Hemera source pin execution

Serves: Kadek foundation row 4 · Radio/soft3 · dependency delivery prerequisite. Parent Radio a11d342594949d4ea542b26366f71d56ef21662d; Hemera d5f0a09539360934fb32db9b2e15a91995607db6. Original Grok PLAN approved at 2026-10-11T20:36:14Z; the separately reviewed source-policy amendment approved at 21:02:59Z. Raw verdicts and invocation/completion records remain in their immutable PLAN packs. Root owns final CODE disposition, commit and merge. Reducer/no_std work remains a separate dependent task.

The final delta is eleven production files: root Cargo.toml/Cargo.lock, eight inheriting manifests and one Hemera allow-git line in deny.toml. No Rust or canonical specification changed. final/source-freeze.json binds the full candidate/parent files, exact patch and all 511 unchanged tracked Rust files; freeze-final.rb checks those bytes against Git. Two incidental removed EOF blank lines were restored before this freeze. final-bridge/ retains both manifest versions, Nu TOML equality and three complete locked metadata equality checks; historical gate snapshots retain their original bytes.

Evidence staging: /tmp/radio-hemera-pin-execution/. Every gate has an exact argv/cwd/environment/time/exit record plus unedited stdout/stderr in logs/. verify-execution.rb replays 96 records and 192 streams, including the explicit corrected-tag reruns, validates source epochs, parent Git inputs and the exact final diff. That replay result is an integrity check, not a green repository/product verdict. Run 01 predates the runner-hash field; its original runner is preserved, without a contemporaneous hash-binding claim. Later records bind the preserved runner. Each Cargo command uses two jobs and disables incremental compilation; independent target groups overlapped.

Run 01 is the single owning unlocked online resolve, seeded by committed lock. Its sole lock change is Hemera's exact Git source. Runs 02–04 and final runs 44 are locked/offline. compare-metadata.rb checks complete package/node graphs, all eight direct std/serde declarations and the sole removed default marker. The earlier research parent-lock serde probe omitted the job/incremental controls and proves dependency resolution only. Run 07 resolves a separate Radio export without an adjacent Hemera directory. External legacy-Hash probes have their own workspace/lock: parent run 9 compiles, candidate run 11 gets E0308. This is the intentional major source-identity floor; rustdoc comparisons cannot waive it.

Measured gate results, all against the named parent plus the recorded candidate file hashes, are derived from gate-summary.json and its named raw records:

• BAO debug/release runs 05/06 each pass 88 existing cases. Blobs root_policy, export_pairs, parent_pairs and empty_root filters pass; these filters overlap.
• Native nextest runs 21/24 each pass 547 cases and skip nine, under the committed CI timeout profile. Their counts are separate feature variants, not unique totals. All-feature compile run 16 and its exact parent both fail E0599: no method named 'add' found for enum 'Result<T, E>' in the current scope (raw Rust output preserves backticks). Dependent all-feature runtime is blocked.
• Rust 1.89 workspace/all-targets check 31 passes. All-feature doctest run 35 passes 51 cases. Actual particle, radio-cli, iroh-docs and integration package checks 37 pass. Literal CI loops 36 retain stale iroh/iroh-relay selectors; their default check can address registry dependencies, and feature/doctest selectors fail on candidate and parent. They do not substitute for owner gates.
• Strict scoped/workspace Clippy and format checks 25–30 are red on both sources; first owning diagnostics include clone_on_copy and unnecessary_sort_by. Strict private docs 32 reproduces the broken Self::persist link on both.
• Shared stable/nightly doc targets in 33/39 produce column-cache errors and remain inconclusive/harness-sensitive. Fresh isolated nightly workflow run 43 exits zero using iroh_docsrs, with output-filename-collision/rustdoc warnings. No zero-warning documentation claim is made.
• Current-parent runs 40 and corrected last-tag runs 45 (default/none) exit 101 at the generated iroh-car helper's yanked core2 resolution. Completed package results are scoped only. Helpers used fresh separate targets; full helper manifests/ locks and observed rustdoc hash inventories are retained. Those final artifacts alone do not prove both intermediate inputs consumed by the tool. Last-tag Radio f2b1298d uses the explicitly declared current Hemera dependency closure, not a reconstructed historical release. An additional export audit found two license symlink targets had been overwritten by the preparation harness. Original last-tag runs are input-deviant/inconclusive; tag-correction.json binds actual differences and the corrected exact export. Only gradlew.bat required line-ending restoration. New runs 45 repeat the two affected diagnostics with fresh targets; all historical inputs/errors remain.

The newly introduced cargo-deny Hemera source failure in run 34 was fixed within this unit through the approved one-line policy amendment. Full repeat 41 exits 13; sources-only repeat 42 exits 8. The Hemera source denial disappears (five source denials become four); every other diagnostic-heading count and remaining source block is unchanged. Only Quinn remains unmatched, shifted to policy line 31. Existing Willow, license and advisory failures remain red. The advisory DB HEAD is clean and equal immediately before/after these repeats. The pre-amendment pair has only a later-observed DB snapshot and is labelled accordingly. Matcher scope is normalized host/path, including its userinfo/scheme/port/revision limits; Cargo rev and lock enforce the immutable revision.

Fresh soft3 prerequisite 38, at soft3 44824e6c with explicitly named committed sibling exports, fails because cybergraph 42fc2512 lacks the requested local-storage feature. No dirty input or dependency bypass was used. The current product has no direct Radio Cargo edge; this diagnostic does not validate the candidate Radio integration. Product build/runtime/conformance, specification, Kelvin, wider platform/netsim/minimal-versions and ring 2 remain unverified. Existing release pins, FFI and registry Hemera boundaries remain unchanged. The major floor and red gates require root's decision/wip disposition; no version, tag, release or publication is claimed.

Completed target caches are removed only after their command outputs and needed helper artifacts are retained; cleanup receipts name exact owned paths. Original shared worktrees remain untouched. The final CODE pack and portable audit will retain both complete PLAN packs/verdicts, full raw gate records and explicit artifact omissions. This task awaits fresh CODE review and root disposition.