[igorls]

A durable action handoff or disposition and a quiescent worker end previously had no proof that they came from the same original delivery. Add a bounded private association between a freshly acknowledged result and its exact supervised physical attempt, checking original source/payload membership, typed outcome, producer configuration and Elasticsearch target. Copied ends, stored JSON and readback cannot recreate the original acknowledgment or physical ownership. Stored broker settlement remains unknown; associations grant no reader count or byte credit.

Configuration and target are checked before canonical validation, immediately before persistence and before success. The master privately retains and revalidates the original physical reader/source/coordinator scope across later awaits. Irreversible authority requires an authenticated current SHiP LIB anchor matching RPC. Reversible selected-source authority also requires the exact recent admission and an ordered current-reader probe. Retired/disconnected readers, revoked generations, shutdown and inconsistent LIB observations fail closed; ordinary coordinator/LIB advancement remains valid.

Native callback controls cover held/failed writes and required reads, publisher confirmation/drain, thrown ACKs, held/failed ends, uncertain association writes, parent recreation and late configuration/target/source changes. Physically pending operations stay attached to their original attempt through cancellation until settlement or exact exit. Original views reject post-fence use, dispatch observations detect new work, and unrelated physical workers continue. Unknown visible records remain inspection-only. Initialization recovery remains opted into and capped at four fresh accepted attempts after physical drain/current-parent end; terminal, uncertain, storage and configuration failures remain fatal.

Current integrated head: 72e179232c8fb10e316538f361a8aa2bb5faadd4, tree da8db8428041c4d66f1e82b51ce7345a0ce4230d, identical to reviewed/tested leaf 08651531. Merged #320 covers the owned-broker handoff boundary. #322/#323/#326/#328 complete #321's scoped Antelope/Wire component matrix. Merged #330 (including #340 and #342) adds the replica-restart qualifier, bounded worker diagnostics and held-return ownership/terminal-event guards. It preserves original callbacks, comparison order, write/ACK/end authority and failure outcomes.

All nine prior-parent CI jobs pass, including MongoDB and native sequence/journal checks on Node 24/26. Both Linux build legs report 1,586 passed / 1 optional skip / 0 failures / 10,609 assertions across 1,587 tests and 143 files. Complete application/qualification checking, native emission and focused controls pass. Independent Spec/Standards reviews of the complete #330 contribution covered 57 files and 22 commits against 3d53712e, with no remaining findings; the review record preserves exact source, controls and limits. This is a component review, not a complete review of this PR against release/4.5.

Keep this PR draft. The four actual Linux service runs on frozen source 29057aaa remain failed and independently audited. Both combined runs verify the scoped storage-33/broker-34 recovery joins; stored broker settlement remains unknown. Node 24 combined sent 789 frames and ACKed 781 before failing progress toward target 813. Node 26 combined failed the native block-397 row assertion with zero hits and four successful shards. Its source-637 bulk response followed refresh completion by 116.841709 ms and preceded the failed search by 62.628203 ms; that is measured ordering, not established cause or native acceptance. The historical sources, failed searches, software-shutdown failures, physical cleanup records and unknowns remain preserved in #329 and #334.

Merged #343 completes #341's scoped coherent MongoDB sampling inside the original inherited deadline. All 51 controls pass on each native Node 24/26, application/qualification checks and emission pass, both independent axes pass, and all nine exact-head CI jobs pass. Fresh focused actual MongoDB 8.0.34 controls pass with persisted exit 0 and verified cleanup on both runtimes; the outcome record preserves the independently verified archive, rejected samples, earlier wrapper failure and qualification limits. All nine separate Mongo-parent CI jobs pass.

Merged #344 completes the scoped native write-completion witness and inherited-deadline correction on top of #343. Its merged tree exactly equals reviewed 08651531. All nine exact-code CI jobs pass; each Node major reports 1,589 passed, one optional skip, zero failures and 10,630 assertions across 1,590 tests/143 files. Fresh locked installs, complete application/qualification checking and emission, 20 focused tests/289 assertions and 51 Mongo controls per major pass. Final complete-delta reviews cover all ten files/four commits and actual shared driver/docs composition: Spec has zero findings; Standards has zero breaches and one nonblocking heuristic judgement. All nine separate current-parent CI jobs pass.

Next qualification work is the fresh unchanged Node 24/26 baseline/combined owned-service replay on this merged source. #334 remains open for the original-scenario rerun; the controlled mechanism does not establish the historical service cause or successful real proof tails. #332 retains fresh failing end-association operands. #288 owns remaining storage/live-fork recovery; #277 owns prospective count-and-byte coordination, followed by the complete unchanged 1..1480 Linux Node 24/26 replay. #321 and #327 are complete only for their scoped component outcomes.

Passing controls and CI establish no complete Wire support, production capacity, Bun runtime acceptance or release readiness. Preserve Node 24 minimum and CI 24/26, Bun 1.4.4, TypeScript 7.0.2, npm locks, historical Node 22 evidence, original inputs/oracles, 256-block ancestry, durability, resource budgets and deadlines. No public/default, cluster, runtime or hosting activation.

Refs #288, #277, #191 and eosrio/hyperion-tools#24.