Scoped record correspondence candidate (VUH-1515)

2026-10-14 (D14, VUH-2251): Creeper 317 and Fiery Globe 76 are on the one-brain denylist, so the opt-ins below drive neither of them until they come off it. Remove them from kDenied in EnemyMirrorPose.hpp to resume.

The binding-only baseline passed ri-01 (20261008-024015). Lead approved the default-off scoped authority code after ra-06e2 (20261008-211146_vuh1515_scoped_record_authority_ra06_1). Both original populations passed engagement, coverage, motion, colocated position, brain/hit, paired HP/death authority and terminal lifecycle gates; safety passed.

The later ra-06j run (20261009-000418_vuh1515_scoped_record_authority_ra06j_1) passed the scoped record, authority/lifecycle, position, negative, brain, hit, stale/release-retake and group81 exclusion judges; canonical execution, clips and safety passed. FG76's post-retake native hit is observed on the friend at frame8960, netId3, damage18/stat0. This is a native hit receipt, not proof of the adjusted HP delta or exactly-once damage application.

Full qualification is parked at placement: the final approach blocked the background distance sampler and drove the players apart. Its own samples show median separation619u against the150u colocation limit, so restoring the missing receipt alone would not qualify it. Placement remains UNQUALIFIED; ra-06j's final verdict is INCONCLUSIVE. No ra-06k retry is proposed. The feature remains default-off, with the scoped passing evidence retained as partial qualification. Evidence: build/rig/vuh1515-record-authority-20261008-01/live-fixture-ra-06j/ (verdict.json, closure.json) and analysis-ra06j-20261009-000418/findings.md in the same lane.

All flags default off. KH2COOP_ENEMY_RECORD_BINDING=1 on both peers grants correspondence only. Adding KH2COOP_ENEMY_RECORD_AUTHORITY=1 and KH2COOP_ENEMY_MIRROR=1 permits pose/brain/claim/HP/death authority only with a complete current-frame first-population proof. Listing 317/76 as stream families does not grant ordinary point binding or unrestricted authority. Protocol15 publishes the six exact Agrabah group81 negative keys only after fresh native membership/catalog proof; they acquire no binding or damage rights. Unknown peer keys, ambiguous extras, root/key reuse or missing originals withdraw and poison the whole population. Other families retain the ordinary point binder.

The reviewed retained run 20261008-011600 found native spawn-placement divergence outside the ordinary binder's 8-unit tolerance. Record correspondence was unique in these captured populations, not globally or across incarnations:

Protocol v15 extends EnemyManifest entries with an optional schema-1 record key. The key contains all six location/program fields, controller namespace, group, ordinal/native ID, the complete definition comparison digest, exact header projection digest and exact 64-byte record digest. Only the eight reviewed keys are admitted. Raw game data remains outside git. v14 peers fail the existing protocol handshake; flag mismatch is explicitly refused without point fallback.

On every observation, the adapter uses a complete native census and the existing double-sampled ordinary record catalog/membership reader. It validates all content, unique controller/table association, actor/objentry/status/controller/record roots and a second complete catalog. No historical actor pointer is dereferenced. The full population must contain exactly three or five living unique records, with matching host keys and unique host netIds. Pointers, local load serials and frame counters are local guards, never cross-machine identity.

The lease consumes this first population for the local load and shared host epoch. Repeated observations require continuous frames, identical local roots/tracked rows and unchanged host record/netId assignments. Duplicate records, incomplete content or census, dead/missing bodies, controller/root replacement, conflicting claims, host respawn with an old friend body, and same-record reuse hold the whole population. A held lease cannot recover by selecting a nearest/newest body or replaying an old manifest. Reset requires forward local load and transition serials plus a forward shared epoch, or a new generation and host connection. Leaving the reviewed scope cannot erase the consumed-record fence.

There is no same-record incarnation recovery algorithm. Even continuous checked roots cannot exclude invisible same-address reuse between samples. Consequently binding-only mode grants correspondence only; the separately reviewed authority mode has the partial live qualification documented above. It adds no spawn/activation call, memory hook, native HP writer, widened point radius or family-wide eligibility.

The sealed lane build/rig/vuh1515-record-binder-20261008-01 contains the code, products, native controls and a canonical-runner fixture: Creeper, Fiery Globe, then a fresh Creeper load. It requires both-side living spawn confirmations, complete record/netId correspondence throughout measured native-frame windows, six clips/screenshots, default-off control, guard acknowledgement before resume, unchanged saves/sandbox and owned-process closure. That original binding-only packet is historical; binding PASS alone does not imply enemy-authority PASS.

The ra-06 combination fix keeps KH2COOP_ENEMY_POPULATION=1 native cull callbacks for positively excluded group81 bodies separate from admitted rights. The handler hook is shared by a class, so an un-driven excluded body can reach it. Its callback rebuilds complete census/catalog membership and checks every original body's current authority before returning the native predicate result. A cached negative publication key alone is insufficient. Excluded actors acquire no driver, HP, death or claim rights. Missing, changed, aliased or stale evidence still withdraws the original population and denies queued work. The packet's real-guard/real-CullBody regression exercises both native predicate results, positive exclusion, twelve uncertainty mutations and admitted proof loss; this combination control remains offline evidence because ra-06e2 omitted population opt-in. The standard authority/lifecycle path has the partial live evidence above.