#1053 private-writer mutation diagnostic correction — cloud only
OBSERVED_AT=2026-10-12 09:53+08

Original cloud observation
- Exact34229879a071054c02e544c8376baad2189e0316, QA run38192680727,
  test635 job114629258691:205pass/0fail/464expectations in3files.
- Real non-root foreign-UID refusal succeeds; preread mutation is red.
- Script then exits1 before writer-bypass receipt. Its grep still expects2,
  while create-node-daemon-private-wiring.test.ts now pins3 atomic JSON
  writes, including the new private names-only secrets-source marker.
- No mutation log artifact was exported from that runner. The source/log
  evidence identifies the stale diagnostic; don't claim the full suite PASS
  until the corrected existing Docker suite succeeds in GitHub Actions.

Narrow change
- Only align the diagnostic's expected count2→3. Same mutated writer site,
  mandatory nonzero test exit, atomic-writer assertion, raw-write rejection,
  permission/owner checks and pre-read negative control remain unchanged.
- No product file, package/version, baseline, publication input or runtime
  semantics changed. No new test suite/matrix; existing QA runs the recipe.
- User requested Actions-only testing: no local tests or Docker run.

Recovery/cleanup
- No new service/launcher/ports/proxy/tunnel/environment/credential source.
  Existing deployment scripts and protected data backups remain authority.
- No production state, account, secret, global package or process changed.
- This correction does not rebuild or relabel the formal main source
  31b0dbdae3192f471c8812574c118795658120f0 package family.

09:57+08 increment — legacy network source gap (not an all-green claim)
- Source34229879 QA lifecycle job114629258120 remains failed: SDK children
  die before registration. Earlier inactive-parent fix alone was insufficient.
- Daemon NETWORK_ID is empty for that old hand-written config. The new source
  marker used this empty local value, while the child's config already used
  req.network_id from token-bound get_create_request. readScopedNodeEnv rejects
  the resulting scope mismatch before child startup. This is product wiring,
  not an environment failure; the runner has no child exception artifact.
- Narrow correction uses the same Hub-bound request network only when the
  local Daemon network is absent. Hub get_create_request checks exact token
  Daemon identity and matching request network before returning this field.
  Configured-store parent network/identity/owner checks remain unchanged.
- One case added to existing node-name-652 unit fixture proves actual marker
  persistence and empty-store reader acceptance. Real SDK lifecycle replay and
  existing secrets core remain GitHub Actions-only pending evidence.
- npm publish for runtime135 was already accepted before this later failure
  was observed. Do not re-publish immutable135, install it as repaired, or claim
  current publication equals delivery. Runtime136 is the narrow replacement
  candidate; Hub127/CLI169 product bytes are not changed by this fix.

2026-10-12 10:11+08 exact-pair correction — pending new cloud evidence
- Exactfcd7fd9f real-client run38193857400/job114632161003 failed at child
  startup. Retrieved artifact11723175645 (ZIP digest is not a package SHA).
  positive/bridge.log explicitly rejects runtime136 because CLI source still
  pins exact135, before launch/attach records. This is an omitted release-pair
  update, not an environment timeout and not a reason to extend the UI wait.
- Bump the paired CLI package/lock/resolver to170 and runtime resolver to136
  together; keep exact ownership/version checks. Update bilingual candidate
  version claims and exact per-package release notes. Runtime136 remains
  the same narrow legacy marker correction; public Hub127 remains unchanged.
- CLI169 main GitHub download38193906192 is SUCCESS and bytes match its
  original formal main artifact, but it is not the repaired runtime136 pair.
  Its npm verification38193199217 timed out after accepted publish; no reissue.
- App249 draft889 currently pins169/136 and must remain held until170's exact
  formal bytes replace that installer URL/hash. Its Mac fixture20/20 PASS
  proves installer flow with adapters, not real OpenCode/runtime compatibility.
- New core/pair/legacy checks only in GitHub Actions; no local testing.
