# CORE-C V2 native closure follow-up — experimental source-only kit

This is the new, separately budgeted
`SWAYFX_MOSAIC_STEP20C_COREC_V2_FULLSCREEN_OOM_GLES_NATIVE_CLOSURE_BATCH_V1`
ticket. Its parent is project commit
`d46f854b3026e911659528fe94792aa13837a1d6`. The
[parent kit](../step20c-corec-v2/README.md) and its closed runtime receipts
remain unchanged. This directory does not add a production dependency.

## Post-campaign portability repair — OFFLINE_ONLY

The closed campaign executed commit
`c55373eab3c53132bf1157acc9cfc9edd451156e`, source manifest v2 SHA256
`2e9fe75a48466fa1a9e3081137146d5cfffb35145c1749160e2c4f350bc6e5b7`.
Its historical GPU client SHA256 is
`4e791780ac62152245891459864283750681b136a246c3c39ccf36b4f33972b4`;
its G3 compositor SHA256 is
`9da90b178f20ea79bc9fb2a105c227f9d5d66a9de7eac77ff4ec3ea102908658`.
These identities and their original receipts remain authoritative for that
campaign. FS-P was NOT_EXERCISED at the client identity guard. A separate
post-campaign probe reproduced EACCES for a nondumpable child, while the
original FS-P errno remains NOT_OBSERVABLE. GPU-G3 was INCONCLUSIVE with zero
captures, epochs and arms: reference exited2 after configure/ACK and before SHM.
The old client required the retired LAB's absolute TMPDIR. DY-C, OM-ROOT and
OM-NESTED were PARTIALLY_FEASIBLE in the sampled scope (32 captures total).

The following source changes are **OFFLINE_ONLY**, made after that campaign,
and have never run in a compositor. The GPU SHM path helper requires SMX_LAB
to be a canonical owned0700 direct child of `/var/tmp` whose name begins
`swayfx-mosaic-step20c-native-closure-`, and TMPDIR to be its exact canonical
owned0700 `scratch` directory. It rejects missing values, old-ticket/outside
paths, symlinks, foreign ownership, wrong modes and truncation, with explicit
stderr diagnostics. mkstemp stays in that scratch directory. Existing core and
dumpability guards remain mandatory.

Fullscreen client identity still requires an observed matching PID/proc/exe
path and SHA. Inaccessible proc identity now saves NOT_OBSERVABLE plus the
operation and original OS error/errno before the same mandatory gate refuses.
This improves diagnostics and does not fix or exercise the native fullscreen
gate; a future observable identity proof remains to be designed. No self-report
substitute or weakened dumpability is admitted.

The new helper tests execute only extracted production C path-validation code,
and Python identity predicates. A corrected client may be compiled offline;
that is not a native qualification. The campaign budget is closed: these bytes
authorize no retry, new reservation, GPU-CTRL or other headless run. They require
a new parent-owned source freeze and independent review, without rewriting any
historical manifest, review, admission, ledger or runtime receipt.

The follow-up derives prospective fullscreen, migration/refocus and root/nested
OOM fixtures in `graphics/`, and a distinct intrusive GLES diagnostic in `gpu/`.
Each implementation has its own offline tests. Independent acceptance of the
final source bytes and verified publication to both project remotes are
required before a runtime reservation. A source test or a successful build is
not native runtime evidence. No campaign is admitted by this README.

The G2 Wayland client sets `RLIMIT_CORE` to zero, sets
`PR_SET_DUMPABLE=0`, and verifies `PR_GET_DUMPABLE=0` before any Wayland
operation. This protects the client itself; the compositor's `exec` does not
preserve a parent's `prctl` dumpable setting. The parent also applies
`RLIMIT_CORE=0` to owned children, while compositor dumpability after `exec`
remains an explicit limitation.

Generated sources, clients, binaries, builds, receipts, logs, raw readbacks and
captures belong in a new mode-0700 LAB below `/var/tmp`. Redirect `TMPDIR`,
`TMP`, `TEMP`, `XDG_CACHE_HOME`, `XDG_DATA_HOME`, `PYTHONPYCACHEPREFIX` and
`CCACHE_DIR` there for every build/test. Runtime sockets must be private,
short, checked for quota, and explicitly selected. Never use an inherited
desktop socket or display. Keep heavy artifacts outside HOME and Git.

The eight named reservations have fixed, nonfungible ceilings:

| Run | Output captures maximum | Dependency |
| --- | ---: | --- |
| FS-P | 12 | Reviewed comparable pristine fullscreen fixture |
| FS-C | 16 | Same reviewed client and actual FS-P comparison |
| DY-C | 16 | Reviewed native-source refocus oracle |
| OM-ROOT | 10 | Reviewed root-only closure and availability oracle |
| OM-NESTED | 10 | Safe root result, or explicit independent dependency review |
| GPU-G3 | 12 | Reviewed capability/readback source and distinct built ELF |
| OM-EXTRA | 12 | New distinct discriminant and additional review |
| GPU-CTRL | 12 | New attribution question and additional review |

Maximum eight runs, 150 seconds each, 18 captures per run, and 110 output
captures globally; the named ceilings sum to 100. A reservation is consumed
even on failure. No retry, reset, refund, historical token or scenario renaming
is permitted. Optional entries are not admitted by default. The previous
ticket's unused reservations are closed and cannot be transferred.

CORE and OOM production mechanisms remain unchanged. Runtime Row 0 borrows
Sway's real tiling list. Pending IPC geometry, applied scene/input evidence,
native commits, presentation and buffer lifetime remain distinct. Stable
screenshots cannot establish atomic generation, complete damage or GPU
completion. OOM production policy and offscreen-popup UX remain undecided.

STEP20A DONE; STEP20B EXPERIMENTAL; STEP20C NEXT; STEP20D–G PLANNED.
PRODUCTION_MULTI_OUTPUT=NOT_YET_SUPPORTED; PRODUCTION_AUTHORIZED=FALSE.
No installation, live session operation, production source/patch, public ABI,
package recipe or UX change is authorized by this kit.