Compatibility review for captured candidate ed02fdb594cfb1f9aa537c11f563b89812bd1136

The assigned ten-package declaration subset contains 361 files, with 73 changed hashes. Every normalized fresh text independently matches the retained API surface. Only registry/scorers have authenticated historical declaration text in this subset; source-history review covers the other eight packages without pretending to reconstruct old declarations.

Migration notes for release review:

- Custom ControlRuntime services need queryPlans. Custom GrantStore services need a conservative, real policy snapshot. Descriptor-relative filesystem executors need resolve and the extended batch variants. These are intentional structural migrations, not blanket source compatibility.
- Exhaustive switches need the new plans listing, usd guard source, approval_unavailable error, capabilities identity-conflict field and open network posture. New optional fields preserve old payloads; old clients may still reject new union variants.
- Custom authenticated control hosts default to their own launched runs. Configure operator visibility deliberately. Legacy unattributed runs remain operator-only; a principalId filter does not authorize access. Fork/verify are write:runs procedures.
- Core Flow.make retains its legacy adapter signature with deprecated JSDoc. New authoring uses the canonical @smthrs/flow Flow.make(tag, options); the adapter still lowers to that one executable model.
- Module locator display documents are optional. Real referenced payload schemas and refinements remain the admission authority. Retained sourceRoot maps a verified checkout while preserving approved locator/digest identity. Unsupported measured loads refuse.
- Typed Prompt.Component<Props> retains concrete missing/wrong/extra prop checks. Runtime JSX attributes are deliberately unknown-valued; JavaScript generated from MDX strings is not an automatic TypeScript prop-safety proof.
- New Scorers helpers preserve prior scorer declarations. A testsPass scorer needs an acquired session; launch/transport/timeout and malformed diffs stay inconclusive.
- Native process confinement is required at the kernel spawn boundary. kernel layerNoop and platform unavailable:unconfined are explicit opt-outs, not security evidence. Existing native evidence is macOS only; rendered Linux/Docker argv is not executed enforcement.
- Sandbox fork is optional and fanOut refuses unavailable providers. Credential stripping is a provider contract; a directory-backed session or arbitrary fork implementation does not establish isolation.

This is a review of retained ed02fdb declarations. The parent must review incremental final-candidate drift and retain fresh installed consumer results before updating the baseline. The review is not a whole-release or whole-package coverage verdict.
