Move the new WSL SRT install path to sandbox-runtime 0.0.79 - #876

### Scope

Two historical 24/24 runtime runs did not print their lock checksum in acceptance stdout. This change publishes the measured final f451/aa37 metadata, preserves those original runs as historical, and binds final-lock acceptance to one new native 24-case run whose own output prints f451 immediately before and after execution.

The future installer also uses uv0.12.17's default exact `--locked --group dev` sync. Approved older environments previously could retain removed DVC/dvc-data/diskcache packages under `--inexact` while receiving the final completion marker. The shared-vector hash and a matching-hash negative control now enforce the prospective exact contract. This read-only acceptance executes no migration or sync.

- Lane: `lane:trading`; original source basea6f3ee76, initial landing base8c1428d2; corrected landing baseb4182ccc0a7bee6352274408e03545cb5949142d follows merged Row70 defectA.
- Runtime source owners cleared bounded publication in acknowledgements47492/47495. CC172905Z authorized one final-lock acceptance after #876 ready and SUITE-GO; both occurred.
- Catalog reconciliation goes to the G5 sole assembler. This PR changes no catalog file.
- Landing path:5f. The custody hold lifts only on `873-LOCKS-RECONCILED` and `LANDING-READY` at the same corrected head with the run receipt and both actual lock hashes, after exact-head checks/reviews/current-main conditions.

### SOTA sources

- [astral-sh/uv0.12.17](https://github.com/astral-sh/uv/blob/0.12.17/docs/concepts/projects/sync.md#L92-L100): supported default exact sync removes packages absent from the lock. Installed help confirms --inexact retains extras; pinned document SHA2565c6a534a81111800ff37455f8c547bbb67f304b9d0cb02543c7185266dbef218.
- [containers/bubblewrap0.9.0](https://github.com/containers/bubblewrap/blob/v0.9.0/bubblewrap.c): retained native clear-environment/network isolation/read-only mount controls.
- Unchanged retained later `accept-trading-2604.sh`, SHA256 `4d7b784aa2b24ccfe05910fd652fb4d7ef99f0298b7200e3a864b7c186207ade`:24 offline integration cases. It invokes existing Python directly and runs no uv lock/sync. The public prospective source is a separate28-case recipe.
- Official PyPI versions: [EdgarTools5.61.1](https://pypi.org/pypi/edgartools/5.61.1/json), [skfolio1.7.0](https://pypi.org/pypi/skfolio/1.7.0/json), [LightGBM4.7.0](https://pypi.org/pypi/lightgbm/4.7.0/json), [pytest9.1.1](https://pypi.org/pypi/pytest/9.1.1/json).
- Existing native dev synchronization receipt95cb1cae and independent current-input readbackda1985f3 retain their original provenance. Neither is relabeled as fresh acceptance.

### Evidence-class table

| Claim | Evidence class | Exact scope |
| --- | --- | --- |
| Final source metadata matches measured runtime | independent observation/local_integration | Lock f451ef979cdb1ae3686a30df1c883c257402b32753478c1f9c686c057e9c3989; manifest aa370e42e29dc2419e586358254ff2e821df48a693aa9a3ee16b65d30036ee0b |
| New final-lock native acceptance | native CLI/local_integration |17:48:39–17:49:09Z,24 unique PASS/0, actual same-stream before/after f451 |
| Historical dev sync/dependency check | imported native observation | Unchanged95cb inexact operation and native-verification1128a569 |
| Prospective exact source guards | local_integration |13 source/argv cases; reintroduced --inexact fails despite refreshed hash |
| Both earlier24/24 runs | retained history | Receipt-reported1fb and writer-reported172; neither prints a lock in acceptance stdout |
| Legacy cleanup,28/dev acceptance, historical engineE2E | unexecuted boundary | No execution claim from the fresh24 offline scope |

### Fresh native acceptance and preserved history

The one fresh execution used the genuine WindowsWSL NativeStack2604/nonroot route under nice10/ionice, with the unchanged24-case script and existing interpreter. The receipt envelope printed script SHA and actual lock checksum immediately before and after. Both are `f451ef979cdb1ae3686a30df1c883c257402b32753478c1f9c686c057e9c3989`; rc0,24PASS, empty stderr. Raw stdout1361bytes/SHAe176e06192e9d027669f42b58b86b395c3df3dfe9dc02a4e439917d23b906313.

The original native receipt hash is `4a064e39026f205b8e2f273d396044b9145dbcb58a1510b8c9dbf45c56c5a2a5`. Its public projection and actual independent assessment are bound by `evidence/receipts/runtime-final-native-24-acceptance-20261008.json`. The retained critic recomputed original hashes/cases and checked source controls; it ran no acceptance.

The dated reconciliation names the two older runs separately. Run1 is06:20:48–06:21:25Z with receipt-reported1fb; run2 is13:45:33.120–13:45:58.886Z with writer-reported172. A separate13:46:01.921–13:46:02.069Z native172 readback is an after-run observation. All original receipts/output bytes are unchanged. The additive correction resolves wording and missing association without retro-binding either run to finalf451.

### Source validation and main-test declaration

The13 focused source cases, separate Bash syntax, offline lock consistency and registered validator pass. The actual independent fresh-run report and historical-source artifact retain exact provenance. Current-main merge/validation is completed in the corrective landing preparation.

For main's changed `tests/test_trading_2604_lock.py`, the declared failing set is exactly `tests.test_trading_2604_lock.Trading2604SyncVectorTests.test_installer_and_ci_source_have_byte_identical_argv`, whose historical expectation reads the retired exclude-newer cutoff. Every other main-version method must pass; the PR test is restored byte-identically after comparison.5f repeats its then-current landing condition.

### Host evidence and inverse

The new operation is a read-only24-case acceptance; owned synthetic output/logs were emitted. No uv lock/sync, runtime metadata/venv write, provider/model/GPU/SEC/broker/paper request or N2 resume occurred. Passing these cases does not establish dev probes, exact legacy migration, historical engineE2E or strategy performance.

Reverting publication restores only owned source/evidence bindings. Before any later exact host migration, the serialized writer retains prior inventory/metadata; restoring a selected prior pair and matching supported sync reinstalls removed dependencies while preserving later owners. No migration or host inverse was exercised.

### Checklist

- [x] One fresh final24 run, own before/after lock proof and actual retained independent assessment.
- [x] Both earlier runs and95cb observation preserved with honest scope.
- [x] Source exact-sync regression guard and published final metadata.
- [x] No protected rule/workflow/credential/client-config/paper/frozen-input/catalog edit.
- [x] Corrected current-main preparation tree9487cda4 matches the final rebased tree; native final validate0 at18:07:03Z (70components,10883files,4profiles,237receipts). Main-test comparison12/11PASS/exact declared cutoff error; PR test restored unchanged.
- [ ] Corrected-head hosted/review gates and CC-required proof/readiness pair before5f lands.

### Scope

Current sandbox records still described a Claude-only echo after the separate Codex observation was bound, left an event digest derivation unstated, lost spaces in current notes and duplicated an older README reference in the living profile. This records-only change fixes those four items and regenerates the matching handbook through its existing builder.

- Landing base: `a484989a43f70ff2575b6fb054cf00c9834e7679`; original recorded source base0d5672b0 retains its dated observations. Lane: `lane:foundation`.
- B: describe the two separately retained0.0.79 echo observations, cite the Codex receipt in use-stage evidence and narrow the next action to0.0.79 policy qualification.
- C: document unchanged event SHA256 as the complete41-byteUTF8 identifier without JSON quoting, normalization, newline or domain label; distinguish the existing domain-labelled producer identity.
- D: repair descriptive spaces.
- E: replace the duplicated0.0.78 README reference with one immutabled9aac209 README and regenerate current handbook bindings.
- The optional Claude session identity stays unknown because retained compact evidence supplies none.
- Landing path:5f after exact-head checks/reviews and fresh current-main merge/validate under the routine records cue. No test file is modified; native output/frozen earlier receipts and policy proof remain unchanged.

### SOTA sources

- [anthropics/sandbox-runtime](https://github.com/anthropics/sandbox-runtime/blob/d9aac2098351ca17f3743fbaf6ecbd0051b7e00e/README.md), immutable0.0.79 commit `d9aac2098351ca17f3743fbaf6ecbd0051b7e00e`: the current install/smoke/settings source.
- [Python3.12 hashlib](https://docs.python.org/3.12/library/hashlib.html): explicit byte-input SHA256 contract, independently reproduced from the existing compact donor receipt. Complete identifier bytes remain private; existing digest2f74… is unchanged.
- Existing native CodexCLI0.161 producer/event evidence and unchanged canonical producer artifactaa835… supply the recorded observation. No current-client inference or new operation is added.
- Existing native `scripts/build_new_wsl_handbook.py`, SHA2561a63ce9f991ec29f7a7e00564940a178b329c47e7661c77a09a60a4c54670f99, projects the canonical profile refs into the handbook.

### Evidence and validation

The existing builder's --write and --check return0 with matching output hashes. The existing current-output/maintained-receipt test passes1case. The actual independent critic is retained verbatim in the actual_output JSON field of `evidence/artifacts/row70-records-b-e-20261008/independent-critic.json`; decoding it reproduces all9171 originalUTF8 bytes/SHA16fe799f6a9075b9856fae3eb584c0ed4deb667233bf5e288bb47997392489e3, including its final blank line. This standard encoding avoids an EOF whitespace defect in the publication without removing any actual report bytes. The JSON artifact is9811bytes/SHAbdf53e7609e865baa9388ef8ce863ff3a65c937c552bd2529e69a9b59ef5d384 and is hash-bound by the unit receipt. It verifies all four record changes, the byte-input digest, distinct identities and preserved evidence.

The maintained handbook receipt updates current profile/output bindings, preserving all40prior regeneration objects and8prior-output objects and appending one of each. Source/generator/test output is retained with its exact scope; it is local record/generated-byte verification, not native acceptance or policy qualification. Registry is updated last.

### Preserved scope and inverse

Original Claude receipt28aa…, producer artifactaa835…, hello/version output hashes and the original command/time/source/proof fields remain unchanged. The0.0.77 filesystem/network and recovery limitations retain their historical scope;0.0.79 policy qualification remains owed. This PR contains no #876 living-plan edit, catalogue, workflow, credential, host, runtime, provider, broker, model or policy action.

Revert only these record/projection edits and their new evidence/registry bindings to undo publication. The previous maintained handbook binding remains in its history. No host inverse is required.

### Checklist

- [x] Four record items are separate from the already landed defectA install-path fix.
- [x] Builder write/check, current binding test and retained independent critic pass.
- [x] Original observations/digests and historical acceptance limits preserved.
- [x] Current handbook binding history retained; unknown Claude identity remains unknown.
- [x] Updated packaging validator passes. Fresh current-main preparation native validate0 (70components,10887files,4profiles,238receipts), exact treefecb4644 matches the final source tree; no modified tests or regeneration needed and all42recorded handbook input hashes match. Earlier validation stays separately dated.
- [ ] Exact-head hosted/thread/current-main conditions before5f lands.