[trissim]

Public notification reads used native-only joins, while native preparation could leave its required tables absent. Notification context now follows the checked RegistryPrivacy type: public roots read base delivery evidence; private roots require native evidence. NativeRuntimeInput owns its context query, and the bounded assignment/publication joins remain shared.

Native preparation now completes the mandatory private coordinator schema outside the registry lock. PrivateCoordinatorTable owns the three same-file capability families. PromptBinding keeps its lazy separate file; optional awareness keeps its independent savepoint. The facade loop and separate leaf installers are deleted, with all callers migrated.

Planned and actual carry both ask CoordinationStore.schema_at for the checked privacy type's complete target before taking the file lock. Public roots retain core tables; private roots reconcile core plus mandatory private tables. The existing BusSchema composition algorithm is shared through ComposedSchemas. CLI reconciliation opens declared files directly before runtime consumers. All 24 mandatory row DDL definitions remain byte-identical.

Coordinator discovery uses existing metaclass-registry package discovery. FreshInstall already executes target source and uses native preparation; no new root probe is added. A refused rehearsal no longer writes a failure report into its source bus; live failures retain reports.

Source evidence: NRA ModuleSyntaxIndex and CompactClassFamilyIndex cover 451 production modules (4,753 classes) and 477 test modules (379 classes), with zero parse omissions and no old installer-name references. Earlier production/dependency census is retained in /home/ts/.cache/agent-scratch/mi-owner-withdrawal-trace.json. Private declaration loading still has its existing bounded four-module bootstrap; the stale historical plan candidate naming coordinated_runtime_schema.py is not a closure certificate.

Follow-up fixes:

• Optional awareness omits sealed pre-rename names at the deliberately preserved generation. Different lookup/future generation still refuse; exact assignment/receipt and native ownership checks remain strict (5544890).
• Standalone digest corroboration uses NativeEvidenceRead. Its API has no committed position, so opening the offset-required reader was an invalid call. Supplied acquired readers remain unchanged, including bounded reads; context-proof readers retain exact placement requirements (504c7d5).

Validation:

• Carry/install CLI: 15 passed. Missing private table restoration retains participant rows; planning writes nothing; public roots retain core-only schemas; maintenance/refused-rehearsal paths are exercised. Log: /home/ts/.cache/agent-scratch/mi-privacy-carry-tests.txt.
• Wider consumers: 104 passed, 2 skipped, 2 stale fixture consumers. The fixtures were migrated to typed owner identity and native preparation; their follow-up plus ingress/cohort batch passed 25. Logs: mi-private-consumer-tests.txt and mi-private-consumer-repairs.txt in the same directory.
• Optional awareness/cohort: 29 passed, including actual rename, generation replacement, damaged proof and different-lookup/future-capture controls. Log: mi-historical-inclusion-tests.txt.
• Native/recovery: 11 passed in 47.54s. Three cases run the actual prepared Pi SDK against a local provider: coding, selected write, and triage followed by coding. They check real tool/file effects, exact declared tools, no-tools JSON triage, actual publication, settlement, cursor/input proof, and one-use execution. Eight cases check released-owner/damaged-evidence refusal. Log: mi-native-final-qualification.txt.
• The provider fixture waits for a delegated real phase write and a fresh canonical turn_record read before releasing its response. Production phase synchronization is unchanged. Handler failures retain their original traceback. Crash fixtures now contain valid external records so the refusal cases exercise their intended damage.
• All 24 row DDL definitions remain byte-identical; actual cold MRO imports pass. NRA postinventory covers 451 production modules with zero omissions and records the digest reader's 25 related declaration/import/call sites in the existing receipt.

These are source-backed real SDK runs on copied roots. This draft is ready for combined source review and paired installation/UI qualification; no real installation has been performed here.

[trissim]

Reviewed both privacy/bootstrap and carry commits through this exact head. RegistryPrivacy owns public versus native notification evidence and the complete reconciliation target. PrivateCoordinatorTable owns mandatory same-file setup; PromptBinding retains its separate lazy file and optional awareness retains its savepoint. The shared ComposedSchemas implementation now serves both bus and private coordinator schema composition. Planned and actual reconciliation both select schema_at before acquiring the file lock, and both CLI paths avoid opening runtime consumers before reading their declared stores. The obsolete leaf installers and their consumers are removed.

Read retained results: 15 carry/install CLI checks passed, including missing native-table restoration with retained participant, unchanged planning, public core-only behavior and a refused rehearsal leaving source bus/registry unchanged. The repaired consumer follow-up passed 25 checks. Earlier 72/22 overlapping batches were reported from terminal output, not retained logs; this review does not turn them into independent evidence.

Source accepted for combination and full-state rehearsal. The existing same-generation optional-awareness rename defect and the base PR's native/recovery fixture failures remain with the MI owner. Actual predecessor migration, final staged build and paired installed qualification remain open.

[trissim]

Closing per Tristan’s explicit branch-hygiene instruction relaying Claude, 2026-10-23. The checked privacy/bootstrap work was integrated through the completed Core batch (#2620); this old draft is not an installation dependency. Published source branch and evidence remain preserved.