ada/codex/prepared-admission-first-handle

   Expose prepared admission handle before commit

3 source commits

1. f639c4bf
   Problem: Lifecycle observers can leak retained wait capacity on abort

   Supervisor monitor registration and scoped task-result attachment can publish a retained runtime resource before their Ada controlled guards own it. Abort in that boundary can strand a monitor slot or sidecar reference, preventing later exact-generation observation and making remoting lifecycle cleanup unsafe.

   Solution: Publish lifecycle wait ownership atomically

   Move supervisor guard ownership into the protected monitor-registration cut, defer abort through task-result retain publication, and add statically elided deterministic abort barriers. The focused fixtures prove exact cleanup and capacity reuse for Static, Families, task-id waits, and retained-monitor waits while production builds contain no hook references.

2. 954a4392
   Problem: Supervised task starts cannot remain blocked through authorization

   Remoting needs a bounded one-shot admission owner and an exact lifecycle observation that survive abort, shutdown, restart, and slot reuse. Families currently queue accepted requests immediately, while ordinary generation waits cannot retain one admission epoch across replacement publication.

   Solution: Add prepared family admissions and scoped exact observation

   Add the optional Prepared_Admissions child over existing Family slots and monitor capacity, abort-safe prepare/commit/release/cancel ownership cuts, coherent exact-epoch lifecycle observation, bounded wake publication, deterministic fault/lifetime/generation coverage, and public architecture documentation.

3. ca8c23a8
   Merge pull request #85 from flyology-ada/codex/remoting-prepared-admissions

   Add prepared family admissions and scoped lifecycle observation

2 source commits

1. 49960169
   Problem: Prepared admissions hide the reserved handle before commit

   Callers that must authorize, bind, or publish an exact supervised child identity while a request remains prepared cannot inspect its Child_Handle until ownership moves into Started_Admission. Remoting task admission therefore cannot validate the reserved controller, child, and generation before committing the launch.

   Solution: Expose the prepared claim's exact first handle

   Add the Start_Claim overload of First_Handle with the active-owner precondition used by Started_Admission. Document that Commit_Start transfers admission ownership while preserving the handle identity, and verify exact identity plus rollback/reprepare generation advancement.

2. bd95746d
   Merge pull request #86 from flyology-ada/codex/prepared-admission-first-handle

   Expose prepared admission handle before commit

3 source commits

1. f639c4bf
   Problem: Lifecycle observers can leak retained wait capacity on abort

   Supervisor monitor registration and scoped task-result attachment can publish a retained runtime resource before their Ada controlled guards own it. Abort in that boundary can strand a monitor slot or sidecar reference, preventing later exact-generation observation and making remoting lifecycle cleanup unsafe.

   Solution: Publish lifecycle wait ownership atomically

   Move supervisor guard ownership into the protected monitor-registration cut, defer abort through task-result retain publication, and add statically elided deterministic abort barriers. The focused fixtures prove exact cleanup and capacity reuse for Static, Families, task-id waits, and retained-monitor waits while production builds contain no hook references.

2. 954a4392
   Problem: Supervised task starts cannot remain blocked through authorization

   Remoting needs a bounded one-shot admission owner and an exact lifecycle observation that survive abort, shutdown, restart, and slot reuse. Families currently queue accepted requests immediately, while ordinary generation waits cannot retain one admission epoch across replacement publication.

   Solution: Add prepared family admissions and scoped exact observation

   Add the optional Prepared_Admissions child over existing Family slots and monitor capacity, abort-safe prepare/commit/release/cancel ownership cuts, coherent exact-epoch lifecycle observation, bounded wake publication, deterministic fault/lifetime/generation coverage, and public architecture documentation.

3. ca8c23a8
   Merge pull request #85 from flyology-ada/codex/remoting-prepared-admissions

   Add prepared family admissions and scoped lifecycle observation

2 source commits

1. 49960169
   Problem: Prepared admissions hide the reserved handle before commit

   Callers that must authorize, bind, or publish an exact supervised child identity while a request remains prepared cannot inspect its Child_Handle until ownership moves into Started_Admission. Remoting task admission therefore cannot validate the reserved controller, child, and generation before committing the launch.

   Solution: Expose the prepared claim's exact first handle

   Add the Start_Claim overload of First_Handle with the active-owner precondition used by Started_Admission. Document that Commit_Start transfers admission ownership while preserving the handle identity, and verify exact identity plus rollback/reprepare generation advancement.

2. bd95746d
   Merge pull request #86 from flyology-ada/codex/prepared-admission-first-handle

   Expose prepared admission handle before commit

1 source commit

1. aa799686
   Problem: clean hosted checkouts cannot complete the publication gates

   Strict Linux C compilation hides kill without an explicit POSIX feature contract, the proof project cannot locate an indirect Flyology project in Alire's shared cache, and shallow test checkouts cannot validate retained benchmark ancestry. The first public main CI therefore fails despite the locally qualified implementation.

   Solution: make clean-checkout requirements explicit

   Expose the POSIX.1-2008 declaration set locally in the durability bridge, prepend Alire's exported Flyology root only for maintained proof invocations, and fetch complete history for the test job that validates retained provenance.

1 source commit

1. 98383e48
   Problem: clean hosted qualification depends on unused and fragile build paths

   Linux SQLite consumers inherit an unnecessary libm link from the optional FTS5 module, while the proof gate imports Flyology through a transitive cache location that Alire does not expose consistently in clean hosted workspaces. This prevents the published development line from completing its maintained SQLite and SPARK gates.

   Solution: narrow SQLite features and import the direct proof closure

   Disable the unused FTS5 extension instead of adding a compensating linker dependency. Make the proof project import the direct HTTP and XML project dependencies, and let the maintained script invoke GNATprove directly without reconstructing a transitive cache path.

1 source commit

1. 3455cde3
   Problem: proof-only checkouts resolve dependencies before materialization

   A clean hosted proof job invokes Alire execution before dependency build roots and generated configuration exist. The resulting GPR search path names directories that have not been synchronized, so GNATprove cannot load the direct HTTP and XML project closure.

   Solution: materialize the proof dependency closure before analysis

   Run Alire through the pre-build stage before GNATprove. This synchronizes dependencies and runs configuration actions without compiling the Object Storage library; GNATprove remains the analyzer for the selected proof units.

5 source commits

1. 09e6eac2
   Problem: DeleteBucket cannot compose with owner-driven callers

   The bucket lifecycle client exposes deletion only through blocking execution, so callers cannot share a Completion_Set and HTTP owner while retaining typed admission certainty across a possibly admitted mutation.

   Solution: Add one provider-owned non-replaying DeleteBucket operation

   Add the limited constructor, operation-last reusable initiation, typed Finish, and synchronous wait on one state machine. Use a non-rewindable empty source, bounded response retention, conservative deletion certainty, signed socket and normalization corpora, and maintainer documentation.

2. 22fec71c
   Problem: GetBucketLocation cannot compose with owner-driven callers

   The bucket provider exposes only blocking location discovery even though callers need the raw bounded response while coordinating related operations in one Completion_Set. They must either block outside their state machine or bypass the provider-owned certainty, cancellation, and response-decoding contract.

   Solution: add one provider-owned bounded location read

   Add limited-root and operation-last Get_Location forms, a typed Finish result, and the matching prepared low-level initiator. Make the typed synchronous and legacy convenience overloads wait on the same bounded owner-driven state machine, preserve established defaults and legacy region normalization, retain no borrowed request input after signing, and leave safe GET recovery to Flyology HTTP. Gate exact response/failure normalization, expected-owner signing, fragmented XML, restart, documentation, full deterministic tests, and the warning-strict 936-check proof campaign.

3. c0bae328
   Problem: GetBucketVersioning cannot compose with owner-driven callers

   Bucket-version reconciliation is available only through a blocking call, so structured callers cannot share a completion set, deadline, cancellation owner, or reusable operation while preserving the modeled response and HTTP failure evidence.

   Solution: add one provider-owned bounded versioning read

   Add limited-root and operation-last Get_Versioning forms with typed Finish in Client.Buckets, drive the prepared request through the shared HTTP state machine, retain XML under the versioning codec bound, preserve the established synchronous behavior, and qualify normalization, restart, documentation, and signed socket behavior.

4. 39f97288
   Problem: PutBucketVersioning cannot compose without replay ambiguity

   Bucket-version updates are available only through blocking execution, so structured callers cannot own deadline, cancellation, and restart state or retain typed admission certainty for reconciliation.

   Solution: add one provider-owned nonreplaying versioning mutation

   Add limited-root and operation-last Set_Versioning_Configuration with typed Finish, move synchronous execution onto the same owned one-shot source, preserve exact certainty mapping, and qualify normalization, restart, documentation, signed sockets, and proof.

5. 1978275b
   Problem: GetBucketPolicy cannot compose with owner-driven callers

   Bucket-policy retrieval is available only through blocking execution, so structured callers cannot retain typed HTTP state, caller-selected response bounds, cancellation, and restart ownership in a larger operation graph.

   Solution: add one provider-owned bounded policy read

   Add limited-root and operation-last Get_Policy with typed Finish, route the synchronous parameter-record overload through the same state machine, enforce exact prepared-operation identity, and qualify normalization, bounds, restart, documentation, signed sockets, and proof.

9 source commits

1. 0da1b4f7
   Problem: bucket policy mutations cannot join caller-owned operation graphs

   Callers can read bucket policies compositionally, but replacement and deletion still use separate blocking transport paths. That prevents provider-centric operation reuse, obscures admission certainty after ambiguous mutations, and leaves a socket-corpus startup failure able to strand clients before the server publishes its port.

   Solution: add provider-owned nonreplaying policy mutations

   Add limited Set_Policy and Delete_Policy roots, operation-last reusable initiation, typed Finish/results, exact low-level prepared-operation binding, and synchronous waits over the same one-shot state machines. Preserve owned payloads, caller-selected bounds, admission certainty, and read-only reconciliation rules; extend the signed corpus and make pre-publication server failure wake waiting clients deterministically.

2. 5503d9d0
   Problem: Files benchmark durability provenance contradicts runtime policy

   The implementation manifest labels the Flyology files lane as not power durable even though its server uses the production durability policy. Campaign metadata also leaves that selected policy implicit, allowing later comparisons to overstate or misclassify durability equivalence.

   Solution: Pin and retain the production durability selection

   Label the matrix lane power-loss-durable, pass Power_Loss_Durable explicitly to the files server, record the exact commit policy in both retained matrix metadata streams, and gate the metadata field. Clarify the guide while leaving immutable historical evidence unchanged.

3. 3453828c
   Problem: Public access controls cannot join composed client workflows

   PutPublicAccessBlock, GetPublicAccessBlock, and DeletePublicAccessBlock are available through synchronous helpers but not through the provider-owned operation model. Callers cannot compose these security controls with their completion sets, and mutation failures lack the typed certainty needed to choose read-only reconciliation without replay.

   Solution: Add provider-owned public access block operations

   Add limited constructors, operation-last restart procedures, typed Finish results, and synchronous waits on the same Client.Buckets state machines. Keep mutation bodies non-rewindable, preserve admission certainty and bounded same-response reads, reject mismatched prepared operations before HTTP admission, and cover lifecycle, restart, certainty, and documentation contracts.

4. 551d514d
   Problem: Ownership controls reads cannot join composed client workflows

   Callers can retrieve bucket ownership controls only through the blocking low-level executor, so owner-driven operation graphs cannot compose the read, preserve typed HTTP failure context, or reuse an established parent operation.

   Solution: colocate bounded Ownership Controls reads with the Buckets provider

   Add limited and operation-last provider forms, typed Finish and synchronous waiting over the same state machine, an exact prepared-request initiator, bounded same-response decoding, restart and operation-identity tests, and matching architecture and compatibility evidence.

5. 07269323
   Problem: Ownership controls writes cannot join composed client workflows

   PutBucketOwnershipControls is available only through a blocking executor, so owner-driven callers cannot retain typed admission certainty or reconcile ambiguous publication without leaving the provider API.

   Solution: add a non-replaying Ownership Controls mutation state machine

   Colocate limited, operation-last, Finish, and synchronous forms in Client.Buckets; expose an exact low-level initiator; retain serialized bytes through terminal drain; classify only response-observed exact rejections as definitely not applied; and gate operation identity, restart, wire behavior, and the complete admission-certainty matrix.

6. 33b28a12
   Problem: Ownership controls deletion cannot join composed workflows

   DeleteBucketOwnershipControls still uses the generic blocking configuration path, so composed callers cannot retain typed admission certainty, reuse an established operation, or reconcile an ambiguous deletion through the owning provider.

   Solution: complete the provider-owned Ownership Controls trio

   Add a non-replaying Delete operation with limited and operation-last forms, typed Finish and synchronous waiting; rewrite the existing convenience call through that state machine; expose exact low-level initiation; and gate operation identity, restart, wire behavior, and exhaustive certainty normalization.

7. da5c057f
   Problem: Bucket encryption reads cannot join composed workflows

   GetBucketEncryption is available only through the blocking executor, so owner-driven callers cannot compose its bounded response, cancellation, and deadline into an existing completion graph.

   Solution: Add a provider-owned Get_Encryption operation

   Add the exact low-level prepared initiator, limited and reusable provider overloads, typed Finish and synchronous wait over one bounded state machine. Cover exact-operation rejection, restart, response normalization, certainty, signed socket behavior, and document the expanded provider surface.

8. e00ca596
   Problem: Bucket encryption deletion cannot join composed workflows

   DeleteBucketEncryption uses the blocking configuration dispatcher, so owner-driven callers cannot compose its one-shot mutation, deadline, cancellation, and admission certainty into an existing completion graph.

   Solution: Add a provider-owned Delete_Encryption operation

   Add the exact low-level initiator, limited and reusable provider overloads, typed Finish, and synchronous waits over one non-replaying state machine. Preserve the legacy Delete_Outcome surface through that same engine, remove its dead blocking branch, and cover exact binding, restart, certainty, response classes, and signed socket behavior.

9. 179b16c4
   Problem: HTTP dependency oracles retain the pre-hook-selection origin

   The five no-pin solve roots now select the published HTTP/QUIC 0.1.3-dev source that removes hook preprocessing, while CI and maintained prose still assert the previous flattened-client origin.

   Solution: Advance the tracked HTTP origin qualification

   Update CI and maintainer documentation to exact eb09a80, retain exact current-dev constraints and no external pins, and align nearby composable terminology with the provider-centric API.

8 source commits

1. db16a412
   Problem: PutBucketCors cannot join composed client workflows

   The existing CORS client can read and delete configurations, but callers cannot publish a complete configuration through the provider-owned operation model. They cannot retain typed admission certainty, restart an established component, or prove that the exact modeled request graph is covered without falling back to a separate blocking path.

   Solution: add one provider-owned nonreplaying CORS mutation

   Serialize the pinned flattened CORS graph within caller-selected XML limits, prepare and execute one-shot signed requests, and colocate limited, operation-last, typed Finish, and synchronous Set_CORS forms in Client.Buckets. Add reciprocal model ledgers, deterministic and signed socket corpora, certainty normalization, coverage accounting, GNATdoc, and maintainer qualification evidence.

2. df9d0d49
   Problem: CORS reads and deletions cannot join composed workflows

   GetBucketCors and DeleteBucketCors stop at synchronous execution even though their provider already owns exact prepared requests and bounded response decoding. Callers cannot reuse them inside completion-set state machines, and synchronous deletion does not share typed admission certainty with the composable client vocabulary.

   Solution: colocate composable CORS reads and deletions with Client.Buckets

   Add exact low-level initiators and provider-owned limited constructors, operation-last reusable procedures, typed Finish results, and synchronous waits on the same state machines. Preserve bounded decoding, non-replaying empty deletion bodies, admission certainty, and conservative outcome mapping, with signed socket, restart, mismatch, capacity, documentation, and normalization coverage.

3. b30f0812
   Problem: Object Legal Hold cannot join composed client workflows

   GetObjectLegalHold and PutObjectLegalHold stop at blocking low-level execution, forcing callers to leave provider-owned completion sets and obscuring mutation admission certainty.

   Solution: colocate owner-driven Legal Hold operations in Client.Objects

   Add exact prepared-request initiators, limited constructors, operation-last restart, typed Finish, shared synchronous waits, an owned nonreplayable mutation source, bounded response sinks, certainty normalization, signed socket and negative corpora, and maintainer documentation.

4. 1160fd60
   Problem: Object Retention cannot join composed client workflows

   GetObjectRetention and PutObjectRetention are available only through blocking client entry points, so completion-set state machines cannot compose exact-version retention reads or mutations without inventing a parallel wrapper. That obscures provider ownership and prevents typed admission certainty from flowing through caller-owned scheduling.

   Solution: colocate Retention operations with Client.Objects

   Add exact prepared-request initiators plus provider-owned limited constructors, operation-last reusable initiation, typed Finish, and synchronous waits driven by the same bounded state machines. Own the Put XML in a non-rewindable source, preserve conservative post-admission mutation certainty, require generation-bound read reconciliation, and gate restart, exact operation binding, normalization, and one-past response limits under native and lightweight owners.

5. aa0a3693
   Problem: Object Lock configuration cannot join composed client workflows

   GetObjectLockConfiguration and PutObjectLockConfiguration expose only blocking execution, so completion-set state machines cannot own their lifetime, drain, certainty, and bounded response handling through the bucket provider.

   Solution: colocate owner-driven Object Lock configuration operations in Client.Buckets

   Add exact Low_Level prepared-request initiators, limited constructors, operation-last reusable procedures, typed Finish results, and synchronous waits over the same state machines. Preserve bounded same-response reads, one-shot non-replaying mutation ownership, conservative admission certainty, and read-only reconciliation, with strict socket, certainty, documentation, and API gates.

6. d1dee5be
   Problem: PutBucketEncryption cannot join composed client workflows

   Callers can prepare and execute bucket-encryption updates synchronously, but they cannot schedule the mutation beside other owner-driven operations without rebuilding its signing, body-lifetime, and publication-certainty rules.

   Solution: add one nonreplaying provider-owned encryption mutation

   Serialize the pinned presence-sensitive configuration into caller-bounded XML, retain its exact signed bytes in the parent operation, expose limited and operation-last Set_Encryption forms with typed Finish, and make the synchronous form wait on that same state machine. Add reciprocal model inventories, deterministic and signed-socket corpora, certainty normalization coverage, qualification evidence, and honest client-only compatibility claims.

7. 0956dcd3
   Problem: completed composable controls remain split from main

   The reviewed CORS, Object Lock configuration, Legal Hold, and Retention operation families live on a parallel lineage, while main independently adds PutBucketEncryption. Leaving the lineages separate prevents exact-tree qualification and publication of the complete provider-owned surface.

   Solution: integrate both composable lineages without narrowing either contract

   Retain every prepared initiator, provider-owned limited constructor, operation-last restart, typed Finish, synchronous wait, corpus, and qualification record from both sides. Reconcile the operation inventory at 52 provider operations and 49 prepared initiators while preserving the explicit three-call projection difference and all nonreplay, ownership, deadline, and certainty rules.

8. 4401e0ec
   Problem: invalid-startup tests leak an admin credential into the checkout

   Configuration-rejection cases can reach credential bootstrap before failing, which leaves a generated credentials file in the repository root and dirties an otherwise clean qualification tree.

   Solution: isolate rejected-startup credentials in the test run directory

   Give every expected-failure launch its own credentials path under RUN_ROOT so bootstrap artifacts are removed with the maintained test workspace.

1 source commit

1. 99706cce
   Problem: bucket CORS stops at the client boundary

   PutBucketCors, GetBucketCors, and DeleteBucketCors have complete clients and signed corpora, but authenticated servers cannot execute them and no backend retains their state. Deployments therefore cannot provide the full configuration lifecycle even though callers can construct every request.

   Solution: complete bucket CORS across backends and server

   Add the backend-neutral canonical-document contract and implement atomic memory, files, and SQLite persistence. Route authenticated server PUT, GET, and DELETE with strict query, owner, checksum, XML, and absence handling. Advance SQLite to schema 13, add migration, corruption, symlink, capacity, restart, and 132-case abrupt-crash evidence, update compatibility and coverage, and qualify the exact tree through full tests, server/provider gates, GNATdoc, and 936/936 SPARK checks.

1 source commit

1. 6ec20483
   Problem: Private ACL reads have no authenticated server route

   The qualified client and ACL codec cannot read bucket or object ACLs from Flyology servers, even though the existing single-tenant mutation profile admits only private ownership. Raw subresource routing must also prevent encoded ACL queries from falling through to ordinary mutations.

   Solution: Derive owner-only ACL responses in the S3 application

   Route authenticated GetBucketAcl and version-selecting GetObjectAcl calls to backend existence reads, synthesize the exact CanonicalUser FULL_CONTROL policy from the stable tenant principal, and reject ACL mutations without publication. Add strict query, authorization, owner, payer, body, error-classification, encoded-subresource, in-process, and real-server socket gates; promote only the server coverage cells while leaving ACL persistence unclaimed.

1 source commit

1. aa799686
   Problem: clean hosted checkouts cannot complete the publication gates

   Strict Linux C compilation hides kill without an explicit POSIX feature contract, the proof project cannot locate an indirect Flyology project in Alire's shared cache, and shallow test checkouts cannot validate retained benchmark ancestry. The first public main CI therefore fails despite the locally qualified implementation.

   Solution: make clean-checkout requirements explicit

   Expose the POSIX.1-2008 declaration set locally in the durability bridge, prepend Alire's exported Flyology root only for maintained proof invocations, and fetch complete history for the test job that validates retained provenance.

1 source commit

1. 98383e48
   Problem: clean hosted qualification depends on unused and fragile build paths

   Linux SQLite consumers inherit an unnecessary libm link from the optional FTS5 module, while the proof gate imports Flyology through a transitive cache location that Alire does not expose consistently in clean hosted workspaces. This prevents the published development line from completing its maintained SQLite and SPARK gates.

   Solution: narrow SQLite features and import the direct proof closure

   Disable the unused FTS5 extension instead of adding a compensating linker dependency. Make the proof project import the direct HTTP and XML project dependencies, and let the maintained script invoke GNATprove directly without reconstructing a transitive cache path.

1 source commit

1. 3455cde3
   Problem: proof-only checkouts resolve dependencies before materialization

   A clean hosted proof job invokes Alire execution before dependency build roots and generated configuration exist. The resulting GPR search path names directories that have not been synchronized, so GNATprove cannot load the direct HTTP and XML project closure.

   Solution: materialize the proof dependency closure before analysis

   Run Alire through the pre-build stage before GNATprove. This synchronizes dependencies and runs configuration actions without compiling the Object Storage library; GNATprove remains the analyzer for the selected proof units.

5 source commits

1. 09e6eac2
   Problem: DeleteBucket cannot compose with owner-driven callers

   The bucket lifecycle client exposes deletion only through blocking execution, so callers cannot share a Completion_Set and HTTP owner while retaining typed admission certainty across a possibly admitted mutation.

   Solution: Add one provider-owned non-replaying DeleteBucket operation

   Add the limited constructor, operation-last reusable initiation, typed Finish, and synchronous wait on one state machine. Use a non-rewindable empty source, bounded response retention, conservative deletion certainty, signed socket and normalization corpora, and maintainer documentation.

2. 22fec71c
   Problem: GetBucketLocation cannot compose with owner-driven callers

   The bucket provider exposes only blocking location discovery even though callers need the raw bounded response while coordinating related operations in one Completion_Set. They must either block outside their state machine or bypass the provider-owned certainty, cancellation, and response-decoding contract.

   Solution: add one provider-owned bounded location read

   Add limited-root and operation-last Get_Location forms, a typed Finish result, and the matching prepared low-level initiator. Make the typed synchronous and legacy convenience overloads wait on the same bounded owner-driven state machine, preserve established defaults and legacy region normalization, retain no borrowed request input after signing, and leave safe GET recovery to Flyology HTTP. Gate exact response/failure normalization, expected-owner signing, fragmented XML, restart, documentation, full deterministic tests, and the warning-strict 936-check proof campaign.

3. c0bae328
   Problem: GetBucketVersioning cannot compose with owner-driven callers

   Bucket-version reconciliation is available only through a blocking call, so structured callers cannot share a completion set, deadline, cancellation owner, or reusable operation while preserving the modeled response and HTTP failure evidence.

   Solution: add one provider-owned bounded versioning read

   Add limited-root and operation-last Get_Versioning forms with typed Finish in Client.Buckets, drive the prepared request through the shared HTTP state machine, retain XML under the versioning codec bound, preserve the established synchronous behavior, and qualify normalization, restart, documentation, and signed socket behavior.

4. 39f97288
   Problem: PutBucketVersioning cannot compose without replay ambiguity

   Bucket-version updates are available only through blocking execution, so structured callers cannot own deadline, cancellation, and restart state or retain typed admission certainty for reconciliation.

   Solution: add one provider-owned nonreplaying versioning mutation

   Add limited-root and operation-last Set_Versioning_Configuration with typed Finish, move synchronous execution onto the same owned one-shot source, preserve exact certainty mapping, and qualify normalization, restart, documentation, signed sockets, and proof.

5. 1978275b
   Problem: GetBucketPolicy cannot compose with owner-driven callers

   Bucket-policy retrieval is available only through blocking execution, so structured callers cannot retain typed HTTP state, caller-selected response bounds, cancellation, and restart ownership in a larger operation graph.

   Solution: add one provider-owned bounded policy read

   Add limited-root and operation-last Get_Policy with typed Finish, route the synchronous parameter-record overload through the same state machine, enforce exact prepared-operation identity, and qualify normalization, bounds, restart, documentation, signed sockets, and proof.

9 source commits

1. 0da1b4f7
   Problem: bucket policy mutations cannot join caller-owned operation graphs

   Callers can read bucket policies compositionally, but replacement and deletion still use separate blocking transport paths. That prevents provider-centric operation reuse, obscures admission certainty after ambiguous mutations, and leaves a socket-corpus startup failure able to strand clients before the server publishes its port.

   Solution: add provider-owned nonreplaying policy mutations

   Add limited Set_Policy and Delete_Policy roots, operation-last reusable initiation, typed Finish/results, exact low-level prepared-operation binding, and synchronous waits over the same one-shot state machines. Preserve owned payloads, caller-selected bounds, admission certainty, and read-only reconciliation rules; extend the signed corpus and make pre-publication server failure wake waiting clients deterministically.

2. 5503d9d0
   Problem: Files benchmark durability provenance contradicts runtime policy

   The implementation manifest labels the Flyology files lane as not power durable even though its server uses the production durability policy. Campaign metadata also leaves that selected policy implicit, allowing later comparisons to overstate or misclassify durability equivalence.

   Solution: Pin and retain the production durability selection

   Label the matrix lane power-loss-durable, pass Power_Loss_Durable explicitly to the files server, record the exact commit policy in both retained matrix metadata streams, and gate the metadata field. Clarify the guide while leaving immutable historical evidence unchanged.

3. 3453828c
   Problem: Public access controls cannot join composed client workflows

   PutPublicAccessBlock, GetPublicAccessBlock, and DeletePublicAccessBlock are available through synchronous helpers but not through the provider-owned operation model. Callers cannot compose these security controls with their completion sets, and mutation failures lack the typed certainty needed to choose read-only reconciliation without replay.

   Solution: Add provider-owned public access block operations

   Add limited constructors, operation-last restart procedures, typed Finish results, and synchronous waits on the same Client.Buckets state machines. Keep mutation bodies non-rewindable, preserve admission certainty and bounded same-response reads, reject mismatched prepared operations before HTTP admission, and cover lifecycle, restart, certainty, and documentation contracts.

4. 551d514d
   Problem: Ownership controls reads cannot join composed client workflows

   Callers can retrieve bucket ownership controls only through the blocking low-level executor, so owner-driven operation graphs cannot compose the read, preserve typed HTTP failure context, or reuse an established parent operation.

   Solution: colocate bounded Ownership Controls reads with the Buckets provider

   Add limited and operation-last provider forms, typed Finish and synchronous waiting over the same state machine, an exact prepared-request initiator, bounded same-response decoding, restart and operation-identity tests, and matching architecture and compatibility evidence.

5. 07269323
   Problem: Ownership controls writes cannot join composed client workflows

   PutBucketOwnershipControls is available only through a blocking executor, so owner-driven callers cannot retain typed admission certainty or reconcile ambiguous publication without leaving the provider API.

   Solution: add a non-replaying Ownership Controls mutation state machine

   Colocate limited, operation-last, Finish, and synchronous forms in Client.Buckets; expose an exact low-level initiator; retain serialized bytes through terminal drain; classify only response-observed exact rejections as definitely not applied; and gate operation identity, restart, wire behavior, and the complete admission-certainty matrix.

6. 33b28a12
   Problem: Ownership controls deletion cannot join composed workflows

   DeleteBucketOwnershipControls still uses the generic blocking configuration path, so composed callers cannot retain typed admission certainty, reuse an established operation, or reconcile an ambiguous deletion through the owning provider.

   Solution: complete the provider-owned Ownership Controls trio

   Add a non-replaying Delete operation with limited and operation-last forms, typed Finish and synchronous waiting; rewrite the existing convenience call through that state machine; expose exact low-level initiation; and gate operation identity, restart, wire behavior, and exhaustive certainty normalization.

7. da5c057f
   Problem: Bucket encryption reads cannot join composed workflows

   GetBucketEncryption is available only through the blocking executor, so owner-driven callers cannot compose its bounded response, cancellation, and deadline into an existing completion graph.

   Solution: Add a provider-owned Get_Encryption operation

   Add the exact low-level prepared initiator, limited and reusable provider overloads, typed Finish and synchronous wait over one bounded state machine. Cover exact-operation rejection, restart, response normalization, certainty, signed socket behavior, and document the expanded provider surface.

8. e00ca596
   Problem: Bucket encryption deletion cannot join composed workflows

   DeleteBucketEncryption uses the blocking configuration dispatcher, so owner-driven callers cannot compose its one-shot mutation, deadline, cancellation, and admission certainty into an existing completion graph.

   Solution: Add a provider-owned Delete_Encryption operation

   Add the exact low-level initiator, limited and reusable provider overloads, typed Finish, and synchronous waits over one non-replaying state machine. Preserve the legacy Delete_Outcome surface through that same engine, remove its dead blocking branch, and cover exact binding, restart, certainty, response classes, and signed socket behavior.

9. 179b16c4
   Problem: HTTP dependency oracles retain the pre-hook-selection origin

   The five no-pin solve roots now select the published HTTP/QUIC 0.1.3-dev source that removes hook preprocessing, while CI and maintained prose still assert the previous flattened-client origin.

   Solution: Advance the tracked HTTP origin qualification

   Update CI and maintainer documentation to exact eb09a80, retain exact current-dev constraints and no external pins, and align nearby composable terminology with the provider-centric API.

8 source commits

1. db16a412
   Problem: PutBucketCors cannot join composed client workflows

   The existing CORS client can read and delete configurations, but callers cannot publish a complete configuration through the provider-owned operation model. They cannot retain typed admission certainty, restart an established component, or prove that the exact modeled request graph is covered without falling back to a separate blocking path.

   Solution: add one provider-owned nonreplaying CORS mutation

   Serialize the pinned flattened CORS graph within caller-selected XML limits, prepare and execute one-shot signed requests, and colocate limited, operation-last, typed Finish, and synchronous Set_CORS forms in Client.Buckets. Add reciprocal model ledgers, deterministic and signed socket corpora, certainty normalization, coverage accounting, GNATdoc, and maintainer qualification evidence.

2. df9d0d49
   Problem: CORS reads and deletions cannot join composed workflows

   GetBucketCors and DeleteBucketCors stop at synchronous execution even though their provider already owns exact prepared requests and bounded response decoding. Callers cannot reuse them inside completion-set state machines, and synchronous deletion does not share typed admission certainty with the composable client vocabulary.

   Solution: colocate composable CORS reads and deletions with Client.Buckets

   Add exact low-level initiators and provider-owned limited constructors, operation-last reusable procedures, typed Finish results, and synchronous waits on the same state machines. Preserve bounded decoding, non-replaying empty deletion bodies, admission certainty, and conservative outcome mapping, with signed socket, restart, mismatch, capacity, documentation, and normalization coverage.

3. b30f0812
   Problem: Object Legal Hold cannot join composed client workflows

   GetObjectLegalHold and PutObjectLegalHold stop at blocking low-level execution, forcing callers to leave provider-owned completion sets and obscuring mutation admission certainty.

   Solution: colocate owner-driven Legal Hold operations in Client.Objects

   Add exact prepared-request initiators, limited constructors, operation-last restart, typed Finish, shared synchronous waits, an owned nonreplayable mutation source, bounded response sinks, certainty normalization, signed socket and negative corpora, and maintainer documentation.

4. 1160fd60
   Problem: Object Retention cannot join composed client workflows

   GetObjectRetention and PutObjectRetention are available only through blocking client entry points, so completion-set state machines cannot compose exact-version retention reads or mutations without inventing a parallel wrapper. That obscures provider ownership and prevents typed admission certainty from flowing through caller-owned scheduling.

   Solution: colocate Retention operations with Client.Objects

   Add exact prepared-request initiators plus provider-owned limited constructors, operation-last reusable initiation, typed Finish, and synchronous waits driven by the same bounded state machines. Own the Put XML in a non-rewindable source, preserve conservative post-admission mutation certainty, require generation-bound read reconciliation, and gate restart, exact operation binding, normalization, and one-past response limits under native and lightweight owners.

5. aa0a3693
   Problem: Object Lock configuration cannot join composed client workflows

   GetObjectLockConfiguration and PutObjectLockConfiguration expose only blocking execution, so completion-set state machines cannot own their lifetime, drain, certainty, and bounded response handling through the bucket provider.

   Solution: colocate owner-driven Object Lock configuration operations in Client.Buckets

   Add exact Low_Level prepared-request initiators, limited constructors, operation-last reusable procedures, typed Finish results, and synchronous waits over the same state machines. Preserve bounded same-response reads, one-shot non-replaying mutation ownership, conservative admission certainty, and read-only reconciliation, with strict socket, certainty, documentation, and API gates.

6. d1dee5be
   Problem: PutBucketEncryption cannot join composed client workflows

   Callers can prepare and execute bucket-encryption updates synchronously, but they cannot schedule the mutation beside other owner-driven operations without rebuilding its signing, body-lifetime, and publication-certainty rules.

   Solution: add one nonreplaying provider-owned encryption mutation

   Serialize the pinned presence-sensitive configuration into caller-bounded XML, retain its exact signed bytes in the parent operation, expose limited and operation-last Set_Encryption forms with typed Finish, and make the synchronous form wait on that same state machine. Add reciprocal model inventories, deterministic and signed-socket corpora, certainty normalization coverage, qualification evidence, and honest client-only compatibility claims.

7. 0956dcd3
   Problem: completed composable controls remain split from main

   The reviewed CORS, Object Lock configuration, Legal Hold, and Retention operation families live on a parallel lineage, while main independently adds PutBucketEncryption. Leaving the lineages separate prevents exact-tree qualification and publication of the complete provider-owned surface.

   Solution: integrate both composable lineages without narrowing either contract

   Retain every prepared initiator, provider-owned limited constructor, operation-last restart, typed Finish, synchronous wait, corpus, and qualification record from both sides. Reconcile the operation inventory at 52 provider operations and 49 prepared initiators while preserving the explicit three-call projection difference and all nonreplay, ownership, deadline, and certainty rules.

8. 4401e0ec
   Problem: invalid-startup tests leak an admin credential into the checkout

   Configuration-rejection cases can reach credential bootstrap before failing, which leaves a generated credentials file in the repository root and dirties an otherwise clean qualification tree.

   Solution: isolate rejected-startup credentials in the test run directory

   Give every expected-failure launch its own credentials path under RUN_ROOT so bootstrap artifacts are removed with the maintained test workspace.

1 source commit

1. 99706cce
   Problem: bucket CORS stops at the client boundary

   PutBucketCors, GetBucketCors, and DeleteBucketCors have complete clients and signed corpora, but authenticated servers cannot execute them and no backend retains their state. Deployments therefore cannot provide the full configuration lifecycle even though callers can construct every request.

   Solution: complete bucket CORS across backends and server

   Add the backend-neutral canonical-document contract and implement atomic memory, files, and SQLite persistence. Route authenticated server PUT, GET, and DELETE with strict query, owner, checksum, XML, and absence handling. Advance SQLite to schema 13, add migration, corruption, symlink, capacity, restart, and 132-case abrupt-crash evidence, update compatibility and coverage, and qualify the exact tree through full tests, server/provider gates, GNATdoc, and 936/936 SPARK checks.

1 source commit

1. 6ec20483
   Problem: Private ACL reads have no authenticated server route

   The qualified client and ACL codec cannot read bucket or object ACLs from Flyology servers, even though the existing single-tenant mutation profile admits only private ownership. Raw subresource routing must also prevent encoded ACL queries from falling through to ordinary mutations.

   Solution: Derive owner-only ACL responses in the S3 application

   Route authenticated GetBucketAcl and version-selecting GetObjectAcl calls to backend existence reads, synthesize the exact CanonicalUser FULL_CONTROL policy from the stable tenant principal, and reject ACL mutations without publication. Add strict query, authorization, owner, payer, body, error-classification, encoded-subresource, in-process, and real-server socket gates; promote only the server coverage cells while leaving ACL persistence unclaimed.

1 source commit

1. aa799686
   Problem: clean hosted checkouts cannot complete the publication gates

   Strict Linux C compilation hides kill without an explicit POSIX feature contract, the proof project cannot locate an indirect Flyology project in Alire's shared cache, and shallow test checkouts cannot validate retained benchmark ancestry. The first public main CI therefore fails despite the locally qualified implementation.

   Solution: make clean-checkout requirements explicit

   Expose the POSIX.1-2008 declaration set locally in the durability bridge, prepend Alire's exported Flyology root only for maintained proof invocations, and fetch complete history for the test job that validates retained provenance.

1 source commit

1. 98383e48
   Problem: clean hosted qualification depends on unused and fragile build paths

   Linux SQLite consumers inherit an unnecessary libm link from the optional FTS5 module, while the proof gate imports Flyology through a transitive cache location that Alire does not expose consistently in clean hosted workspaces. This prevents the published development line from completing its maintained SQLite and SPARK gates.

   Solution: narrow SQLite features and import the direct proof closure

   Disable the unused FTS5 extension instead of adding a compensating linker dependency. Make the proof project import the direct HTTP and XML project dependencies, and let the maintained script invoke GNATprove directly without reconstructing a transitive cache path.

1 source commit

1. 3455cde3
   Problem: proof-only checkouts resolve dependencies before materialization

   A clean hosted proof job invokes Alire execution before dependency build roots and generated configuration exist. The resulting GPR search path names directories that have not been synchronized, so GNATprove cannot load the direct HTTP and XML project closure.

   Solution: materialize the proof dependency closure before analysis

   Run Alire through the pre-build stage before GNATprove. This synchronizes dependencies and runs configuration actions without compiling the Object Storage library; GNATprove remains the analyzer for the selected proof units.

5 source commits

1. 09e6eac2
   Problem: DeleteBucket cannot compose with owner-driven callers

   The bucket lifecycle client exposes deletion only through blocking execution, so callers cannot share a Completion_Set and HTTP owner while retaining typed admission certainty across a possibly admitted mutation.

   Solution: Add one provider-owned non-replaying DeleteBucket operation

   Add the limited constructor, operation-last reusable initiation, typed Finish, and synchronous wait on one state machine. Use a non-rewindable empty source, bounded response retention, conservative deletion certainty, signed socket and normalization corpora, and maintainer documentation.

2. 22fec71c
   Problem: GetBucketLocation cannot compose with owner-driven callers

   The bucket provider exposes only blocking location discovery even though callers need the raw bounded response while coordinating related operations in one Completion_Set. They must either block outside their state machine or bypass the provider-owned certainty, cancellation, and response-decoding contract.

   Solution: add one provider-owned bounded location read

   Add limited-root and operation-last Get_Location forms, a typed Finish result, and the matching prepared low-level initiator. Make the typed synchronous and legacy convenience overloads wait on the same bounded owner-driven state machine, preserve established defaults and legacy region normalization, retain no borrowed request input after signing, and leave safe GET recovery to Flyology HTTP. Gate exact response/failure normalization, expected-owner signing, fragmented XML, restart, documentation, full deterministic tests, and the warning-strict 936-check proof campaign.

3. c0bae328
   Problem: GetBucketVersioning cannot compose with owner-driven callers

   Bucket-version reconciliation is available only through a blocking call, so structured callers cannot share a completion set, deadline, cancellation owner, or reusable operation while preserving the modeled response and HTTP failure evidence.

   Solution: add one provider-owned bounded versioning read

   Add limited-root and operation-last Get_Versioning forms with typed Finish in Client.Buckets, drive the prepared request through the shared HTTP state machine, retain XML under the versioning codec bound, preserve the established synchronous behavior, and qualify normalization, restart, documentation, and signed socket behavior.

4. 39f97288
   Problem: PutBucketVersioning cannot compose without replay ambiguity

   Bucket-version updates are available only through blocking execution, so structured callers cannot own deadline, cancellation, and restart state or retain typed admission certainty for reconciliation.

   Solution: add one provider-owned nonreplaying versioning mutation

   Add limited-root and operation-last Set_Versioning_Configuration with typed Finish, move synchronous execution onto the same owned one-shot source, preserve exact certainty mapping, and qualify normalization, restart, documentation, signed sockets, and proof.

5. 1978275b
   Problem: GetBucketPolicy cannot compose with owner-driven callers

   Bucket-policy retrieval is available only through blocking execution, so structured callers cannot retain typed HTTP state, caller-selected response bounds, cancellation, and restart ownership in a larger operation graph.

   Solution: add one provider-owned bounded policy read

   Add limited-root and operation-last Get_Policy with typed Finish, route the synchronous parameter-record overload through the same state machine, enforce exact prepared-operation identity, and qualify normalization, bounds, restart, documentation, signed sockets, and proof.

9 source commits

1. 0da1b4f7
   Problem: bucket policy mutations cannot join caller-owned operation graphs

   Callers can read bucket policies compositionally, but replacement and deletion still use separate blocking transport paths. That prevents provider-centric operation reuse, obscures admission certainty after ambiguous mutations, and leaves a socket-corpus startup failure able to strand clients before the server publishes its port.

   Solution: add provider-owned nonreplaying policy mutations

   Add limited Set_Policy and Delete_Policy roots, operation-last reusable initiation, typed Finish/results, exact low-level prepared-operation binding, and synchronous waits over the same one-shot state machines. Preserve owned payloads, caller-selected bounds, admission certainty, and read-only reconciliation rules; extend the signed corpus and make pre-publication server failure wake waiting clients deterministically.

2. 5503d9d0
   Problem: Files benchmark durability provenance contradicts runtime policy

   The implementation manifest labels the Flyology files lane as not power durable even though its server uses the production durability policy. Campaign metadata also leaves that selected policy implicit, allowing later comparisons to overstate or misclassify durability equivalence.

   Solution: Pin and retain the production durability selection

   Label the matrix lane power-loss-durable, pass Power_Loss_Durable explicitly to the files server, record the exact commit policy in both retained matrix metadata streams, and gate the metadata field. Clarify the guide while leaving immutable historical evidence unchanged.

3. 3453828c
   Problem: Public access controls cannot join composed client workflows

   PutPublicAccessBlock, GetPublicAccessBlock, and DeletePublicAccessBlock are available through synchronous helpers but not through the provider-owned operation model. Callers cannot compose these security controls with their completion sets, and mutation failures lack the typed certainty needed to choose read-only reconciliation without replay.

   Solution: Add provider-owned public access block operations

   Add limited constructors, operation-last restart procedures, typed Finish results, and synchronous waits on the same Client.Buckets state machines. Keep mutation bodies non-rewindable, preserve admission certainty and bounded same-response reads, reject mismatched prepared operations before HTTP admission, and cover lifecycle, restart, certainty, and documentation contracts.

4. 551d514d
   Problem: Ownership controls reads cannot join composed client workflows

   Callers can retrieve bucket ownership controls only through the blocking low-level executor, so owner-driven operation graphs cannot compose the read, preserve typed HTTP failure context, or reuse an established parent operation.

   Solution: colocate bounded Ownership Controls reads with the Buckets provider

   Add limited and operation-last provider forms, typed Finish and synchronous waiting over the same state machine, an exact prepared-request initiator, bounded same-response decoding, restart and operation-identity tests, and matching architecture and compatibility evidence.

5. 07269323
   Problem: Ownership controls writes cannot join composed client workflows

   PutBucketOwnershipControls is available only through a blocking executor, so owner-driven callers cannot retain typed admission certainty or reconcile ambiguous publication without leaving the provider API.

   Solution: add a non-replaying Ownership Controls mutation state machine

   Colocate limited, operation-last, Finish, and synchronous forms in Client.Buckets; expose an exact low-level initiator; retain serialized bytes through terminal drain; classify only response-observed exact rejections as definitely not applied; and gate operation identity, restart, wire behavior, and the complete admission-certainty matrix.

6. 33b28a12
   Problem: Ownership controls deletion cannot join composed workflows

   DeleteBucketOwnershipControls still uses the generic blocking configuration path, so composed callers cannot retain typed admission certainty, reuse an established operation, or reconcile an ambiguous deletion through the owning provider.

   Solution: complete the provider-owned Ownership Controls trio

   Add a non-replaying Delete operation with limited and operation-last forms, typed Finish and synchronous waiting; rewrite the existing convenience call through that state machine; expose exact low-level initiation; and gate operation identity, restart, wire behavior, and exhaustive certainty normalization.

7. da5c057f
   Problem: Bucket encryption reads cannot join composed workflows

   GetBucketEncryption is available only through the blocking executor, so owner-driven callers cannot compose its bounded response, cancellation, and deadline into an existing completion graph.

   Solution: Add a provider-owned Get_Encryption operation

   Add the exact low-level prepared initiator, limited and reusable provider overloads, typed Finish and synchronous wait over one bounded state machine. Cover exact-operation rejection, restart, response normalization, certainty, signed socket behavior, and document the expanded provider surface.

8. e00ca596
   Problem: Bucket encryption deletion cannot join composed workflows

   DeleteBucketEncryption uses the blocking configuration dispatcher, so owner-driven callers cannot compose its one-shot mutation, deadline, cancellation, and admission certainty into an existing completion graph.

   Solution: Add a provider-owned Delete_Encryption operation

   Add the exact low-level initiator, limited and reusable provider overloads, typed Finish, and synchronous waits over one non-replaying state machine. Preserve the legacy Delete_Outcome surface through that same engine, remove its dead blocking branch, and cover exact binding, restart, certainty, response classes, and signed socket behavior.

9. 179b16c4
   Problem: HTTP dependency oracles retain the pre-hook-selection origin

   The five no-pin solve roots now select the published HTTP/QUIC 0.1.3-dev source that removes hook preprocessing, while CI and maintained prose still assert the previous flattened-client origin.

   Solution: Advance the tracked HTTP origin qualification

   Update CI and maintainer documentation to exact eb09a80, retain exact current-dev constraints and no external pins, and align nearby composable terminology with the provider-centric API.

8 source commits

1. db16a412
   Problem: PutBucketCors cannot join composed client workflows

   The existing CORS client can read and delete configurations, but callers cannot publish a complete configuration through the provider-owned operation model. They cannot retain typed admission certainty, restart an established component, or prove that the exact modeled request graph is covered without falling back to a separate blocking path.

   Solution: add one provider-owned nonreplaying CORS mutation

   Serialize the pinned flattened CORS graph within caller-selected XML limits, prepare and execute one-shot signed requests, and colocate limited, operation-last, typed Finish, and synchronous Set_CORS forms in Client.Buckets. Add reciprocal model ledgers, deterministic and signed socket corpora, certainty normalization, coverage accounting, GNATdoc, and maintainer qualification evidence.

2. df9d0d49
   Problem: CORS reads and deletions cannot join composed workflows

   GetBucketCors and DeleteBucketCors stop at synchronous execution even though their provider already owns exact prepared requests and bounded response decoding. Callers cannot reuse them inside completion-set state machines, and synchronous deletion does not share typed admission certainty with the composable client vocabulary.

   Solution: colocate composable CORS reads and deletions with Client.Buckets

   Add exact low-level initiators and provider-owned limited constructors, operation-last reusable procedures, typed Finish results, and synchronous waits on the same state machines. Preserve bounded decoding, non-replaying empty deletion bodies, admission certainty, and conservative outcome mapping, with signed socket, restart, mismatch, capacity, documentation, and normalization coverage.

3. b30f0812
   Problem: Object Legal Hold cannot join composed client workflows

   GetObjectLegalHold and PutObjectLegalHold stop at blocking low-level execution, forcing callers to leave provider-owned completion sets and obscuring mutation admission certainty.

   Solution: colocate owner-driven Legal Hold operations in Client.Objects

   Add exact prepared-request initiators, limited constructors, operation-last restart, typed Finish, shared synchronous waits, an owned nonreplayable mutation source, bounded response sinks, certainty normalization, signed socket and negative corpora, and maintainer documentation.

4. 1160fd60
   Problem: Object Retention cannot join composed client workflows

   GetObjectRetention and PutObjectRetention are available only through blocking client entry points, so completion-set state machines cannot compose exact-version retention reads or mutations without inventing a parallel wrapper. That obscures provider ownership and prevents typed admission certainty from flowing through caller-owned scheduling.

   Solution: colocate Retention operations with Client.Objects

   Add exact prepared-request initiators plus provider-owned limited constructors, operation-last reusable initiation, typed Finish, and synchronous waits driven by the same bounded state machines. Own the Put XML in a non-rewindable source, preserve conservative post-admission mutation certainty, require generation-bound read reconciliation, and gate restart, exact operation binding, normalization, and one-past response limits under native and lightweight owners.

5. aa0a3693
   Problem: Object Lock configuration cannot join composed client workflows

   GetObjectLockConfiguration and PutObjectLockConfiguration expose only blocking execution, so completion-set state machines cannot own their lifetime, drain, certainty, and bounded response handling through the bucket provider.

   Solution: colocate owner-driven Object Lock configuration operations in Client.Buckets

   Add exact Low_Level prepared-request initiators, limited constructors, operation-last reusable procedures, typed Finish results, and synchronous waits over the same state machines. Preserve bounded same-response reads, one-shot non-replaying mutation ownership, conservative admission certainty, and read-only reconciliation, with strict socket, certainty, documentation, and API gates.

6. d1dee5be
   Problem: PutBucketEncryption cannot join composed client workflows

   Callers can prepare and execute bucket-encryption updates synchronously, but they cannot schedule the mutation beside other owner-driven operations without rebuilding its signing, body-lifetime, and publication-certainty rules.

   Solution: add one nonreplaying provider-owned encryption mutation

   Serialize the pinned presence-sensitive configuration into caller-bounded XML, retain its exact signed bytes in the parent operation, expose limited and operation-last Set_Encryption forms with typed Finish, and make the synchronous form wait on that same state machine. Add reciprocal model inventories, deterministic and signed-socket corpora, certainty normalization coverage, qualification evidence, and honest client-only compatibility claims.

7. 0956dcd3
   Problem: completed composable controls remain split from main

   The reviewed CORS, Object Lock configuration, Legal Hold, and Retention operation families live on a parallel lineage, while main independently adds PutBucketEncryption. Leaving the lineages separate prevents exact-tree qualification and publication of the complete provider-owned surface.

   Solution: integrate both composable lineages without narrowing either contract

   Retain every prepared initiator, provider-owned limited constructor, operation-last restart, typed Finish, synchronous wait, corpus, and qualification record from both sides. Reconcile the operation inventory at 52 provider operations and 49 prepared initiators while preserving the explicit three-call projection difference and all nonreplay, ownership, deadline, and certainty rules.

8. 4401e0ec
   Problem: invalid-startup tests leak an admin credential into the checkout

   Configuration-rejection cases can reach credential bootstrap before failing, which leaves a generated credentials file in the repository root and dirties an otherwise clean qualification tree.

   Solution: isolate rejected-startup credentials in the test run directory

   Give every expected-failure launch its own credentials path under RUN_ROOT so bootstrap artifacts are removed with the maintained test workspace.

1 source commit

1. 99706cce
   Problem: bucket CORS stops at the client boundary

   PutBucketCors, GetBucketCors, and DeleteBucketCors have complete clients and signed corpora, but authenticated servers cannot execute them and no backend retains their state. Deployments therefore cannot provide the full configuration lifecycle even though callers can construct every request.

   Solution: complete bucket CORS across backends and server

   Add the backend-neutral canonical-document contract and implement atomic memory, files, and SQLite persistence. Route authenticated server PUT, GET, and DELETE with strict query, owner, checksum, XML, and absence handling. Advance SQLite to schema 13, add migration, corruption, symlink, capacity, restart, and 132-case abrupt-crash evidence, update compatibility and coverage, and qualify the exact tree through full tests, server/provider gates, GNATdoc, and 936/936 SPARK checks.

1 source commit

1. 6ec20483
   Problem: Private ACL reads have no authenticated server route

   The qualified client and ACL codec cannot read bucket or object ACLs from Flyology servers, even though the existing single-tenant mutation profile admits only private ownership. Raw subresource routing must also prevent encoded ACL queries from falling through to ordinary mutations.

   Solution: Derive owner-only ACL responses in the S3 application

   Route authenticated GetBucketAcl and version-selecting GetObjectAcl calls to backend existence reads, synthesize the exact CanonicalUser FULL_CONTROL policy from the stable tenant principal, and reject ACL mutations without publication. Add strict query, authorization, owner, payer, body, error-classification, encoded-subresource, in-process, and real-server socket gates; promote only the server coverage cells while leaving ACL persistence unclaimed.

8 source commits

1. 86f831cc
   Problem: Buffer slots can reenter the free pool at their final generation

   A slot whose nonwrapping generation reaches its maximum is released back into the free stack. Its next acquisition fails after the pool has already removed it, corrupting availability and potentially leaving waiters with inconsistent accounting. The remoting buffer-domain work depends on generation-safe capability reuse.

   Solution: Retire slots after their final published generation

   Preflight generation exhaustion before mutating allocation state, omit final-generation slots from the free stack on release, document permanent retirement, and add a statically elided test seam that exercises near-wrap behavior. The regression covers surviving capacity, complete retirement, nonblocking and timed acquisition, coverage integration, and production hook-symbol elision.

2. 06bbc9c0
   Problem: Runtime-selected buffer pools cannot carry ownership without stored pool access

   Remoting sessions need to choose among heterogeneous buffer pools while moving payload ownership through definite transport capabilities. A pool-bound buffer alone either exposes an access value across the driver boundary or loses the lifetime, domain, and exception-atomicity guarantees needed for zero-copy delivery.

   Solution: Add domain-bound heterogeneous buffer capabilities

   Introduce an immutable buffer-domain catalogue with opaque pool references and access-free driver capabilities. Ownership transfers use abort-deferred protected commits, domain-bound public owners retain compile-time lifetime checks, and all storage access validates the supplied domain. Add wrong-domain, zero-copy, finalization, rollback, hook-elision, and compile-negative lifetime coverage.

3. 50b84004
   Problem: Remoting header pools cannot be reserved across abort-safe session cleanup

   A remoting session needs exclusive ownership of one heterogeneous buffer pool while messages are in flight, but the existing domain admitted only ordinary acquisitions. It had no bounded reservation claims, generation-safe delayed release, or authority token for acknowledging a retired session after its final context-state cut. Base buffer acquisition and release also published ownership through protected-call copy-out boundaries that could lose recovery authority under abort.

   Solution: Add bounded generation-stamped buffer pool reservations

   Add controlled reservation claims and authorized release tokens, exact reservation provenance on buffers and capabilities, total acquisition statuses, nonwrapping generations, pending-release reissue, and permanent exhaustion. Publish and clear actual ownership tokens inside protected actions, retain abort-safe cleanup guards, document lock and lifecycle rules, and cover failure boundaries, provenance, finalization, status precedence, lifetime rejection, and production hook elision.

4. a4ab6d4b
   Problem: Context publication cannot move domain capabilities without nesting protected locks

   A remoting context must publish a reserved header and an ordinary payload as one abort-deferred ownership transition. The validated buffer operations re-enter the domain gate, so calling them while the context registry is protected would invert the lock boundary and leave no safe compound commit point.

   Solution: Add prevalidated direct capability commit moves

   Add provider-only limited ownership moves whose bodies contain only same-subtype field transfers and source clearing. Document the caller-owned validation and publication cut, cover heterogeneous pool provenance, tags, bytes, rejection, and abort behavior, and make the root suite fail closed on any unreviewed helper instruction or retained test hook.

5. f387f8ec
   Problem: Production hook checks reject the disabled buffer hook package

   The disabled test-hook variant necessarily contributes its package elaboration and literal Enabled symbols to the production archive. The behavioral suite matches the package prefix broadly, so a clean production build fails before the repository can verify the new buffer-domain boundary.

   Solution: Match only executable buffer test seams

   Restrict the archive classifier to the arm, consume, note, and live hook operations plus the imported disabled sentinels. This keeps surviving test behavior detectable without treating the inert disabled package metadata as production test code.

6. c9125bed
   Problem: Buffer domain API fails strict documentation verification

   The new domain catalogue, sentinels, acquisition results, reservation overloads, and private controlled-operation helpers lack complete GNATdoc annotations. Strict API generation therefore rejects the reviewed dependency series and cannot publish its public contract.

   Solution: Complete buffer domain API annotations

   Document every new public entity and result literal, describe each reservation overload formal, and exclude private implementation helpers while documenting their formals as required by GNATdoc. Format the specification with the owning Flyology project settings.

7. 5c3d43c4
   Problem: Buffer acquisition status docs overstate reservation state

   The generated API describes Reservation_Not_Active as never published even though a previously published exact generation can later become inactive. It also attributes the bounded claim capacity to a reservation although ordinary unreserved acquisitions share the same pool claim bound.

   Solution: Describe status outcomes by current pool state

   Define Reservation_Not_Active in terms of the exact generation currently being inactive and attribute Claim_Limit_Reached to the pool claim capacity. The wording now matches the implemented and tested status paths.

8. 810f1088
   Merge pull request #83 from flyology-ada/codex/remoting-buffer-domain-publish

   Add abort-safe heterogeneous buffer domains for remoting

2 source commits

1. 84b425b1
   Problem: External consumers do not verify buffer-domain publication

   The out-of-tree consumer does not reference the buffer-domain packages. A stale exact-version Alire lock can therefore supply a pre-domain Flyology source tree while the consumer still builds, leaving the published dependency surface unverified.

   Solution: Compile the buffer-domain API out of tree

   Make the external consumer import Domains and Domains.Drivers, acquire and release a domain-owned buffer, and call the driver diagnostic so the two package specifications and bodies must be packaged, compiled, and linked.

2. 3859f412
   Merge pull request #84 from flyology-ada/codex/buffer-domain-external-consumer

   Verify buffer-domain API from an external consumer

8 source commits

1. 86f831cc
   Problem: Buffer slots can reenter the free pool at their final generation

   A slot whose nonwrapping generation reaches its maximum is released back into the free stack. Its next acquisition fails after the pool has already removed it, corrupting availability and potentially leaving waiters with inconsistent accounting. The remoting buffer-domain work depends on generation-safe capability reuse.

   Solution: Retire slots after their final published generation

   Preflight generation exhaustion before mutating allocation state, omit final-generation slots from the free stack on release, document permanent retirement, and add a statically elided test seam that exercises near-wrap behavior. The regression covers surviving capacity, complete retirement, nonblocking and timed acquisition, coverage integration, and production hook-symbol elision.

2. 06bbc9c0
   Problem: Runtime-selected buffer pools cannot carry ownership without stored pool access

   Remoting sessions need to choose among heterogeneous buffer pools while moving payload ownership through definite transport capabilities. A pool-bound buffer alone either exposes an access value across the driver boundary or loses the lifetime, domain, and exception-atomicity guarantees needed for zero-copy delivery.

   Solution: Add domain-bound heterogeneous buffer capabilities

   Introduce an immutable buffer-domain catalogue with opaque pool references and access-free driver capabilities. Ownership transfers use abort-deferred protected commits, domain-bound public owners retain compile-time lifetime checks, and all storage access validates the supplied domain. Add wrong-domain, zero-copy, finalization, rollback, hook-elision, and compile-negative lifetime coverage.

3. 50b84004
   Problem: Remoting header pools cannot be reserved across abort-safe session cleanup

   A remoting session needs exclusive ownership of one heterogeneous buffer pool while messages are in flight, but the existing domain admitted only ordinary acquisitions. It had no bounded reservation claims, generation-safe delayed release, or authority token for acknowledging a retired session after its final context-state cut. Base buffer acquisition and release also published ownership through protected-call copy-out boundaries that could lose recovery authority under abort.

   Solution: Add bounded generation-stamped buffer pool reservations

   Add controlled reservation claims and authorized release tokens, exact reservation provenance on buffers and capabilities, total acquisition statuses, nonwrapping generations, pending-release reissue, and permanent exhaustion. Publish and clear actual ownership tokens inside protected actions, retain abort-safe cleanup guards, document lock and lifecycle rules, and cover failure boundaries, provenance, finalization, status precedence, lifetime rejection, and production hook elision.

4. a4ab6d4b
   Problem: Context publication cannot move domain capabilities without nesting protected locks

   A remoting context must publish a reserved header and an ordinary payload as one abort-deferred ownership transition. The validated buffer operations re-enter the domain gate, so calling them while the context registry is protected would invert the lock boundary and leave no safe compound commit point.

   Solution: Add prevalidated direct capability commit moves

   Add provider-only limited ownership moves whose bodies contain only same-subtype field transfers and source clearing. Document the caller-owned validation and publication cut, cover heterogeneous pool provenance, tags, bytes, rejection, and abort behavior, and make the root suite fail closed on any unreviewed helper instruction or retained test hook.

5. f387f8ec
   Problem: Production hook checks reject the disabled buffer hook package

   The disabled test-hook variant necessarily contributes its package elaboration and literal Enabled symbols to the production archive. The behavioral suite matches the package prefix broadly, so a clean production build fails before the repository can verify the new buffer-domain boundary.

   Solution: Match only executable buffer test seams

   Restrict the archive classifier to the arm, consume, note, and live hook operations plus the imported disabled sentinels. This keeps surviving test behavior detectable without treating the inert disabled package metadata as production test code.

6. c9125bed
   Problem: Buffer domain API fails strict documentation verification

   The new domain catalogue, sentinels, acquisition results, reservation overloads, and private controlled-operation helpers lack complete GNATdoc annotations. Strict API generation therefore rejects the reviewed dependency series and cannot publish its public contract.

   Solution: Complete buffer domain API annotations

   Document every new public entity and result literal, describe each reservation overload formal, and exclude private implementation helpers while documenting their formals as required by GNATdoc. Format the specification with the owning Flyology project settings.

7. 5c3d43c4
   Problem: Buffer acquisition status docs overstate reservation state

   The generated API describes Reservation_Not_Active as never published even though a previously published exact generation can later become inactive. It also attributes the bounded claim capacity to a reservation although ordinary unreserved acquisitions share the same pool claim bound.

   Solution: Describe status outcomes by current pool state

   Define Reservation_Not_Active in terms of the exact generation currently being inactive and attribute Claim_Limit_Reached to the pool claim capacity. The wording now matches the implemented and tested status paths.

8. 810f1088
   Merge pull request #83 from flyology-ada/codex/remoting-buffer-domain-publish

   Add abort-safe heterogeneous buffer domains for remoting

2 source commits

1. 84b425b1
   Problem: External consumers do not verify buffer-domain publication

   The out-of-tree consumer does not reference the buffer-domain packages. A stale exact-version Alire lock can therefore supply a pre-domain Flyology source tree while the consumer still builds, leaving the published dependency surface unverified.

   Solution: Compile the buffer-domain API out of tree

   Make the external consumer import Domains and Domains.Drivers, acquire and release a domain-owned buffer, and call the driver diagnostic so the two package specifications and bodies must be packaged, compiled, and linked.

2. 3859f412
   Merge pull request #84 from flyology-ada/codex/buffer-domain-external-consumer

   Verify buffer-domain API from an external consumer

8 source commits

1. 86f831cc
   Problem: Buffer slots can reenter the free pool at their final generation

   A slot whose nonwrapping generation reaches its maximum is released back into the free stack. Its next acquisition fails after the pool has already removed it, corrupting availability and potentially leaving waiters with inconsistent accounting. The remoting buffer-domain work depends on generation-safe capability reuse.

   Solution: Retire slots after their final published generation

   Preflight generation exhaustion before mutating allocation state, omit final-generation slots from the free stack on release, document permanent retirement, and add a statically elided test seam that exercises near-wrap behavior. The regression covers surviving capacity, complete retirement, nonblocking and timed acquisition, coverage integration, and production hook-symbol elision.

2. 06bbc9c0
   Problem: Runtime-selected buffer pools cannot carry ownership without stored pool access

   Remoting sessions need to choose among heterogeneous buffer pools while moving payload ownership through definite transport capabilities. A pool-bound buffer alone either exposes an access value across the driver boundary or loses the lifetime, domain, and exception-atomicity guarantees needed for zero-copy delivery.

   Solution: Add domain-bound heterogeneous buffer capabilities

   Introduce an immutable buffer-domain catalogue with opaque pool references and access-free driver capabilities. Ownership transfers use abort-deferred protected commits, domain-bound public owners retain compile-time lifetime checks, and all storage access validates the supplied domain. Add wrong-domain, zero-copy, finalization, rollback, hook-elision, and compile-negative lifetime coverage.

3. 50b84004
   Problem: Remoting header pools cannot be reserved across abort-safe session cleanup

   A remoting session needs exclusive ownership of one heterogeneous buffer pool while messages are in flight, but the existing domain admitted only ordinary acquisitions. It had no bounded reservation claims, generation-safe delayed release, or authority token for acknowledging a retired session after its final context-state cut. Base buffer acquisition and release also published ownership through protected-call copy-out boundaries that could lose recovery authority under abort.

   Solution: Add bounded generation-stamped buffer pool reservations

   Add controlled reservation claims and authorized release tokens, exact reservation provenance on buffers and capabilities, total acquisition statuses, nonwrapping generations, pending-release reissue, and permanent exhaustion. Publish and clear actual ownership tokens inside protected actions, retain abort-safe cleanup guards, document lock and lifecycle rules, and cover failure boundaries, provenance, finalization, status precedence, lifetime rejection, and production hook elision.

4. a4ab6d4b
   Problem: Context publication cannot move domain capabilities without nesting protected locks

   A remoting context must publish a reserved header and an ordinary payload as one abort-deferred ownership transition. The validated buffer operations re-enter the domain gate, so calling them while the context registry is protected would invert the lock boundary and leave no safe compound commit point.

   Solution: Add prevalidated direct capability commit moves

   Add provider-only limited ownership moves whose bodies contain only same-subtype field transfers and source clearing. Document the caller-owned validation and publication cut, cover heterogeneous pool provenance, tags, bytes, rejection, and abort behavior, and make the root suite fail closed on any unreviewed helper instruction or retained test hook.

5. f387f8ec
   Problem: Production hook checks reject the disabled buffer hook package

   The disabled test-hook variant necessarily contributes its package elaboration and literal Enabled symbols to the production archive. The behavioral suite matches the package prefix broadly, so a clean production build fails before the repository can verify the new buffer-domain boundary.

   Solution: Match only executable buffer test seams

   Restrict the archive classifier to the arm, consume, note, and live hook operations plus the imported disabled sentinels. This keeps surviving test behavior detectable without treating the inert disabled package metadata as production test code.

6. c9125bed
   Problem: Buffer domain API fails strict documentation verification

   The new domain catalogue, sentinels, acquisition results, reservation overloads, and private controlled-operation helpers lack complete GNATdoc annotations. Strict API generation therefore rejects the reviewed dependency series and cannot publish its public contract.

   Solution: Complete buffer domain API annotations

   Document every new public entity and result literal, describe each reservation overload formal, and exclude private implementation helpers while documenting their formals as required by GNATdoc. Format the specification with the owning Flyology project settings.

7. 5c3d43c4
   Problem: Buffer acquisition status docs overstate reservation state

   The generated API describes Reservation_Not_Active as never published even though a previously published exact generation can later become inactive. It also attributes the bounded claim capacity to a reservation although ordinary unreserved acquisitions share the same pool claim bound.

   Solution: Describe status outcomes by current pool state

   Define Reservation_Not_Active in terms of the exact generation currently being inactive and attribute Claim_Limit_Reached to the pool claim capacity. The wording now matches the implemented and tested status paths.

8. 810f1088
   Merge pull request #83 from flyology-ada/codex/remoting-buffer-domain-publish

   Add abort-safe heterogeneous buffer domains for remoting

2 source commits

1. 84b425b1
   Problem: External consumers do not verify buffer-domain publication

   The out-of-tree consumer does not reference the buffer-domain packages. A stale exact-version Alire lock can therefore supply a pre-domain Flyology source tree while the consumer still builds, leaving the published dependency surface unverified.

   Solution: Compile the buffer-domain API out of tree

   Make the external consumer import Domains and Domains.Drivers, acquire and release a domain-owned buffer, and call the driver diagnostic so the two package specifications and bodies must be packaged, compiled, and linked.

2. 3859f412
   Merge pull request #84 from flyology-ada/codex/buffer-domain-external-consumer

   Verify buffer-domain API from an external consumer

8 source commits

1. 86f831cc
   Problem: Buffer slots can reenter the free pool at their final generation

   A slot whose nonwrapping generation reaches its maximum is released back into the free stack. Its next acquisition fails after the pool has already removed it, corrupting availability and potentially leaving waiters with inconsistent accounting. The remoting buffer-domain work depends on generation-safe capability reuse.

   Solution: Retire slots after their final published generation

   Preflight generation exhaustion before mutating allocation state, omit final-generation slots from the free stack on release, document permanent retirement, and add a statically elided test seam that exercises near-wrap behavior. The regression covers surviving capacity, complete retirement, nonblocking and timed acquisition, coverage integration, and production hook-symbol elision.

2. 06bbc9c0
   Problem: Runtime-selected buffer pools cannot carry ownership without stored pool access

   Remoting sessions need to choose among heterogeneous buffer pools while moving payload ownership through definite transport capabilities. A pool-bound buffer alone either exposes an access value across the driver boundary or loses the lifetime, domain, and exception-atomicity guarantees needed for zero-copy delivery.

   Solution: Add domain-bound heterogeneous buffer capabilities

   Introduce an immutable buffer-domain catalogue with opaque pool references and access-free driver capabilities. Ownership transfers use abort-deferred protected commits, domain-bound public owners retain compile-time lifetime checks, and all storage access validates the supplied domain. Add wrong-domain, zero-copy, finalization, rollback, hook-elision, and compile-negative lifetime coverage.

3. 50b84004
   Problem: Remoting header pools cannot be reserved across abort-safe session cleanup

   A remoting session needs exclusive ownership of one heterogeneous buffer pool while messages are in flight, but the existing domain admitted only ordinary acquisitions. It had no bounded reservation claims, generation-safe delayed release, or authority token for acknowledging a retired session after its final context-state cut. Base buffer acquisition and release also published ownership through protected-call copy-out boundaries that could lose recovery authority under abort.

   Solution: Add bounded generation-stamped buffer pool reservations

   Add controlled reservation claims and authorized release tokens, exact reservation provenance on buffers and capabilities, total acquisition statuses, nonwrapping generations, pending-release reissue, and permanent exhaustion. Publish and clear actual ownership tokens inside protected actions, retain abort-safe cleanup guards, document lock and lifecycle rules, and cover failure boundaries, provenance, finalization, status precedence, lifetime rejection, and production hook elision.

4. a4ab6d4b
   Problem: Context publication cannot move domain capabilities without nesting protected locks

   A remoting context must publish a reserved header and an ordinary payload as one abort-deferred ownership transition. The validated buffer operations re-enter the domain gate, so calling them while the context registry is protected would invert the lock boundary and leave no safe compound commit point.

   Solution: Add prevalidated direct capability commit moves

   Add provider-only limited ownership moves whose bodies contain only same-subtype field transfers and source clearing. Document the caller-owned validation and publication cut, cover heterogeneous pool provenance, tags, bytes, rejection, and abort behavior, and make the root suite fail closed on any unreviewed helper instruction or retained test hook.

5. f387f8ec
   Problem: Production hook checks reject the disabled buffer hook package

   The disabled test-hook variant necessarily contributes its package elaboration and literal Enabled symbols to the production archive. The behavioral suite matches the package prefix broadly, so a clean production build fails before the repository can verify the new buffer-domain boundary.

   Solution: Match only executable buffer test seams

   Restrict the archive classifier to the arm, consume, note, and live hook operations plus the imported disabled sentinels. This keeps surviving test behavior detectable without treating the inert disabled package metadata as production test code.

6. c9125bed
   Problem: Buffer domain API fails strict documentation verification

   The new domain catalogue, sentinels, acquisition results, reservation overloads, and private controlled-operation helpers lack complete GNATdoc annotations. Strict API generation therefore rejects the reviewed dependency series and cannot publish its public contract.

   Solution: Complete buffer domain API annotations

   Document every new public entity and result literal, describe each reservation overload formal, and exclude private implementation helpers while documenting their formals as required by GNATdoc. Format the specification with the owning Flyology project settings.

7. 5c3d43c4
   Problem: Buffer acquisition status docs overstate reservation state

   The generated API describes Reservation_Not_Active as never published even though a previously published exact generation can later become inactive. It also attributes the bounded claim capacity to a reservation although ordinary unreserved acquisitions share the same pool claim bound.

   Solution: Describe status outcomes by current pool state

   Define Reservation_Not_Active in terms of the exact generation currently being inactive and attribute Claim_Limit_Reached to the pool claim capacity. The wording now matches the implemented and tested status paths.

8. 810f1088
   Merge pull request #83 from flyology-ada/codex/remoting-buffer-domain-publish

   Add abort-safe heterogeneous buffer domains for remoting

2 source commits

1. 84b425b1
   Problem: External consumers do not verify buffer-domain publication

   The out-of-tree consumer does not reference the buffer-domain packages. A stale exact-version Alire lock can therefore supply a pre-domain Flyology source tree while the consumer still builds, leaving the published dependency surface unverified.

   Solution: Compile the buffer-domain API out of tree

   Make the external consumer import Domains and Domains.Drivers, acquire and release a domain-owned buffer, and call the driver diagnostic so the two package specifications and bodies must be packaged, compiled, and linked.

2. 3859f412
   Merge pull request #84 from flyology-ada/codex/buffer-domain-external-consumer

   Verify buffer-domain API from an external consumer

8 source commits

1. 86f831cc
   Problem: Buffer slots can reenter the free pool at their final generation

   A slot whose nonwrapping generation reaches its maximum is released back into the free stack. Its next acquisition fails after the pool has already removed it, corrupting availability and potentially leaving waiters with inconsistent accounting. The remoting buffer-domain work depends on generation-safe capability reuse.

   Solution: Retire slots after their final published generation

   Preflight generation exhaustion before mutating allocation state, omit final-generation slots from the free stack on release, document permanent retirement, and add a statically elided test seam that exercises near-wrap behavior. The regression covers surviving capacity, complete retirement, nonblocking and timed acquisition, coverage integration, and production hook-symbol elision.

2. 06bbc9c0
   Problem: Runtime-selected buffer pools cannot carry ownership without stored pool access

   Remoting sessions need to choose among heterogeneous buffer pools while moving payload ownership through definite transport capabilities. A pool-bound buffer alone either exposes an access value across the driver boundary or loses the lifetime, domain, and exception-atomicity guarantees needed for zero-copy delivery.

   Solution: Add domain-bound heterogeneous buffer capabilities

   Introduce an immutable buffer-domain catalogue with opaque pool references and access-free driver capabilities. Ownership transfers use abort-deferred protected commits, domain-bound public owners retain compile-time lifetime checks, and all storage access validates the supplied domain. Add wrong-domain, zero-copy, finalization, rollback, hook-elision, and compile-negative lifetime coverage.

3. 50b84004
   Problem: Remoting header pools cannot be reserved across abort-safe session cleanup

   A remoting session needs exclusive ownership of one heterogeneous buffer pool while messages are in flight, but the existing domain admitted only ordinary acquisitions. It had no bounded reservation claims, generation-safe delayed release, or authority token for acknowledging a retired session after its final context-state cut. Base buffer acquisition and release also published ownership through protected-call copy-out boundaries that could lose recovery authority under abort.

   Solution: Add bounded generation-stamped buffer pool reservations

   Add controlled reservation claims and authorized release tokens, exact reservation provenance on buffers and capabilities, total acquisition statuses, nonwrapping generations, pending-release reissue, and permanent exhaustion. Publish and clear actual ownership tokens inside protected actions, retain abort-safe cleanup guards, document lock and lifecycle rules, and cover failure boundaries, provenance, finalization, status precedence, lifetime rejection, and production hook elision.

4. a4ab6d4b
   Problem: Context publication cannot move domain capabilities without nesting protected locks

   A remoting context must publish a reserved header and an ordinary payload as one abort-deferred ownership transition. The validated buffer operations re-enter the domain gate, so calling them while the context registry is protected would invert the lock boundary and leave no safe compound commit point.

   Solution: Add prevalidated direct capability commit moves

   Add provider-only limited ownership moves whose bodies contain only same-subtype field transfers and source clearing. Document the caller-owned validation and publication cut, cover heterogeneous pool provenance, tags, bytes, rejection, and abort behavior, and make the root suite fail closed on any unreviewed helper instruction or retained test hook.

5. f387f8ec
   Problem: Production hook checks reject the disabled buffer hook package

   The disabled test-hook variant necessarily contributes its package elaboration and literal Enabled symbols to the production archive. The behavioral suite matches the package prefix broadly, so a clean production build fails before the repository can verify the new buffer-domain boundary.

   Solution: Match only executable buffer test seams

   Restrict the archive classifier to the arm, consume, note, and live hook operations plus the imported disabled sentinels. This keeps surviving test behavior detectable without treating the inert disabled package metadata as production test code.

6. c9125bed
   Problem: Buffer domain API fails strict documentation verification

   The new domain catalogue, sentinels, acquisition results, reservation overloads, and private controlled-operation helpers lack complete GNATdoc annotations. Strict API generation therefore rejects the reviewed dependency series and cannot publish its public contract.

   Solution: Complete buffer domain API annotations

   Document every new public entity and result literal, describe each reservation overload formal, and exclude private implementation helpers while documenting their formals as required by GNATdoc. Format the specification with the owning Flyology project settings.

7. 5c3d43c4
   Problem: Buffer acquisition status docs overstate reservation state

   The generated API describes Reservation_Not_Active as never published even though a previously published exact generation can later become inactive. It also attributes the bounded claim capacity to a reservation although ordinary unreserved acquisitions share the same pool claim bound.

   Solution: Describe status outcomes by current pool state

   Define Reservation_Not_Active in terms of the exact generation currently being inactive and attribute Claim_Limit_Reached to the pool claim capacity. The wording now matches the implemented and tested status paths.

8. 810f1088
   Merge pull request #83 from flyology-ada/codex/remoting-buffer-domain-publish

   Add abort-safe heterogeneous buffer domains for remoting

2 source commits

1. 84b425b1
   Problem: External consumers do not verify buffer-domain publication

   The out-of-tree consumer does not reference the buffer-domain packages. A stale exact-version Alire lock can therefore supply a pre-domain Flyology source tree while the consumer still builds, leaving the published dependency surface unverified.

   Solution: Compile the buffer-domain API out of tree

   Make the external consumer import Domains and Domains.Drivers, acquire and release a domain-owned buffer, and call the driver diagnostic so the two package specifications and bodies must be packaged, compiled, and linked.

2. 3859f412
   Merge pull request #84 from flyology-ada/codex/buffer-domain-external-consumer

   Verify buffer-domain API from an external consumer

3 source commits

1. f1e65c3d
   Problem: Scoped safe reads expose silently closed pooled H1 sockets

   A server can return a complete response without Connection: close and then silently close the reusable HTTP/1 transport. The next public bounded-buffer GET or HEAD fails at response-head parsing even though the synchronous adapter already performs guarded one-shot stale recovery. This prevents object-storage reconciliation after a conclusive conditional response.

   Solution: Extend guarded stale recovery to complete-body buffer exchanges

   Allow public buffer exchanges to use the existing safe-method, no-source, no-response-byte, reused-transport retry path. Add a deterministic native/lightweight established-child regression that models the complete 412 followed by a dropped GET and replacement connection, and record the executable scenario in the maintained corpus.

2. 1cded286
   Problem: Nested Alire tests inherit outer compiler selections

   The HTTP test action invokes IRI and QUIC as nested Alire projects. After the development index selected a newer compiler, exported GNAT and GPRbuild prefixes from the outer solve contaminated the nested solve, and the QUIC lane maintained a separate incomplete unset list.

   Solution: Centralize nested toolchain environment isolation

   Clear Flyology, compiler, GPRbuild, and project-path prefixes in the shared nested-test helper, route both IRI and QUIC through it, and extend the action-context regression to cover the toolchain variables.

3. 537edbc5
   Merge pull request #39 from flyology-ada/codex/scoped-h1-stale-reuse

   Recover scoped safe reads from silently stale H1 leases

3 source commits

1. 22d8ee67
   Problem: Composable HTTP calls live in parallel Scoped namespaces

   Scoped describes an operation's limited lifetime and ownership discipline, not the provider that performs it. Keeping client and server operation forms in child namespaces makes callers learn two API trees for one state machine, obscures synchronous parity, and encourages downstream wrappers and documentation drift.

   Solution: Colocate composable overloads with their providers

   Move the limited constructors, same-name established initiators, operation state accessors, and typed Finish overloads directly into Flyology.HTTP.Client and Flyology.HTTP.Server. Remove both Scoped namespaces without aliases, migrate every executable caller, and retain the existing ownership, certainty, cancellation, drain, deadline, protocol, and guarded stale-H1 behavior.

2. 17a403e5
   Problem: HTTP guidance still presents composability as an execution namespace

   The corpus vocabulary, differential tools, generated expectations, architecture notes, and website guides still name Scoped as a parallel API style. That language would teach the removed namespace and leave provider ownership hard to discover after the intentional development-line source break.

   Solution: Document provider-centric composable operations

   Rename corpus execution styles to composable buffer and sink forms, regenerate the Ada oracle, and update conformance and differential tooling. Revise the guides and architecture to place root constructors, established initiation, and typed Finish beside synchronous provider calls while preserving scoped lifetime as an operation semantic.

3. b5cd966d
   Merge pull request #40 from flyology-ada/codex/flatten-composable-http-api

   Colocate composable HTTP operations with providers

3 source commits

1. f1e65c3d
   Problem: Scoped safe reads expose silently closed pooled H1 sockets

   A server can return a complete response without Connection: close and then silently close the reusable HTTP/1 transport. The next public bounded-buffer GET or HEAD fails at response-head parsing even though the synchronous adapter already performs guarded one-shot stale recovery. This prevents object-storage reconciliation after a conclusive conditional response.

   Solution: Extend guarded stale recovery to complete-body buffer exchanges

   Allow public buffer exchanges to use the existing safe-method, no-source, no-response-byte, reused-transport retry path. Add a deterministic native/lightweight established-child regression that models the complete 412 followed by a dropped GET and replacement connection, and record the executable scenario in the maintained corpus.

2. 1cded286
   Problem: Nested Alire tests inherit outer compiler selections

   The HTTP test action invokes IRI and QUIC as nested Alire projects. After the development index selected a newer compiler, exported GNAT and GPRbuild prefixes from the outer solve contaminated the nested solve, and the QUIC lane maintained a separate incomplete unset list.

   Solution: Centralize nested toolchain environment isolation

   Clear Flyology, compiler, GPRbuild, and project-path prefixes in the shared nested-test helper, route both IRI and QUIC through it, and extend the action-context regression to cover the toolchain variables.

3. 537edbc5
   Merge pull request #39 from flyology-ada/codex/scoped-h1-stale-reuse

   Recover scoped safe reads from silently stale H1 leases

3 source commits

1. 22d8ee67
   Problem: Composable HTTP calls live in parallel Scoped namespaces

   Scoped describes an operation's limited lifetime and ownership discipline, not the provider that performs it. Keeping client and server operation forms in child namespaces makes callers learn two API trees for one state machine, obscures synchronous parity, and encourages downstream wrappers and documentation drift.

   Solution: Colocate composable overloads with their providers

   Move the limited constructors, same-name established initiators, operation state accessors, and typed Finish overloads directly into Flyology.HTTP.Client and Flyology.HTTP.Server. Remove both Scoped namespaces without aliases, migrate every executable caller, and retain the existing ownership, certainty, cancellation, drain, deadline, protocol, and guarded stale-H1 behavior.

2. 17a403e5
   Problem: HTTP guidance still presents composability as an execution namespace

   The corpus vocabulary, differential tools, generated expectations, architecture notes, and website guides still name Scoped as a parallel API style. That language would teach the removed namespace and leave provider ownership hard to discover after the intentional development-line source break.

   Solution: Document provider-centric composable operations

   Rename corpus execution styles to composable buffer and sink forms, regenerate the Ada oracle, and update conformance and differential tooling. Revise the guides and architecture to place root constructors, established initiation, and typed Finish beside synchronous provider calls while preserving scoped lifetime as an operation semantic.

3. b5cd966d
   Merge pull request #40 from flyology-ada/codex/flatten-composable-http-api

   Colocate composable HTTP operations with providers

8 source commits

1. 86f831cc
   Problem: Buffer slots can reenter the free pool at their final generation

   A slot whose nonwrapping generation reaches its maximum is released back into the free stack. Its next acquisition fails after the pool has already removed it, corrupting availability and potentially leaving waiters with inconsistent accounting. The remoting buffer-domain work depends on generation-safe capability reuse.

   Solution: Retire slots after their final published generation

   Preflight generation exhaustion before mutating allocation state, omit final-generation slots from the free stack on release, document permanent retirement, and add a statically elided test seam that exercises near-wrap behavior. The regression covers surviving capacity, complete retirement, nonblocking and timed acquisition, coverage integration, and production hook-symbol elision.

2. 06bbc9c0
   Problem: Runtime-selected buffer pools cannot carry ownership without stored pool access

   Remoting sessions need to choose among heterogeneous buffer pools while moving payload ownership through definite transport capabilities. A pool-bound buffer alone either exposes an access value across the driver boundary or loses the lifetime, domain, and exception-atomicity guarantees needed for zero-copy delivery.

   Solution: Add domain-bound heterogeneous buffer capabilities

   Introduce an immutable buffer-domain catalogue with opaque pool references and access-free driver capabilities. Ownership transfers use abort-deferred protected commits, domain-bound public owners retain compile-time lifetime checks, and all storage access validates the supplied domain. Add wrong-domain, zero-copy, finalization, rollback, hook-elision, and compile-negative lifetime coverage.

3. 50b84004
   Problem: Remoting header pools cannot be reserved across abort-safe session cleanup

   A remoting session needs exclusive ownership of one heterogeneous buffer pool while messages are in flight, but the existing domain admitted only ordinary acquisitions. It had no bounded reservation claims, generation-safe delayed release, or authority token for acknowledging a retired session after its final context-state cut. Base buffer acquisition and release also published ownership through protected-call copy-out boundaries that could lose recovery authority under abort.

   Solution: Add bounded generation-stamped buffer pool reservations

   Add controlled reservation claims and authorized release tokens, exact reservation provenance on buffers and capabilities, total acquisition statuses, nonwrapping generations, pending-release reissue, and permanent exhaustion. Publish and clear actual ownership tokens inside protected actions, retain abort-safe cleanup guards, document lock and lifecycle rules, and cover failure boundaries, provenance, finalization, status precedence, lifetime rejection, and production hook elision.

4. a4ab6d4b
   Problem: Context publication cannot move domain capabilities without nesting protected locks

   A remoting context must publish a reserved header and an ordinary payload as one abort-deferred ownership transition. The validated buffer operations re-enter the domain gate, so calling them while the context registry is protected would invert the lock boundary and leave no safe compound commit point.

   Solution: Add prevalidated direct capability commit moves

   Add provider-only limited ownership moves whose bodies contain only same-subtype field transfers and source clearing. Document the caller-owned validation and publication cut, cover heterogeneous pool provenance, tags, bytes, rejection, and abort behavior, and make the root suite fail closed on any unreviewed helper instruction or retained test hook.

5. f387f8ec
   Problem: Production hook checks reject the disabled buffer hook package

   The disabled test-hook variant necessarily contributes its package elaboration and literal Enabled symbols to the production archive. The behavioral suite matches the package prefix broadly, so a clean production build fails before the repository can verify the new buffer-domain boundary.

   Solution: Match only executable buffer test seams

   Restrict the archive classifier to the arm, consume, note, and live hook operations plus the imported disabled sentinels. This keeps surviving test behavior detectable without treating the inert disabled package metadata as production test code.

6. c9125bed
   Problem: Buffer domain API fails strict documentation verification

   The new domain catalogue, sentinels, acquisition results, reservation overloads, and private controlled-operation helpers lack complete GNATdoc annotations. Strict API generation therefore rejects the reviewed dependency series and cannot publish its public contract.

   Solution: Complete buffer domain API annotations

   Document every new public entity and result literal, describe each reservation overload formal, and exclude private implementation helpers while documenting their formals as required by GNATdoc. Format the specification with the owning Flyology project settings.

7. 5c3d43c4
   Problem: Buffer acquisition status docs overstate reservation state

   The generated API describes Reservation_Not_Active as never published even though a previously published exact generation can later become inactive. It also attributes the bounded claim capacity to a reservation although ordinary unreserved acquisitions share the same pool claim bound.

   Solution: Describe status outcomes by current pool state

   Define Reservation_Not_Active in terms of the exact generation currently being inactive and attribute Claim_Limit_Reached to the pool claim capacity. The wording now matches the implemented and tested status paths.

8. 810f1088
   Merge pull request #83 from flyology-ada/codex/remoting-buffer-domain-publish

   Add abort-safe heterogeneous buffer domains for remoting

2 source commits

1. 84b425b1
   Problem: External consumers do not verify buffer-domain publication

   The out-of-tree consumer does not reference the buffer-domain packages. A stale exact-version Alire lock can therefore supply a pre-domain Flyology source tree while the consumer still builds, leaving the published dependency surface unverified.

   Solution: Compile the buffer-domain API out of tree

   Make the external consumer import Domains and Domains.Drivers, acquire and release a domain-owned buffer, and call the driver diagnostic so the two package specifications and bodies must be packaged, compiled, and linked.

2. 3859f412
   Merge pull request #84 from flyology-ada/codex/buffer-domain-external-consumer

   Verify buffer-domain API from an external consumer

3 source commits

1. f1e65c3d
   Problem: Scoped safe reads expose silently closed pooled H1 sockets

   A server can return a complete response without Connection: close and then silently close the reusable HTTP/1 transport. The next public bounded-buffer GET or HEAD fails at response-head parsing even though the synchronous adapter already performs guarded one-shot stale recovery. This prevents object-storage reconciliation after a conclusive conditional response.

   Solution: Extend guarded stale recovery to complete-body buffer exchanges

   Allow public buffer exchanges to use the existing safe-method, no-source, no-response-byte, reused-transport retry path. Add a deterministic native/lightweight established-child regression that models the complete 412 followed by a dropped GET and replacement connection, and record the executable scenario in the maintained corpus.

2. 1cded286
   Problem: Nested Alire tests inherit outer compiler selections

   The HTTP test action invokes IRI and QUIC as nested Alire projects. After the development index selected a newer compiler, exported GNAT and GPRbuild prefixes from the outer solve contaminated the nested solve, and the QUIC lane maintained a separate incomplete unset list.

   Solution: Centralize nested toolchain environment isolation

   Clear Flyology, compiler, GPRbuild, and project-path prefixes in the shared nested-test helper, route both IRI and QUIC through it, and extend the action-context regression to cover the toolchain variables.

3. 537edbc5
   Merge pull request #39 from flyology-ada/codex/scoped-h1-stale-reuse

   Recover scoped safe reads from silently stale H1 leases

3 source commits

1. 22d8ee67
   Problem: Composable HTTP calls live in parallel Scoped namespaces

   Scoped describes an operation's limited lifetime and ownership discipline, not the provider that performs it. Keeping client and server operation forms in child namespaces makes callers learn two API trees for one state machine, obscures synchronous parity, and encourages downstream wrappers and documentation drift.

   Solution: Colocate composable overloads with their providers

   Move the limited constructors, same-name established initiators, operation state accessors, and typed Finish overloads directly into Flyology.HTTP.Client and Flyology.HTTP.Server. Remove both Scoped namespaces without aliases, migrate every executable caller, and retain the existing ownership, certainty, cancellation, drain, deadline, protocol, and guarded stale-H1 behavior.

2. 17a403e5
   Problem: HTTP guidance still presents composability as an execution namespace

   The corpus vocabulary, differential tools, generated expectations, architecture notes, and website guides still name Scoped as a parallel API style. That language would teach the removed namespace and leave provider ownership hard to discover after the intentional development-line source break.

   Solution: Document provider-centric composable operations

   Rename corpus execution styles to composable buffer and sink forms, regenerate the Ada oracle, and update conformance and differential tooling. Revise the guides and architecture to place root constructors, established initiation, and typed Finish beside synchronous provider calls while preserving scoped lifetime as an operation semantic.

3. b5cd966d
   Merge pull request #40 from flyology-ada/codex/flatten-composable-http-api

   Colocate composable HTTP operations with providers

46 source commits

1. 7a4ec6c3
   Problem: Server body accounting narrows S3-scale transfers (#24)

   Request limits, decoded-byte counters, route policy, metrics, and diagnostics use Natural throughout the server stack. Values above the platform Natural range can therefore fail during framing or truncate accounting, while the global 1 MiB protocol ceiling prevents S3-scale streaming even when applications retain nothing.

   Solution: Share one 64-bit-safe body size across client and server

   Introduce Flyology.HTTP.Body_Size and carry it through HTTP/1, HTTP/2, HTTP/3, routing, exchanges, logs, and metrics. Raise the streaming protocol ceiling to the current 50 TB S3 object bound while preserving independent ingress limits and the HTTP/3 profile's existing 1 MiB retained-body cap. Make decimal, hexadecimal, accumulation, and metric arithmetic overflow-safe; add 5 GiB and out-of-range framing regressions; and document the streaming-versus-retention boundary.

2. ca058efa
   Preserve S3 request fidelity and stream H2/H3 uploads (#25)

   * Problem: S3 request fidelity and streaming stop at protocol boundaries

   Solution: preserve authority, physical headers, and request trailers through every server engine; stream borrowed uploads through bounded HTTP/2 and HTTP/3 flow-control paths; raise bounded target metadata limits; and qualify canonicalization, trailers, and cross-boundary uploads.

   * Problem: streaming backpressure can starve protocol progress

   Solution: make H2 wait predicates fragment-size aware, poll output immediately before sleeping, stop H3 uploads on early final responses, and isolate H3 qualification runtimes. Cover zero progress, overrun, source exceptions, cancellation, deadlines, early finals, reuse, and generated 64 GiB sources in both protocol integrations.

3. ffe9cb00
   Problem: QUIC has no stable release for current HTTP APIs (#26)

   Solution: release flyology_quic 0.1.1 with a stable Flyology dependency range, validated against the published 0.1.0 implementation.

4. 5638f1c6Problem: HTTP S3 prerequisites have no stable release (#27)
5. 80609dd7
   Problem: Released HTTP and QUIC changes are not summarized

   Flyology HTTP and Flyology QUIC 0.1.1 have published tags, but users cannot see the notable changes since 0.1.0 or trace them to their pull requests and commits.

   Solution: Add crate-scoped release changelogs

   Document both release ranges in Keep a Changelog format with version comparisons and source links.

6. 8279a99d
   Problem: Server streams cannot declare exact response lengths

   Object storage handlers know representation sizes but the server only offers retained responses or unknown-length streams. That forces HTTP/1.1 chunking, prevents correct HEAD metadata, and leaves overruns and underruns unchecked.

   Solution: Add proved fixed-length streaming responses

   Expose 64-bit Content_Length overloads through the raw and application APIs, enforce exact completion across HTTP/1.1, HTTP/2, and HTTP/3, preserve HEAD suppression and unknown-length compatibility, and qualify framing, failures, isolation, backpressure, large logical lengths, proofs, and documentation.

7. 548a41c8
   Solution: Record fixed-length response streams

   Add the new server API, exact framing and completion guarantees, HEAD behavior, and stream-isolation semantics to the unreleased HTTP changelog.

8. 8cc0e4c5
   Add exact fixed-length server response streams (#28)

   Expose 64-bit known-length streams across HTTP/1.1, HTTP/2, and HTTP/3 with proved exact accounting, correct HEAD semantics, bounded backpressure, failure isolation, tests, and documentation.

9. 80e7f6b9fix(http2): accept empty HEAD stream completion
10. fc54793d
    Merge pull request #29 from flyology-ada/codex/fix-http2-head-completion

    fix(http2): accept empty HEAD stream completion

11. 4e93366frelease flyology_http 0.1.2
12. 8f34e73b
    Merge pull request #30 from flyology-ada/codex/release-http-0.1.2

    release flyology_http 0.1.2

13. 2e356498
    Problem: HTTP parsing waits hide protocol state on the blocking stack

    Request-head input inspection and chunked-body framing combine transport suspension with parser progress. In particular, trailer phase and byte accounting are local to a blocking loop, so a scoped operation cannot suspend and resume without duplicating parser semantics or retaining a helper stack.

    Solution: Factor HTTP input parsing into bounded immediate steps

    Separate request initialization and buffered-input inspection, promote trailer progress into the connection state, and advance body framing one bounded transition at a time. Keep the synchronous entry points driving the same steps, and exercise every header, chunk, terminator, and trailer boundary with one-byte transport fragmentation.

14. a1b43b16
    Problem: Composable HTTP work lacks a controlled performance baseline

    Changing the request wait path can alter the existing native and lightweight HTTP performance profile. Without an untouched c128 cohort and an explicit foundation pin, later throughput or latency changes cannot be attributed or reproduced.

    Solution: Pin the Flyology operation branch and record baseline evidence

    Track codex/composable-operations through a branch pin that remains easy to advance, and document the exact baseline commits, environment, 16-loop runtime, commands, three-sample throughput and latency distributions, resource controls, noise caveats, and pre-existing nested-suite mismatch.

15. 8e1b04a5
    Problem: HTTP server waits cannot compose as operations

    The public request-head and streaming-body entry points suspend directly through a class-wide transport. Callers cannot combine them with Flyology timers, gates, cancellation, connection setup, or counted completion waits while preserving connection and borrowed-buffer lifetimes.

    Solution: add bounded scoped HTTP server operations

    Add a public immediate-step transport capability backed by the set-independent connection driver, scoped request-head, body-acceptance, and body-read operations, and retained typed Finish procedures. Share bounded parser transitions with the synchronous API, initialize closure state on every parse path, preserve original failures through cleanup, and cover native and lightweight composition, TLS upgrade, cancellation, failure retention, cleanup, partial I/O, and synchronous parity.

16. d88e70cb
    Problem: Composable HTTP candidate performance is unqualified

    The controlled c128 baseline has no post-change measurements, so reviewers cannot distinguish steady-state regression from host noise or verify the final success count and latency profile.

    Solution: record the current-pin candidate campaign

    Document the exact Flyology and HTTP revisions, qualification commands, three samples per workload and lane, median throughput and latency, baseline deltas, all-success response count, and the observed run-order noise. Mark the results as current-pin evidence that must be repeated when the foundation revision advances.

17. fcac4635
    Problem: TLS test adapter no longer matches the controller contract

    The final composable-operations foundation refactors the private TLS descriptor controller around explicit operation states. The HTTP repository's test-only child body still calls the removed acquisition primitives, so its authoritative suite cannot compile against the advanced branch pin.

    Solution: synchronize the TLS test adapter state transitions

    Use Start_Operation, Try_Acquire, Abandon_Operation, and state-aware Release exactly as the foundation test helper does. Preserve the existing Generation and stale-acquisition test behavior without adding any production dependency on the private controller.

18. 18a9ad70
    Problem: Final composable HTTP performance is unqualified

    The intermediate benchmark covers an earlier Flyology operation-provider revision and ran while unrelated stale compiler probes loaded the host. It cannot qualify the replacement PR #60 head or distinguish a synchronous-path regression from host contention.

    Solution: record the serialized final c128 campaign

    Document fresh suite and GNATdoc validation on exact Flyology 195b228, all three alternating 16-loop and native trials, latency and throughput summaries, HTTP status results, and wrapper resource evidence. State the contention caveat and the supported conclusion that the final candidate preserves the established performance profile.

19. 8de52f57
    Problem: HTTP still depends on the temporary Flyology branch pin

    Flyology composable operations are merged and published as 0.1.1-dev in the organization index. Keeping the mutable Git branch override bypasses that validated release resolution and leaves the consumer tied to review infrastructure.

    Solution: resolve Flyology from the organization index

    Require flyology 0.1.1-dev and remove the custom Git pin. The resolved release is the merged main commit 159210ca44eff9f636e933195bf176c3500ff60e.

20. a91e1a77
    Problem: Alire test actions can re-enter HTTP dependency setup

    The manifest test action exports ALIRE and Flyology paths without the private HTTP test marker. The test entry can therefore invoke a nested root build, and its IRI child inherits outer dependency paths into a separate Alire workspace.

    Solution: reuse the active Alire test context

    Recognize the standard action environment before any build decision, export the existing marker, and sanitize outer Flyology paths only for the IRI child workspace. Add a shell regression for action-marker inheritance, child isolation, and unchanged direct invocation.

21. f4d98b2c
    Problem: Composable HTTP operations lack usage guidance

    The low-level HTTP/1.x server API exposes bounded request-head and body operations, but the website does not explain their transport requirements, lifecycle, composition rules, or ownership limits.

    Solution: Add a bounded operations guide

    Document synchronous versus scoped calls, operation-capable plain and upgraded-TLS transports, slot sizing, typed Finish, body sequencing, waits, gates, cancellation, retained failures, and borrowed lifetimes. Link the guide from the guide index, server guide, and llms.txt.

22. f4fd9c3e
    Merge pull request #31 from flyology-ada/codex/composable-http-operations

    Add composable HTTP server operations

23. 6f72c29b
    Problem: QUIC receive windows cannot advance for large HTTP/3 responses

    The application stream reassembler is fixed at the initial receive window and the connection cannot return MAX_STREAM_DATA credit. Whole HTTP/3 responses above 16 KiB therefore stall, and old retransmissions below the consumed base can underflow reassembly offsets.

    Solution: add rolling stream receive credit

    Track consumed stream bases, encode and schedule MAX_STREAM_DATA, preserve final-size and overlap checks across window advances, and cover credit, reuse, overlap, and retired retransmission behavior with policy tests.

24. f0d630d0
    Problem: HTTP client exchanges block inside duplicate protocol engines

    Object storage and database providers cannot compose admission, upload, response-head, and complete-body work on their completion-set owner stack. The synchronous client uses a separate monolithic path, which duplicates H1/H2/H3 policy and can replay ambiguous conditional mutations.

    Solution: make the composable exchange engine canonical

    Add limited root and established exchange operations for owned buffers and streaming sinks, transactional Unique_Buffer restoration, monotonic admission certainty, typed environmental outcomes, one absolute deadline, owner-driven DNS/connect/TLS/H1/H2/H3 children, multiplexed stream isolation, and cancellation drain. Route synchronous Execute through the same request and response-head engine while preserving its retained-response API and exception semantics.

25. 3d72adbc
    Problem: client correctness has no uniform executable protocol corpus

    The synchronous and composable APIs need the same deterministic scenarios across H1, H2, and H3, including ambiguity, ownership restoration, blocked sources, cancellation drain, malformed multiplexed responses, and large flow-controlled bodies. Existing protocol tests do not provide one shared golden oracle or complete CI coverage.

    Solution: gate both APIs with a shared client corpus

    Add standards-backed JSON scenarios, checked-in binary and hex fixtures, generated Ada expectations, source and sink fault providers, native/lightweight scoped matrices, h2specd client coverage, aioquic and PycURL differentials, large-body reuse, lost-final-response and no-replay oracles, and required CI execution. Ignore Python bytecode artifacts.

26. 4b1b91c3
    Problem: the client guide documents only blocking exchange behavior

    Users cannot discover the scoped complete-body operations, ownership restoration, admission certainty, parent composition, readiness bounds, or the fact that synchronous Execute now uses the same canonical protocol engine.

    Solution: document composable client exchanges

    Add a complete buffer and sink workflow, child-operation example, cancellation and ambiguity rules, protocol readiness bounds, task-free multiplexing details, current address iteration behavior, corpus evidence boundaries, and development-version changelog entries.

27. d60726a8
    Problem: Agent resources lack reproducible package ownership

    Fresh clones need a deterministic way to provision Codex and Claude resources without committed skill symlinks. Repository-specific instruction scopes also need to remain owned and versioned with the code they govern instead of becoming shared policy accidentally.

    Solution: Compose local and shared APM packages

    Package each existing repository scope under agent-packages, pin the validated shared profile at an exact commit, and commit the resolved lockfile and generated Codex guides. Document pinned APM installation and add CI that installs Claude rules and both skill trees, compiles Codex instructions, audits the graph, and checks drift.

28. 4e5fc625
    Problem: QUIC packet rollback exhausts the owner task stack

    Multi-stream packet validation copies the complete bounded stream table before reassembly. The copy adds roughly a megabyte to the owner task's deepest HTTP/3 receive path, so sustained exchanges can overflow an otherwise bounded Flyology task stack.

    Solution: commit stream reassembly in place after packet validation

    Apply validated stream frames directly and rely on the connection-fatal reassembly-conflict boundary to prevent later reuse. Add a driver-level poison-and-no-reuse regression and explicit SPARK witnesses for the receive-window and stream-table invariants; the complete QUIC policy suite proves all 2,156 checks.

29. 37b7cbbb
    Problem: sustained client exchanges exhaust owner stack storage

    Synchronous compatibility calls accumulate limited function-return temporaries in long caller scopes, while HTTP/3 keeps large event scratch in exchange and body-reader frames. Retry recursion and protocol cleanup diagnostics add further depth, and the HTTP/2 bounded-body check misclassifies representation lengths on body-forbidden responses.

    Solution: reuse results and persistent protocol scratch

    Add procedural Execute and Read_All overloads that drive the same composable engine, make redirect retries iterative, and retain one serialized HTTP/3 event per pooled connection. Remove the legacy synchronous HTTP/3 body path, preserve causal drain phases, flush queued HTTP/2 shutdown work, and align body-forbidden capacity semantics across protocols. Gate the result with 10,000-exchange HTTP/1.1 and HTTP/2 loops, reduced-stack concurrent 8,000-exchange HTTP/3 clients, scoped HEAD/304 buffer regressions, and the repaired deterministic conformance harness.

30. 2f8add5d
    Problem: Agents updates require manifest edits

    The shared package is pinned to a full commit in apm.yml, duplicating the
    lockfile and preventing apm update from advancing the reviewed dependency
    without rewriting the manifest.

    Solution: Track agents main through the lockfile

    Declare main as the update channel, refresh the exact lockfile pin, and
    document the explicit update, compilation, and audit workflow.

31. aba55512
    Problem: Long reuse tests inherit connection age rotation

    The extended H1 and H2 reuse regressions are intended to detect stack growth and slot leaks across 10,000 or more exchanges. On a slow runner, the default total connection age expires during the H2 loop. The client correctly retires that transport, but the single-connection independent peer exits and the test misreports the expected rotation as a client failure. Its truncated peer log also hides the terminal request count.

    Solution: Isolate reuse stress from pool age policy

    Disable total-age rotation only in the long H1 and H2 reuse scenarios, consistent with the existing HTTP/2 soak qualification. Keep rotation under the separate deterministic pool-policy tests. Report both ends and aggregate counts from a failed HTTP/2 peer trace so future long-run failures retain useful evidence.

32. 7daf0b4a
    Problem: Consumer agents omit the required review cycle

    The locked shared package graph predates the findings-driven review rule, so
    Codex and Claude in this repository do not yet require architectural decisions
    and implementation changes to close P0 and P1 findings or explicitly dispose
    of P2 findings before completion.

    Solution: Adopt the shared review-cycle package

    Advance the exact agents lock to the reviewed shared commit and regenerate
    Codex instructions so both clients receive the same remediation and repeat-
    review requirements.

33. ef6c8d9c
    Problem: Consumer constants audits lose approved value authority

    The locked shared skill reports hard-coded value decisions but does not require
    their durable authority to be recorded beside Ada declarations. Future changes
    can therefore mistake protocol mandates, derived arithmetic, or test capacities
    for arbitrary production policy.

    Solution: Adopt source-adjacent authority documentation

    Advance the exact shared agents lock to the reviewed constants skill. The
    updated portable workflow preserves consequential choices and their stable
    authority in comments while excluding harmless literals from comment noise.

34. 8a527902
    Problem: HTTP/2 client resets malformed-frame connections

    The composable and synchronous HTTP/2 client rejects a malformed frame from its header before consuming a bounded declared payload. On Linux, closing the socket with those peer bytes unread can replace the queued GOAWAY with a TCP reset, so h2spec cannot observe the required protocol error. Invalid frame lengths also use the generic protocol error instead of FRAME_SIZE_ERROR.

    Solution: Drain bounded malformed frames before protocol failure

    Wait for and consume the declared payload when the complete malformed frame fits the fixed input buffer, matching the server-side defensive path. Select FRAME_SIZE_ERROR for excessive or invalid frame lengths and retain PROTOCOL_ERROR for other invalid headers.

35. 6e03ebce
    Problem: Consumer locks omit new shared review skills (#37)

    Repositories using the shared agents package remain pinned before the crate-spinout workflow and the refined constants-audit triage. Fresh sessions therefore cannot discover those reviewed capabilities.

    Solution: Refresh the shared agents lock

    Advance every shared package entry to the green agents main revision. The manifest keeps its main update channel while the lock preserves the exact commit and content hashes for reproducible Codex and Claude installs.

36. 882e2440
    Problem: HTTP/2 GOAWAY can be replaced by TCP reset

    After a peer protocol violation, the owner-stack pump writes GOAWAY and immediately releases the connection lease. Linux can turn that close into a TCP reset while peer input is still arriving, so h2spec cannot observe the required error on semantic CONTINUATION violations. Consuming malformed frame payloads alone does not cover these validly framed protocol errors.

    Solution: Drain protocol-error closes compositionally

    Retain the pump and transport lease after GOAWAY, discard one bounded receive chunk per owner-stack drive, and finish on peer close or a one-second monotonic cleanup deadline capped by the request deadline. Readiness and the cleanup timer remain on the existing operation slot, and normal exchanges are unchanged.

37. 41471605
    Problem: HTTP/3 reuse stress inherits server age rotation

    The 8,000-exchange HTTP/3 regression is intended to keep one connection alive while crossing stream-table and flow-control credit boundaries. Its test server still has a 20-second total connection age, so a loaded host retires the peer around exchange 5,000 to 7,000 and reports a timeout unrelated to stack or credit reuse.

    Solution: Isolate HTTP/3 reuse stress from age policy

    Disable total-age rotation only for the long-lived HTTP/3 fixture, matching the existing H1 and H2 reuse stress setup. Deterministic pool-policy tests continue to cover connection-age rotation.

38. 5f23f559
    Problem: Same-flight TLS errors can escape QUIC rejection

    A client can append a forbidden TLS message such as KeyUpdate after Finished in one Handshake CRYPTO range. The server accepts Finished and publishes Connected before checking the trailing message, so rejection depends on a later Handshake packet and h3spec can observe a successful connection.

    Solution: Reject complete trailing Handshake messages before connection publication

    Inspect the already-reassembled CRYPTO bytes immediately after Finished validation and emit the unexpected_message crypto close before HANDSHAKE_DONE. Repeat the exact published h3spec boundary ten times in the qualification gate to keep the scheduling-independent behavior executable.

39. db0346bb
    Problem: Boundary close checks reject valid peer resets

    The timeout and cancellation fixture expects abandoned HTTP/1 connections to end only with a zero-length receive. macOS can report a typed socket reset when the client closes with unread bytes, causing the raw server to abort and the following exchange to time out even though the client behavior is correct.

    Solution: Accept reset as terminal in the close-only fixture path

    Treat Socket_Error as peer termination only inside Expect_Close while preserving hard failures for request-head reads and response writes. The corrected fixture completes both native and lightweight lanes across 100 consecutive runs.

40. 262b0c2f
    Problem: HTTP/2 soak stalls hide their terminal wire state

    The qualification runner prints only the first peer events when a concurrent soak fails. A late lost-wakeup or stream-lifecycle stall therefore reports an old request rather than the active streams and event counts needed to distinguish protocol and scheduling failures.

    Solution: Preserve terminal HTTP/2 soak diagnostics

    Record completed request halves and timeout-time active streams in the independent peer. Print bounded first and final event windows plus aggregate request, response, reset, and timeout counts on failure.

41. 98c0e26f
    Problem: HTTP/2 pump contention can starve a stream

    A just-rescheduled stream can repeatedly reclaim the shared session pump while sibling streams only receive broadcast wakeups. Under concurrent load a sibling can therefore wait through its absolute request deadline even though the transport keeps making progress.

    Solution: Hand off the HTTP/2 pump fairly

    Track bounded waiter state inside the protected session controller and reserve each released pump for the next waiter in round-robin order. Cover the no-cut-in handoff sequence with a deterministic four-stream regression.

42. 23051ca7
    Problem: Synchronous H2 bodies can bypass protocol close drain

    The synchronous response-body adapter returns as soon as its stream is locally ready or already complete. If an invalid peer frame is received with the final response, that path can release the transport after queuing GOAWAY but before the bounded close drain, replacing the protocol error with TCP reset.

    Solution: Preserve composable drain semantics in the sync adapter

    Keep driving the shared pump through its reported closing-drain budget regardless of local stream readiness, and settle already-complete H2 bodies before returning. The adapter uses the same pump, monotonic request deadline, and bounded one-second protocol-close budget as the composable exchange.

43. b7fb5474
    Problem: owner-driven h2spec can outrun late invalid frames

    The conformance executable exits after one full exchange. A malicious frame sent just after the response reaches would-block can arrive after the last operation terminalizes, so the peer observes a TCP reset instead of the required HTTP/2 error response. This made closed-stream h2spec cases timing-dependent in CI.

    Solution: give conformance exchanges a bounded settlement probe

    Add a per-client testing-only grace interval that defaults to zero. The synchronous and scoped adapters use their existing owner-stack pump, transport readiness, completion slot, and absolute deadline for one bounded post-response probe. Enable 50 ms only in the h2specd driver and document the qualification boundary.

44. 153c9c80
    Problem: loaded h2spec peers exceed the initial settlement probe

    The 50 ms conformance-only readiness interval can expire before a lightweight-owner peer schedules a CONTINUATION following RST_STREAM. The client then exits and h2spec observes a TCP reset instead of the queued HTTP/2 stream or connection error.

    Solution: widen the bounded conformance probe to 250 ms

    Keep the production default at zero while giving the single-exchange h2specd driver enough owner-stack readiness time under CI load. Document the exact bound; no helper task, protocol path, completion slot, or application latency changes.

45. 09e95348
    Problem: development manifests imply unreleased version advances

    The composable-client branch declares flyology_http 0.1.3-dev and flyology_quic 0.1.2-dev even though this work is published by advancing the existing 0.1.1-dev sessions without a stable release. The mismatch would force unnecessary index-version bootstrapping and give consumers the wrong session coordinates.

    Solution: keep both active sessions at 0.1.1-dev

    Restore the HTTP and QUIC crate versions and the exact HTTP-to-QUIC development constraint to 0.1.1-dev. Record that this work advances development origins only and creates no stable release tag.

46. 92820c5f
    Merge pull request #33 from flyology-ada/codex/composable-http-client-async

    Add composable owner-driven HTTP client exchanges

34 source commits

1. 2e356498
   Problem: HTTP parsing waits hide protocol state on the blocking stack

   Request-head input inspection and chunked-body framing combine transport suspension with parser progress. In particular, trailer phase and byte accounting are local to a blocking loop, so a scoped operation cannot suspend and resume without duplicating parser semantics or retaining a helper stack.

   Solution: Factor HTTP input parsing into bounded immediate steps

   Separate request initialization and buffered-input inspection, promote trailer progress into the connection state, and advance body framing one bounded transition at a time. Keep the synchronous entry points driving the same steps, and exercise every header, chunk, terminator, and trailer boundary with one-byte transport fragmentation.

2. a1b43b16
   Problem: Composable HTTP work lacks a controlled performance baseline

   Changing the request wait path can alter the existing native and lightweight HTTP performance profile. Without an untouched c128 cohort and an explicit foundation pin, later throughput or latency changes cannot be attributed or reproduced.

   Solution: Pin the Flyology operation branch and record baseline evidence

   Track codex/composable-operations through a branch pin that remains easy to advance, and document the exact baseline commits, environment, 16-loop runtime, commands, three-sample throughput and latency distributions, resource controls, noise caveats, and pre-existing nested-suite mismatch.

3. 8e1b04a5
   Problem: HTTP server waits cannot compose as operations

   The public request-head and streaming-body entry points suspend directly through a class-wide transport. Callers cannot combine them with Flyology timers, gates, cancellation, connection setup, or counted completion waits while preserving connection and borrowed-buffer lifetimes.

   Solution: add bounded scoped HTTP server operations

   Add a public immediate-step transport capability backed by the set-independent connection driver, scoped request-head, body-acceptance, and body-read operations, and retained typed Finish procedures. Share bounded parser transitions with the synchronous API, initialize closure state on every parse path, preserve original failures through cleanup, and cover native and lightweight composition, TLS upgrade, cancellation, failure retention, cleanup, partial I/O, and synchronous parity.

4. d88e70cb
   Problem: Composable HTTP candidate performance is unqualified

   The controlled c128 baseline has no post-change measurements, so reviewers cannot distinguish steady-state regression from host noise or verify the final success count and latency profile.

   Solution: record the current-pin candidate campaign

   Document the exact Flyology and HTTP revisions, qualification commands, three samples per workload and lane, median throughput and latency, baseline deltas, all-success response count, and the observed run-order noise. Mark the results as current-pin evidence that must be repeated when the foundation revision advances.

5. fcac4635
   Problem: TLS test adapter no longer matches the controller contract

   The final composable-operations foundation refactors the private TLS descriptor controller around explicit operation states. The HTTP repository's test-only child body still calls the removed acquisition primitives, so its authoritative suite cannot compile against the advanced branch pin.

   Solution: synchronize the TLS test adapter state transitions

   Use Start_Operation, Try_Acquire, Abandon_Operation, and state-aware Release exactly as the foundation test helper does. Preserve the existing Generation and stale-acquisition test behavior without adding any production dependency on the private controller.

6. 18a9ad70
   Problem: Final composable HTTP performance is unqualified

   The intermediate benchmark covers an earlier Flyology operation-provider revision and ran while unrelated stale compiler probes loaded the host. It cannot qualify the replacement PR #60 head or distinguish a synchronous-path regression from host contention.

   Solution: record the serialized final c128 campaign

   Document fresh suite and GNATdoc validation on exact Flyology 195b228, all three alternating 16-loop and native trials, latency and throughput summaries, HTTP status results, and wrapper resource evidence. State the contention caveat and the supported conclusion that the final candidate preserves the established performance profile.

7. 8de52f57
   Problem: HTTP still depends on the temporary Flyology branch pin

   Flyology composable operations are merged and published as 0.1.1-dev in the organization index. Keeping the mutable Git branch override bypasses that validated release resolution and leaves the consumer tied to review infrastructure.

   Solution: resolve Flyology from the organization index

   Require flyology 0.1.1-dev and remove the custom Git pin. The resolved release is the merged main commit 159210ca44eff9f636e933195bf176c3500ff60e.

8. a91e1a77
   Problem: Alire test actions can re-enter HTTP dependency setup

   The manifest test action exports ALIRE and Flyology paths without the private HTTP test marker. The test entry can therefore invoke a nested root build, and its IRI child inherits outer dependency paths into a separate Alire workspace.

   Solution: reuse the active Alire test context

   Recognize the standard action environment before any build decision, export the existing marker, and sanitize outer Flyology paths only for the IRI child workspace. Add a shell regression for action-marker inheritance, child isolation, and unchanged direct invocation.

9. f4d98b2c
   Problem: Composable HTTP operations lack usage guidance

   The low-level HTTP/1.x server API exposes bounded request-head and body operations, but the website does not explain their transport requirements, lifecycle, composition rules, or ownership limits.

   Solution: Add a bounded operations guide

   Document synchronous versus scoped calls, operation-capable plain and upgraded-TLS transports, slot sizing, typed Finish, body sequencing, waits, gates, cancellation, retained failures, and borrowed lifetimes. Link the guide from the guide index, server guide, and llms.txt.

10. f4fd9c3e
    Merge pull request #31 from flyology-ada/codex/composable-http-operations

    Add composable HTTP server operations

11. 6f72c29b
    Problem: QUIC receive windows cannot advance for large HTTP/3 responses

    The application stream reassembler is fixed at the initial receive window and the connection cannot return MAX_STREAM_DATA credit. Whole HTTP/3 responses above 16 KiB therefore stall, and old retransmissions below the consumed base can underflow reassembly offsets.

    Solution: add rolling stream receive credit

    Track consumed stream bases, encode and schedule MAX_STREAM_DATA, preserve final-size and overlap checks across window advances, and cover credit, reuse, overlap, and retired retransmission behavior with policy tests.

12. f0d630d0
    Problem: HTTP client exchanges block inside duplicate protocol engines

    Object storage and database providers cannot compose admission, upload, response-head, and complete-body work on their completion-set owner stack. The synchronous client uses a separate monolithic path, which duplicates H1/H2/H3 policy and can replay ambiguous conditional mutations.

    Solution: make the composable exchange engine canonical

    Add limited root and established exchange operations for owned buffers and streaming sinks, transactional Unique_Buffer restoration, monotonic admission certainty, typed environmental outcomes, one absolute deadline, owner-driven DNS/connect/TLS/H1/H2/H3 children, multiplexed stream isolation, and cancellation drain. Route synchronous Execute through the same request and response-head engine while preserving its retained-response API and exception semantics.

13. 3d72adbc
    Problem: client correctness has no uniform executable protocol corpus

    The synchronous and composable APIs need the same deterministic scenarios across H1, H2, and H3, including ambiguity, ownership restoration, blocked sources, cancellation drain, malformed multiplexed responses, and large flow-controlled bodies. Existing protocol tests do not provide one shared golden oracle or complete CI coverage.

    Solution: gate both APIs with a shared client corpus

    Add standards-backed JSON scenarios, checked-in binary and hex fixtures, generated Ada expectations, source and sink fault providers, native/lightweight scoped matrices, h2specd client coverage, aioquic and PycURL differentials, large-body reuse, lost-final-response and no-replay oracles, and required CI execution. Ignore Python bytecode artifacts.

14. 4b1b91c3
    Problem: the client guide documents only blocking exchange behavior

    Users cannot discover the scoped complete-body operations, ownership restoration, admission certainty, parent composition, readiness bounds, or the fact that synchronous Execute now uses the same canonical protocol engine.

    Solution: document composable client exchanges

    Add a complete buffer and sink workflow, child-operation example, cancellation and ambiguity rules, protocol readiness bounds, task-free multiplexing details, current address iteration behavior, corpus evidence boundaries, and development-version changelog entries.

15. d60726a8
    Problem: Agent resources lack reproducible package ownership

    Fresh clones need a deterministic way to provision Codex and Claude resources without committed skill symlinks. Repository-specific instruction scopes also need to remain owned and versioned with the code they govern instead of becoming shared policy accidentally.

    Solution: Compose local and shared APM packages

    Package each existing repository scope under agent-packages, pin the validated shared profile at an exact commit, and commit the resolved lockfile and generated Codex guides. Document pinned APM installation and add CI that installs Claude rules and both skill trees, compiles Codex instructions, audits the graph, and checks drift.

16. 4e5fc625
    Problem: QUIC packet rollback exhausts the owner task stack

    Multi-stream packet validation copies the complete bounded stream table before reassembly. The copy adds roughly a megabyte to the owner task's deepest HTTP/3 receive path, so sustained exchanges can overflow an otherwise bounded Flyology task stack.

    Solution: commit stream reassembly in place after packet validation

    Apply validated stream frames directly and rely on the connection-fatal reassembly-conflict boundary to prevent later reuse. Add a driver-level poison-and-no-reuse regression and explicit SPARK witnesses for the receive-window and stream-table invariants; the complete QUIC policy suite proves all 2,156 checks.

17. 37b7cbbb
    Problem: sustained client exchanges exhaust owner stack storage

    Synchronous compatibility calls accumulate limited function-return temporaries in long caller scopes, while HTTP/3 keeps large event scratch in exchange and body-reader frames. Retry recursion and protocol cleanup diagnostics add further depth, and the HTTP/2 bounded-body check misclassifies representation lengths on body-forbidden responses.

    Solution: reuse results and persistent protocol scratch

    Add procedural Execute and Read_All overloads that drive the same composable engine, make redirect retries iterative, and retain one serialized HTTP/3 event per pooled connection. Remove the legacy synchronous HTTP/3 body path, preserve causal drain phases, flush queued HTTP/2 shutdown work, and align body-forbidden capacity semantics across protocols. Gate the result with 10,000-exchange HTTP/1.1 and HTTP/2 loops, reduced-stack concurrent 8,000-exchange HTTP/3 clients, scoped HEAD/304 buffer regressions, and the repaired deterministic conformance harness.

18. 2f8add5d
    Problem: Agents updates require manifest edits

    The shared package is pinned to a full commit in apm.yml, duplicating the
    lockfile and preventing apm update from advancing the reviewed dependency
    without rewriting the manifest.

    Solution: Track agents main through the lockfile

    Declare main as the update channel, refresh the exact lockfile pin, and
    document the explicit update, compilation, and audit workflow.

19. aba55512
    Problem: Long reuse tests inherit connection age rotation

    The extended H1 and H2 reuse regressions are intended to detect stack growth and slot leaks across 10,000 or more exchanges. On a slow runner, the default total connection age expires during the H2 loop. The client correctly retires that transport, but the single-connection independent peer exits and the test misreports the expected rotation as a client failure. Its truncated peer log also hides the terminal request count.

    Solution: Isolate reuse stress from pool age policy

    Disable total-age rotation only in the long H1 and H2 reuse scenarios, consistent with the existing HTTP/2 soak qualification. Keep rotation under the separate deterministic pool-policy tests. Report both ends and aggregate counts from a failed HTTP/2 peer trace so future long-run failures retain useful evidence.

20. 7daf0b4a
    Problem: Consumer agents omit the required review cycle

    The locked shared package graph predates the findings-driven review rule, so
    Codex and Claude in this repository do not yet require architectural decisions
    and implementation changes to close P0 and P1 findings or explicitly dispose
    of P2 findings before completion.

    Solution: Adopt the shared review-cycle package

    Advance the exact agents lock to the reviewed shared commit and regenerate
    Codex instructions so both clients receive the same remediation and repeat-
    review requirements.

21. ef6c8d9c
    Problem: Consumer constants audits lose approved value authority

    The locked shared skill reports hard-coded value decisions but does not require
    their durable authority to be recorded beside Ada declarations. Future changes
    can therefore mistake protocol mandates, derived arithmetic, or test capacities
    for arbitrary production policy.

    Solution: Adopt source-adjacent authority documentation

    Advance the exact shared agents lock to the reviewed constants skill. The
    updated portable workflow preserves consequential choices and their stable
    authority in comments while excluding harmless literals from comment noise.

22. 8a527902
    Problem: HTTP/2 client resets malformed-frame connections

    The composable and synchronous HTTP/2 client rejects a malformed frame from its header before consuming a bounded declared payload. On Linux, closing the socket with those peer bytes unread can replace the queued GOAWAY with a TCP reset, so h2spec cannot observe the required protocol error. Invalid frame lengths also use the generic protocol error instead of FRAME_SIZE_ERROR.

    Solution: Drain bounded malformed frames before protocol failure

    Wait for and consume the declared payload when the complete malformed frame fits the fixed input buffer, matching the server-side defensive path. Select FRAME_SIZE_ERROR for excessive or invalid frame lengths and retain PROTOCOL_ERROR for other invalid headers.

23. 6e03ebce
    Problem: Consumer locks omit new shared review skills (#37)

    Repositories using the shared agents package remain pinned before the crate-spinout workflow and the refined constants-audit triage. Fresh sessions therefore cannot discover those reviewed capabilities.

    Solution: Refresh the shared agents lock

    Advance every shared package entry to the green agents main revision. The manifest keeps its main update channel while the lock preserves the exact commit and content hashes for reproducible Codex and Claude installs.

24. 882e2440
    Problem: HTTP/2 GOAWAY can be replaced by TCP reset

    After a peer protocol violation, the owner-stack pump writes GOAWAY and immediately releases the connection lease. Linux can turn that close into a TCP reset while peer input is still arriving, so h2spec cannot observe the required error on semantic CONTINUATION violations. Consuming malformed frame payloads alone does not cover these validly framed protocol errors.

    Solution: Drain protocol-error closes compositionally

    Retain the pump and transport lease after GOAWAY, discard one bounded receive chunk per owner-stack drive, and finish on peer close or a one-second monotonic cleanup deadline capped by the request deadline. Readiness and the cleanup timer remain on the existing operation slot, and normal exchanges are unchanged.

25. 41471605
    Problem: HTTP/3 reuse stress inherits server age rotation

    The 8,000-exchange HTTP/3 regression is intended to keep one connection alive while crossing stream-table and flow-control credit boundaries. Its test server still has a 20-second total connection age, so a loaded host retires the peer around exchange 5,000 to 7,000 and reports a timeout unrelated to stack or credit reuse.

    Solution: Isolate HTTP/3 reuse stress from age policy

    Disable total-age rotation only for the long-lived HTTP/3 fixture, matching the existing H1 and H2 reuse stress setup. Deterministic pool-policy tests continue to cover connection-age rotation.

26. 5f23f559
    Problem: Same-flight TLS errors can escape QUIC rejection

    A client can append a forbidden TLS message such as KeyUpdate after Finished in one Handshake CRYPTO range. The server accepts Finished and publishes Connected before checking the trailing message, so rejection depends on a later Handshake packet and h3spec can observe a successful connection.

    Solution: Reject complete trailing Handshake messages before connection publication

    Inspect the already-reassembled CRYPTO bytes immediately after Finished validation and emit the unexpected_message crypto close before HANDSHAKE_DONE. Repeat the exact published h3spec boundary ten times in the qualification gate to keep the scheduling-independent behavior executable.

27. db0346bb
    Problem: Boundary close checks reject valid peer resets

    The timeout and cancellation fixture expects abandoned HTTP/1 connections to end only with a zero-length receive. macOS can report a typed socket reset when the client closes with unread bytes, causing the raw server to abort and the following exchange to time out even though the client behavior is correct.

    Solution: Accept reset as terminal in the close-only fixture path

    Treat Socket_Error as peer termination only inside Expect_Close while preserving hard failures for request-head reads and response writes. The corrected fixture completes both native and lightweight lanes across 100 consecutive runs.

28. 262b0c2f
    Problem: HTTP/2 soak stalls hide their terminal wire state

    The qualification runner prints only the first peer events when a concurrent soak fails. A late lost-wakeup or stream-lifecycle stall therefore reports an old request rather than the active streams and event counts needed to distinguish protocol and scheduling failures.

    Solution: Preserve terminal HTTP/2 soak diagnostics

    Record completed request halves and timeout-time active streams in the independent peer. Print bounded first and final event windows plus aggregate request, response, reset, and timeout counts on failure.

29. 98c0e26f
    Problem: HTTP/2 pump contention can starve a stream

    A just-rescheduled stream can repeatedly reclaim the shared session pump while sibling streams only receive broadcast wakeups. Under concurrent load a sibling can therefore wait through its absolute request deadline even though the transport keeps making progress.

    Solution: Hand off the HTTP/2 pump fairly

    Track bounded waiter state inside the protected session controller and reserve each released pump for the next waiter in round-robin order. Cover the no-cut-in handoff sequence with a deterministic four-stream regression.

30. 23051ca7
    Problem: Synchronous H2 bodies can bypass protocol close drain

    The synchronous response-body adapter returns as soon as its stream is locally ready or already complete. If an invalid peer frame is received with the final response, that path can release the transport after queuing GOAWAY but before the bounded close drain, replacing the protocol error with TCP reset.

    Solution: Preserve composable drain semantics in the sync adapter

    Keep driving the shared pump through its reported closing-drain budget regardless of local stream readiness, and settle already-complete H2 bodies before returning. The adapter uses the same pump, monotonic request deadline, and bounded one-second protocol-close budget as the composable exchange.

31. b7fb5474
    Problem: owner-driven h2spec can outrun late invalid frames

    The conformance executable exits after one full exchange. A malicious frame sent just after the response reaches would-block can arrive after the last operation terminalizes, so the peer observes a TCP reset instead of the required HTTP/2 error response. This made closed-stream h2spec cases timing-dependent in CI.

    Solution: give conformance exchanges a bounded settlement probe

    Add a per-client testing-only grace interval that defaults to zero. The synchronous and scoped adapters use their existing owner-stack pump, transport readiness, completion slot, and absolute deadline for one bounded post-response probe. Enable 50 ms only in the h2specd driver and document the qualification boundary.

32. 153c9c80
    Problem: loaded h2spec peers exceed the initial settlement probe

    The 50 ms conformance-only readiness interval can expire before a lightweight-owner peer schedules a CONTINUATION following RST_STREAM. The client then exits and h2spec observes a TCP reset instead of the queued HTTP/2 stream or connection error.

    Solution: widen the bounded conformance probe to 250 ms

    Keep the production default at zero while giving the single-exchange h2specd driver enough owner-stack readiness time under CI load. Document the exact bound; no helper task, protocol path, completion slot, or application latency changes.

33. 09e95348
    Problem: development manifests imply unreleased version advances

    The composable-client branch declares flyology_http 0.1.3-dev and flyology_quic 0.1.2-dev even though this work is published by advancing the existing 0.1.1-dev sessions without a stable release. The mismatch would force unnecessary index-version bootstrapping and give consumers the wrong session coordinates.

    Solution: keep both active sessions at 0.1.1-dev

    Restore the HTTP and QUIC crate versions and the exact HTTP-to-QUIC development constraint to 0.1.1-dev. Record that this work advances development origins only and creates no stable release tag.

34. 92820c5f
    Merge pull request #33 from flyology-ada/codex/composable-http-client-async

    Add composable owner-driven HTTP client exchanges

3 source commits

1. 2444df84
   Problem: stable releases supersede the active development channel

   HTTP and QUIC still identify their development sessions as 0.1.1-dev. Stable HTTP 0.1.2 and stable QUIC 0.1.1 retire those entries under the Alire index policy, so merged work cannot be published through the development channel and consumers must retain source pins.

   Solution: open a refreshable lockstep 0.1.3-dev channel

   Advance both indexed crate manifests to 0.1.3-dev, keep the HTTP dependency on QUIC exact at the matching development version, and record that this is a development rollover without stable tags.

2. 686094b1
   Problem: scoped H2 conformance can close before a late violation

   A peer can reset the active stream and immediately send a connection-level violation. The scoped lightweight exchange may finish cancellation and let a short-lived conformance client close between those frames, so h2spec observes TCP RST instead of the required HTTP/2 error handling.

   Solution: retain the configured settlement probe through cancellation

   When the explicit test-only HTTP/2 settlement grace is nonzero, perform one bounded owner-stack read probe before releasing a cancelled stream. Preserve the zero-duration production default, clear the probe state at terminal cancellation, and document the conformance fix.

3. a65f24f4
   Merge pull request #38 from flyology-ada/codex/http-0.1.2-dev-rollover

   Open the HTTP and QUIC 0.1.3-dev channel

7 source commits

1. c9ccf71b
   Problem: Running servers cannot change generations without losing continuity

   Flyology lacks a generation protocol, listener-capability handoff, and coordinated canary lifecycle for replacing a running server with a changed executable. Operators cannot prepare, admit, promote, cancel, drain, fence, or reverse generations through one reviewed ownership model.

   Solution: Add supervised process-generation upgrades and executable guide

   Implement the Ada-owned coordinator and agent protocol, narrow descriptor and bootstrap handoff mechanisms, lifecycle policy, ABI and behavioral checks, and a mechanically extracted two-artifact website guide that exercises promotion and cancellation.

2. 1fb1025e
   Problem: The upgrade guide does not identify the demo service

   Readers can follow coordinator calls without knowing what behavior changes between the two artifacts or what the verification request proves.

   Solution: Explain the example server and its observable cutover

   Describe the one-byte request/reply behavior, the distinct generation replies, and how promotion and cancellation assertions relate to new connections.

3. 5ec82af6
   Merge pull request #61 from flyology-ada/codex/process-upgrades

   Add supervised process-generation upgrades

4. 270984a3
   Problem: Benchmark CI failures hide their local test log

   The standalone flyology_bench Alire action captures command output in alire/alr_test_local.log. Hosted failures currently retain only Alire’s generic wrapper, so maintainers cannot identify which redirected smoke executable or assertion failed.

   Solution: Surface benchmark test diagnostics on failure

   Print the tail of the captured Alire log while preserving the original status, and label the two redirected smoke executables so the retained log names the active command. Successful test output remains unchanged apart from the command labels.

5. 0081ba78
   Problem: Benchmark smoke counter overflows on fast hosts

   The flyology_bench smoke fixture accumulates every calibrated operation in a Natural. Fast x86-64 runners can execute more than Natural Last operations across the suite, raising Constraint_Error before the runtime-specific tests begin.

   Solution: Use a modular 64-bit operation counter

   Store the volatile sink and scheduler-probe value directly as Interfaces.Unsigned_64. The counter now retains the intended observable work signal without a checked 32-bit accumulation limit.

6. 04ff6dcd
   Add direct managed client connections (#70)

   * Problem: Managed clients require raw socket adoption boilerplate

   Composable protocol clients need a managed Flyology connection before they can use the public connection driver, but callers must create and connect a raw socket and then transfer it through Take. This obscures the admission, deadline, cancellation, and cleanup boundary.

   Solution: Add a direct managed connection path

   Add Connections.Connect to reserve admission, create and connect the endpoint-family socket under one deadline, and atomically adopt it with existing guards. Cover both lanes, failure cleanup, TLS and driver composition, and document raw and managed client choices.

   * Problem: The managed connection test iterates a platform type

   Execution_Model is discrete on Darwin but an access type on Linux, so iterating its subtype prevents the new smoke test from compiling on a supported platform. The Darwin loop also repeats the configured project default rather than naming the two lanes under test.

   Solution: Run the two execution lanes explicitly

   Move the scenarios into Run_All and invoke it once for Lightweight_Task and once for Native_Task. This preserves the intended parity coverage without platform-dependent subtype iteration or a redundant default-lane pass.

7. 4ec71932
   Add scoped managed connection construction (#72)

   * Problem: Managed connection setup cannot join completion sets

   * Problem: Managed connect lacks a selective-wait regression

   The scoped construction tests use Wait_All, so they do not directly prove that a managed connect remains visible as one parent result while its hidden child is excluded from a heterogeneous success gate.

   Solution: exercise managed connect with a timer success gate

   Run the gate in both execution models, transfer the winning connection through typed Finish, cancel the timer sibling, and assert peer-close and admission cleanup.

47 source commits

1. 12eb5e12Problem: Benchmark confidence policy is fixed
2. a9567c3bProblem: Bootstrap settings permit pathological analysis
3. 2a4f4862
   Problem: Benchmark documentation links target a stale API anchor

   The statistical-policy changes alter the generated GNATdoc identity for Compare_Independent. The benchmarking guide and comparison journal retain the previous fragment, so the Pages link checker rejects the site built for PR #62.

   Solution: Point both links at the regenerated entity anchor

   Update the two deep links to the fragment emitted for Compare_Independent by the current flyology_bench API documentation.

4. 98f7201a
   Problem: Statistical smoke retains a stale counter type

   Current main widens the benchmark smoke counter to Unsigned_64 so fast hosts cannot overflow it. The statistical-policy layer snapshots that counter as Natural, making the rebased stack fail compilation before any benchmark runs.

   Solution: Match the snapshot to the widened counter

   Store the pre-execution snapshot as Interfaces.Unsigned_64 so assignment and comparison remain type-correct across the counter full range.

5. 1c7a45e4
   Problem: Equal-time smoke faults on noisy calibration ratios

   The statistical smoke compares two live timing medians against a fixed fourfold ratio. Very fast operations can calibrate into dissimilar observed slices under scheduler and timer noise even though both slices are valid, causing intermittent Program_Error before the benchmark API is exercised further.

   Solution: Validate timed-slice validity instead of proximity

   Require both retained median batch durations to be positive. The smoke still verifies that equal-time comparison produced timed samples and separately verifies the configured batching policy, without treating host timing noise as a correctness failure.

6. f628b406
   Problem: Interference smoke requires observable host load

   The retake and pause checks require a helper process to cross a tick-based host CPU counter window. Runner scheduling can leave no actionable contaminated window, so the test faults even though the harness reports a coherent observation.

   Solution: Validate responses only when the host observes them

   Use tick-sized interference samples and windows, retain bounded response and sample-count checks, and require pause counters, elapsed time, and retaken samples to agree. A run with no actionable external window is now a valid integration outcome.

7. 713783bfAdd extensible benchmark metrics and manual timing
8. cb1c0c6bFix custom metric comparison reporting
9. 1be316cbHarden manual timing adapters
10. 340086a7Preserve missing custom probe failures
11. cc7a3938
    Problem: Custom metrics bypass configured statistics

    Custom metric summaries and comparisons retain fixed bootstrap sizes and 95 percent interval tails after configurable statistical policy is introduced. Their additional intervals also remain outside the aggregate bootstrap-work ceiling.

    Solution: Apply the result's statistical policy to custom metrics

    Size custom bootstrap distributions from the configured resample count, derive their interval tails from the configured confidence level, and include every registered custom metric in bootstrap-work validation.

12. e9100447Add saved baseline regression gates
13. 4c4382afFix baseline gate compatibility and reporting
14. 8aba46e3Prove baseline regression arithmetic bounds
15. fedeeb77
    Problem: Baseline gates discard statistical policy

    The regression gate fixes every independent comparison at 95 percent confidence and 2,000 resamples even when callers use another benchmark policy. This also leaves the gate's bootstrap work outside the shared safety ceiling.

    Solution: Make gate statistics explicit and bounded

    Add source-compatible defaulted confidence and resample parameters to gate evaluation, propagate them through comparison and result metadata, validate aggregate bootstrap work, and cover non-default policy retention.

16. 0b9f10be
    Problem: Baseline equivalence smoke depends on live timing noise

    The saved and current inputs reuse one live measurement, but the independent bootstrap resamples them separately. Scheduler outliers can widen the interval beyond the fixed threshold, causing valid inconclusive results to fail the benchmark test intermittently on CI and locally.

    Solution: Exercise gate policy with deterministic samples

    Add a test-only child helper that constructs a private measurement from a fixed mildly dispersed vector. Use that measurement for equivalence, boundary, inconclusive, and reporter coverage while retaining live measurements for collection and coarse improvement/regression smoke checks.

17. de70616e
    Problem: Benchmark floating proofs exhaust level-one budgets

    The Ratio and Time_Change postconditions leave nonlinear floating-point bounds in combined prover searches. GNATprove 16.1.0 can reach its one-second level-one prover limit on Ubuntu CI even though repeated proofs may pass locally.

    Solution: Split the floating bounds into stable proof obligations

    State Ratio bounds directly in its postcondition and retain the exact Time_Change arithmetic while asserting each difficult bound in its matching branch. The final postcondition becomes a cheap control-flow merge without raising the global proof level or changing returned values.

18. 8b189587
    Problem: Benchmark proofs still exceed the CI prover limit

    Ubuntu GNATprove 16.1.0 still reaches the default one-second limit on the remaining Ratio monotonicity proof and the faster Time_Change bound. Further structural splits relocate the same floating-point search without reducing it.

    Solution: Give only the benchmark proof a two-second timeout

    Keep level 1 and every other proof invocation unchanged while extending the already-isolated baseline math proof budget. Record the focused budget and its rationale in the benchmark proof status.

19. 7406db05
    Problem: Benchmark proof still exceeds its focused budget

    Ubuntu GNATprove 16.1.0 can still exhaust the isolated two-second timeout on the Ratio lower-bound postcondition after the structural proof split. This leaves otherwise valid stack heads intermittently red.

    Solution: Widen only the benchmark proof timeout

    Increase the Baseline_Math timeout to five seconds while retaining level 1 and every other proof budget. Update the proof-status record to match the executable invocation.

20. 739287caAdd benchmark parameter sweeps and scaling analysis
21. ce31f2e2Fix sweep availability and scaling metadata
22. 449eff4bFix sweep availability and display reporting
23. dbf06156Fix sweep failure and scaling states
24. 03d277e6Fix exact sweep boundaries and reporting
25. ac1a8781Test final sweep budget stop semantics
26. cee1d4abAdd explicit flyology_bench suite runner
27. 5334042aFix benchmark suite reporting and execution
28. e1433649
    Problem: Suite context changes reporter profiles

    Adding a defaulted context formal lets ordinary calls compile but breaks source uses that depend on the exact legacy reporter profile, including access attributes, renamings, and generic actuals. Ada also forbids overloading generic units.

    Solution: Preserve legacy profiles beside contextual reporters

    Restore exact pre-suite reporter signatures as forwarding entry points, expose contextual overloads for ordinary procedures and distinctly named contextual multi-way generics, update suite bindings, and compile-check access and renaming compatibility.

29. b5f078d4
    Problem: Suite rejection status has no baseline gate

    The suite aggregate reserves a regression-rejected outcome but registered measurements cannot evaluate a saved baseline. Users must duplicate execution and reporting logic outside the runner, and the suite cannot propagate a gate failure to its final status.

    Solution: Add explicit read-only gated registrations

    Let ordinary cases opt into a saved-baseline policy, evaluate it with the suite's effective confidence, resample, and seed settings after collection, report the gate in every output style, and give rejection precedence in the aggregate without creating or updating artifacts.

30. a062b019
    Problem: Benchmark documentation filter is overbroad

    The GNATdoc workaround accepts any generic-formal warning from several benchmark units, so a newly undocumented public formal can pass documentation verification unnoticed.

    Solution: Match only known GNATdoc false positives

    Split the benchmark-unit filters and enumerate the exact root, reporter, sweep, and suite generic formal names that GNATdoc 26 misclassifies while continuing to reject every other warning.

31. 962e5a48
    Problem: Benchmark smoke failures omit their Ada call chain

    Hosted-runner memory faults currently end with only a runtime Storage_Error location. The local action log cannot identify which benchmark or reporter frame raised it, so platform-only failures are not actionable from CI evidence.

    Solution: Capture symbolic test exception tracebacks

    Build test mains with debug information and GNAT symbolic exception traceback support. On smoke failure, emit the complete exception occurrence to standard error before preserving the original unhandled failure.

32. a637cc13
    Problem: Suite smoke closes an active runner output view

    The reporting-failure scenario closes the caller's Ada.Text_IO file from inside a benchmark callback while Execute still holds and uses that file. GNAT platforms may retain a dangling internal file view, so the subsequent CSV header write can raise erroneous-memory-access instead of the Status_Error the test expects.

    Solution: Keep runner streams valid for the execution lifetime

    Remove the invalid cross-callback close scenario and document that Output and Progress must remain open and must not be reset or closed until Execute returns. Existing callback-failure tests continue to cover runner failure accounting without invoking dangling Text_IO behavior.

33. 6f2cf34cAdd isolated benchmark worker processes
34. 8a195f6dHarden isolated benchmark worker containment
35. 2fb07b32Harden benchmark worker ownership validation
36. c537aff4Harden benchmark worker result validation
37. afb23533Protect benchmark worker environment metadata
38. a29271b3Harden benchmark worker metadata validation
39. 3d0ce30a
    Problem: Worker mode duplicates suite case dispatch

    Fresh-process executables must currently reconstruct case selection beside the suite registry, so the parent identity and worker callback can drift. Readiness and result return are also repeated in each worker main.

    Solution: Execute worker requests through the suite registry

    Validate the requested identity and result kind against an exact registration, rebuild worker-local configuration, announce readiness, invoke Execute_One, and return the matching protocol result. Update the maintained example to use this shared dispatch path.

40. c9c465f1
    Merge pull request #67 from flyology-ada/codex/bench-06-process-workers

    Add fresh-process benchmark workers

41. 6b7273a1
    Problem: Ada formatting policy is inconsistent across the repository

    Flyology and its standalone subcrates lack one enforced line-length and encoding policy. GNAT-preprocessed units also require a documented path that preserves every conditional branch.

    Solution: Standardize Ada formatting at 110 columns

    Configure each owning project for 110-column UTF-8 GNATformat output and matching compiler checks, align runtime compilation, document the preprocessing workflow, and reformat all tracked handwritten Ada sources.

42. ccf08b27
    Problem: Ada preprocessing blocks uniform formatting of test seams

    GNATformat skips Ada units containing preprocessing directives, while the former test-hook switches made production code generation depend on a preprocessing pass. The repository also lacked an isolated regression proving that every hook selection is correct and that disabled calls disappear at all supported optimization levels.

    Solution: Select hook packages through GPR source directories

    Replace Ada directives with documented enabled and disabled private package variants, guard hook references with literal constants, and expose imported sentinels for missed guards. Add a dedicated cross-platform CI job that checks all 256 selections, optimization modes, and production archives without adding the exhaustive pass to the ordinary test suite.

43. edf9d8c0
    Problem: Formatted sources fail Linux and Pages validation

    GNAT's runtime style checker rejects a formatter-shifted comment in the Linux file engine, preventing runtime assembly. GNATformat also separates three leading GNATdoc @exclude tags from their declarations, causing the Pages build to report those internal adapter instances as undocumented public API.

    Solution: Restore validation-sensitive comment placement

    Place the runtime comment in the GNAT style column, keep each @exclude tag adjacent to its declaration, and document the GNATformat exception in the agent guide.

44. 2987d103
    Problem: multiplexed protocol operations cannot compose outbound wakeups

    An owner-stack connection protocol can arm hidden transport and lifecycle readiness through a Capability, but it cannot include the opaque Outbound_Wakeup used by concurrent stream publishers. Multiplexed clients therefore lack one bounded wait set and would need a helper pump or exposed descriptor.

    Solution: compose outbound publication with transport arming

    Add the narrow Arm_Transport overload that arms the required hidden transport direction, outbound wake source, and lifecycle sources on one outer operation. Consume already-pending notifications before rescheduling to prevent stale-signal spin, preserve independent deadlines, and cover pending, later-signal, reuse, TLS, deadline, native, and lightweight paths.

45. 3815cc9d
    Problem: scoped socket children cannot compose lifecycle wake sources

    Established stream and datagram operations can block on transport readiness, but most scoped stream calls and Receive_Datagram cannot include caller-owned cancellation or protocol-output descriptors. DNS, HTTP/2, and HTTP/3 parents therefore cannot wake hidden socket work without a helper.

    Solution: add bounded interrupt sets to scoped socket operations

    Add source-compatible Interrupts parameters to scoped stream array operations and datagram receive roots, copy the bounded descriptor set into caller-owned operation storage, and arm it with transport readiness. Retain typed interruption and device failures and cover already-pending and later-signalled datagram interrupts in native and lightweight lanes.

46. ebf80d6b
    Problem: DNS resolution cannot compose with scoped client operations

    Flyology.IO.DNS exposes only synchronous Resolve calls, so an HTTP parent cannot preserve one owner-stack deadline and cancellation scope while resolving an origin. Wrapping the synchronous resolver would block a lightweight event-loop pthread and cannot participate in Continue_After or completion gates.

    Solution: implement a bounded scoped DNS resolver state machine

    Add reusable resolver configuration snapshots, limited Resolve operations with root and established starts, and typed Finish parity. Drive numeric, localhost, cache, search, family, retry, UDP, TCP fallback, token, deadline, and cancellation paths through hidden scoped socket children, with transactional capacity rollback and complete drain-before-publication tests in both lanes.

47. c6b1bffc
    Merge pull request #75 from flyology-ada/codex/scoped-dns-resolver

    Add composable scoped DNS resolution