Ordinary BC membership lifecycle practice candidate

This descendant of 3670aa39 handles living Shadow removal separately from native death in BC courtyard [5,6,0,1,1,0]. Native compilation, transport ordering and live qualification remain pending. Original practice failures stay FAIL. This is not landing or acceptance evidence.

Retained evidence

Ca007 B host frame3352 had a complete stable census without netId4, whose original status still held HP20/20; the next frame appended6. Friend line796 relabeled the old live body4 to6 by newest point. HPseq24 included6, which had no admitted ledger: serial198 lost its raw payload through a missing-target short circuit, followed by UnknownDelta199. Exact excerpts/full-log hashes are in tests/fixtures/ordinary_lifecycle_ca007.json. No complete native source certificate was retained. Positive certificates in controls are constructed; they do not retroactively qualify the old run.

Static investigation identifies native leave/fade/disposal and scheduled refill paths. The actual initiating branch and a vanilla single-player comparison remain unqualified. This change authenticates membership, not the script/cull trigger. The separate read-only probe commit43bbda1 is not included.

Product behavior

PopulationCut schema2 is membership-only, scoped to BC and object302. Its removed terminal is distinct from schema1 native death. Protocol17 requires a coherent DLL/runtime/relay build; never mix these products with protocol16.

Host proof requires original native generation/load/transition, immediately preceding living five-root identity, repeated complete census, unchanged positive original HP, and bracketed unique record-content/ordinal association. Old-retire is published before replacement manifest and new-birth. History validation rejects missing proof, duplicate, reorder, changed original content/scope and reuse. Retirement never sends EnemyDeath, marks deathSent, writes native HP, invokes native removal or grants kill credit. An unproved same-point refill outside BC is held instead of silently marking deathSent; unrelated existing grace-death handling is not extended. Concurrent population-repair mode refuses.

Native-01 exposed an exception needed for the existing non-BC metadata contract: the same still-listed actor can acquire changed sampled roots and become a fresh spawn row. Outside BC and population-repair mode only, a newer announced row at that same actor, object and point with changed roots and a fresh census match locally supersedes the old identity. Publication proceeds for the new row; neither deathSent nor EnemyDeath/kill credit is manufactured. Actual living removal and different-actor refill still require lifecycle proof. The unchanged native callback test must publish ID2 HP and StateHash and exclude ID1.

Relay validation binds complete manifest coverage and ordered history to the existing authenticated source envelope, removes retired cached HP and sends the certificate before bootstrap HP. Client qualification retains original host/session/connection/delivery and native scope plus fresh local content bookends. Old write/claim authority retires before a new ID can bind. A listed retired body is quarantined, never relabeled; its roots/HP must remain unchanged. A fresh replacement independently qualifies by content/ordinal without historical actor-address reuse. Local disappearance before authenticated host retirement still hard-refuses: no grace, no rebaseline.

The narrower HP choice is explicit rejection. Any unknown, retired or not yet admitted entry rejects the whole packet before its sequence floor or rows mutate. Reason21 retains the exact raw packet and offending ID. Later normal periodic HP can qualify after birth admission; no stale replay or fabricated damage source. HP cache admission uses product-owned source history, never diagnostic engine membership. A source-admitted birth may cache HP before its local body binds; native writes and claim release still require current native association. Observer loss or unqualified receipts retain their diagnostic refusal but cannot veto authenticated product retirement/birth or change HP cache decisions. Receiver product bookends use the existing full client claim scope, roster, peer deliveries, spawn salt and fresh catalog/census. They remain available when the optional observer is OFF; the diagnostic-only CausalScope cannot be used as product permission. Source session/delivery, arrival ACK and all native scope checks remain mandatory.

Ledger and scope limits

MembershipRetire14/MembershipBirth15 retain raw certificates, original scope and roots, ordered events and unchanged HP. Engine and standalone auditor replay the bounded history independently. Consumed historical slots prevent old claims from acquiring new authority. New occurrence damage still needs the unchanged player/companion and normal HP proofs. UnknownDelta stays unchanged. The3670 living-to-dead-to-dead predicate is byte-identical and owns actual native death; membership removal cannot substitute for it.

Frozen source05 scenario Admission still requires the original five targets and has not been changed. Practice may retain a scenario refusal after a valid product lifecycle change. Ledger/auditor support does not claim full fixture or AC3 qualification. Safety, HP, STOP and survival action-order orchestration remain kh2-steam's separate responsibility. No live run was performed by story.

Checks and handoff

Python checks: tests/test_combat_causal_audit.py, tests/test_ordinary_lifecycle_audit.py, and tests/ordinary_lifecycle_source_controls.py (each with python -B). Source controls preserve all four witness predicates, UnknownDelta, NativeHitTrace, CMake registration and terminal continuity. The serializer now emits current owner-frame summary fields so saved-log tests use the current format.

Production C++ controls extend existing PopulationCut, EnemyRecordBinding and CombatCausalTrace targets: ordered retirement/birth, missing/foreign proof, duplicate/reorder/reuse, raw unknown-ID HP, old claims and kill-credit refusal. They are not compiled or executed by story. kh2-steam owns the native slot and coherent build, reporting unrelated failures separately. A build pass alone does not authorize live use or landing.

The native-01 suite on 7406803c was 185/188, including thirteen nativehit assertion failures; no practice ran. Two failures exposed the non-BC metadata publication regression. Ten positive assertions lacked the new BC source cut, and one still expected unknown-target reason17 rather than lifecycle reason21. The successor preserves those positive claim/payload/HP/overflow assertions, constructs five real owned-memory actors and records, admits a catalog-derived cut through the actual consumer, and resets fixture lifecycle history. New native controls require missing-proof refusal and identical product decisions for OFF/ON/retired/overflow observers across a source retirement/new birth before local replacement binding. These native controls await the operator build; Python source checks are not a substitute for their execution.