Guard browser OPFS machine file write helper

text4.txt

@@ -149,79 +149,849 @@ Keep blocked until explicitly designed:
 - Python remap/prolog/epilog runtime;
 - tool database process startup and protocol/state behavior.
 
-Immediate next implementation batches
+Follow-on implementation completed after this plan
 
-Batch 1: make boundary reports durable
+Batch 1: durable boundary reports
 
-- Add a generated machine-readable boundary artifact:
+- Complete. The Node inventory now writes:
 
   ```text
   wasm-port/build/wasm/sim-configs-inventory/boundary-summary.tsv
+  wasm-port/build/wasm/sim-configs-inventory/ini-boundary-summary.tsv
+  wasm-port/build/wasm/sim-configs-inventory/blocked-dependency-summary.tsv
+  wasm-port/build/wasm/sim-configs-inventory/boundary-phase-completion-summary.tsv
   ```
 
-- Minimum fields:
+- `boundary-summary.tsv` records the path, INI, tracked blocked kind,
+  classifier recommendation, dependency evidence, user-M execution codes,
+  unstaged user-M codes, vendored user-M count, DB program, HAL/UI/HALUI
+  process flags, and Python UI/remap process flags.
+- The inventory fails if a hard blocked row and the classifier recommendation
+  drift, if `L4-TOOL-DB` lacks `DB_PROGRAM`, if `L4-USER-M-PROCESS` lacks
+  unstaged external user-M execution codes, or if `L4-PYTHON-REMAP` lacks
+  Python remap process evidence.
+
+Batch 2: safe HAL/UI representatives
+
+- Complete. The inventory keeps these safe representatives as Node/browser
+  `REP` rows while recording declared process dependencies:
+  - `axis/gladevcp/probe.ngc`
+  - `woodpecker/on_abort.ngc`
+  - `axis/vismach/puma/puma_cube.ngc`
+  - `axis/vismach/melfa-sim/example.ngc`
+- These rows remain file/remap execution representatives only. They do not
+  claim full HAL/UI process coverage.
+- `axis/vismach/millturn/example.ngc` remains blocked as
+  `L4-USER-M-PROCESS` because its remap chain calls unstaged `M128/M129`.
+
+Batch 3: external user-M process boundary
+
+- Complete as a design-and-gate phase, still blocked for execution.
+- Generated artifacts now identify LinuxCNC ownership and state targets for
+  millturn `M128/M129`:
 
   ```text
-  path
-  ini
-  blocked
-  recommended_blocked
-  dependencies
-  user_m_execution_codes
-  user_m_vendored_count
-  db_program
-  hal_process
-  ui_process
-  halui_mdi_process
-  python_process
+  wasm-port/build/wasm/sim-configs-inventory/user-m-process-boundary-summary.tsv
+  wasm-port/build/wasm/sim-configs-inventory/user-m-process-state-targets.tsv
+  wasm-port/build/wasm/sim-configs-inventory/user-m-process-transition-plan.tsv
+  wasm-port/build/wasm/sim-configs-inventory/user-m-process-native-runtime-state-plan.tsv
+  wasm-port/build/wasm/sim-configs-inventory/user-m-process-native-runtime-readiness.tsv
+  wasm-port/build/wasm/sim-configs-inventory/user-m-process-native-runtime-probe-gate.tsv
   ```
 
-- The existing Node inventory should fail if `blocked` and
-  `recommended_blocked` conflict for hard blocks.
+- The native probe entry point exists:
 
-Batch 2: promote only safe HAL/UI representatives
+  ```text
+  wasm-port/tests/native/probe_millturn_user_m_runtime.sh
+  ```
 
-- Keep `axis/gladevcp/probe.ngc`, `woodpecker/on_abort.ngc`,
-  `axis/vismach/puma/puma_cube.ngc`, and `axis/vismach/melfa-sim/example.ngc`
-  as representative file-execution paths.
-- Add browser assertions that these programs remain file/remap execution
-  representatives and do not claim full UI/HAL process coverage.
-- Do not promote `axis/vismach/millturn/example.ngc` until the user-M process
-  boundary is designed, because the remap chain calls M128/M129.
+- The probe is disabled by default and currently reports
+  `skipped_missing_host_runtime` on this host because `halrun`, `halcmd`, and
+  `linuxcnc` are unavailable. Promotion remains locked.
 
-Batch 3: design external user-M process boundary
+Batch 4: tool DB boundary
 
-- Start with `axis/vismach/millturn` because it is the smallest current hard
-  blocked row with vendored INI and program context.
-- Required design questions:
-  - Which LinuxCNC source owns M128/M129 behavior in the native config?
-  - Is the behavior expressible as a LinuxCNC-owned deterministic adapter
-    boundary, or does it require spawning external process scripts?
-  - What canonical/state output proves behavior without adding JS CNC
-    semantics?
-- Do not mark `millturn` unblocked until native, Node, and browser checks can
-  prove the boundary.
+- Complete as a design-and-gate phase, still blocked for execution.
+- Generated artifacts now describe the `DB_PROGRAM` v2.1 protocol, get/load/
+  put/unload transactions, persistence state, native readiness, and promotion
+  lock:
 
-Batch 4: design tool DB boundary
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/tool-db-process-boundary-summary.tsv
+  wasm-port/build/wasm/sim-configs-inventory/tool-db-process-protocol-gates.tsv
+  wasm-port/build/wasm/sim-configs-inventory/tool-db-process-transaction-plan.tsv
+  wasm-port/build/wasm/sim-configs-inventory/tool-db-process-native-runtime-readiness.tsv
+  ```
 
-- Start with `axis/db_demo/db_nonran.ini`.
-- Required design questions:
-  - Which LinuxCNC source owns `DB_PROGRAM` startup/protocol semantics?
-  - Can a standalone tool database adapter call vendored LinuxCNC tooldata
-    source without reimplementing database behavior?
-  - What fixture demonstrates tool lookup/update behavior across native and
-    WASM?
-- Keep `axis/db_demo/base.ngc` as `L4-TOOL-DB` until this exists.
+- The native probe entry point exists:
+
+  ```text
+  wasm-port/tests/native/probe_tool_db_runtime.sh
+  ```
+
+- The probe is disabled by default and currently reports
+  `skipped_missing_host_runtime` because `linuxcnc`, `milltask`, and `halcmd`
+  are unavailable. `axis/db_demo/base.ngc` remains `L4-TOOL-DB`.
 
 Batch 5: Python remap/full-process family plan
 
-- Do not vendor or execute `gmoccapy`, `axis/laser`, or TWP nutating Layer 4
-  paths until Python remap runtime ownership is designed.
-- First artifact should be a dependency inventory, not execution:
-  - Python modules referenced by INI/remap;
-  - prolog/epilog functions;
-  - HAL/task/UI assumptions;
-  - NGC-only subpaths, if any, that can be separated safely.
+- Complete as dependency inventory plus a minimal native lifecycle fixture
+  plan, still blocked for execution.
+- Generated artifacts now inventory Python remap families, LinuxCNC owner
+  sources, configured modules, callable/prolog/epilog expectations, runtime
+  phases, readiness, and the selected `stop-lookahead` fixture:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/python-remap-boundary-summary.tsv
+  wasm-port/build/wasm/sim-configs-inventory/python-remap-runtime-contract.tsv
+  wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-readiness.tsv
+  wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-state-plan.tsv
+  wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-fixture-plan.tsv
+  ```
+
+- The native probe entry point exists:
+
+  ```text
+  wasm-port/tests/native/probe_python_remap_runtime.sh
+  ```
+
+- The probe is disabled by default and currently reports
+  `skipped_missing_host_runtime` because `linuxcnc` is unavailable. Python
+  remap families remain inventory-only and are not promoted.
+
+Batch 6: Python remap host/source readiness gate
+
+- Complete as a readiness-and-gate phase, still blocked for execution.
+- Generated artifacts now explicitly separate ordinary `python3` availability
+  from LinuxCNC interpreter-owned Python remap runtime readiness:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-readiness.tsv
+  wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-probe-gate.tsv
+  ```
+
+- `python-remap-native-runtime-probe-gate.tsv` records the selected
+  `axis/remap/stop-lookahead/nc_files` fixture, `python3`, `linuxcnc`,
+  `interp_python.cc`, `python_plugin.cc`, and representative module import
+  inputs:
+
+  ```text
+  import:axis/remap/stop-lookahead/python/remap.py
+  import:axis/remap/stop-lookahead/python/toplevel.py
+  ```
+
+- The gate records `python3_sufficient=0`. On this host, `python3` is present
+  but `linuxcnc` is missing, so the gate remains:
+
+  ```text
+  runtime_ready=0
+  source_proof_ready=1
+  gate_status=blocked_missing_host_runtime
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- Node inventory and browser smoke now require the Python remap runtime probe
+  gate artifact. The browser gate checks the same policy without executing
+  Python remap code or claiming browser/full-process coverage.
+
+Batch 7: tool DB host/source readiness gate
+
+- Complete as a readiness-and-gate phase, still blocked for execution.
+- Generated artifacts now explicitly separate ordinary `python3` availability
+  and tool-table fallback from LinuxCNC `DB_PROGRAM` process readiness:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/tool-db-process-native-runtime-readiness.tsv
+  wasm-port/build/wasm/sim-configs-inventory/tool-db-process-native-runtime-probe-gate.tsv
+  ```
+
+- `tool-db-process-native-runtime-probe-gate.tsv` records the selected
+  `axis/db_demo/base.ngc` fixture, `DB_PROGRAM=./db_nonran.py`, required host
+  commands, DB program source, LinuxCNC Python modules, and the v2.1 protocol
+  transaction contract.
+- The gate records:
+
+  ```text
+  python3_sufficient=0
+  tool_table_fallback_sufficient=0
+  db_program_source_ready=1
+  linuxcnc_python_modules_ready=1
+  protocol_contract_ready=1
+  source_proof_ready=1
+  ```
+
+- On this host, `python3` is present but `linuxcnc`, `milltask`, and `halcmd`
+  are missing, so the gate remains:
+
+  ```text
+  runtime_ready=0
+  gate_status=blocked_missing_host_runtime
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- Node inventory and browser smoke now require the tool DB runtime probe gate
+  artifact. The browser gate checks the same policy without executing
+  `DB_PROGRAM`, starting LinuxCNC processes, or falling back to `.tbl`
+  semantics.
+
+Batch 8: native runtime probe/gate alignment
+
+- Complete as a cross-artifact consistency gate, still blocked for execution.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-probe-gate-alignment.tsv
+  ```
+
+- This artifact aligns the native runtime probe summary with the generated
+  runtime probe gates for:
+  - `axis/vismach/millturn/example.ngc`
+  - `axis/db_demo/base.ngc`
+  - `axis/remap/stop-lookahead/nc_files`
+- The alignment requires matching `runtime_ready`, `source_proof_ready`,
+  missing host requirements, execution-disabled state, promotion-disabled
+  state, and compatible native/gate statuses.
+- Node inventory and browser smoke now require this alignment before any
+  blocked boundary can be considered for promotion.
+
+Batch 9: native runtime probe opt-in metadata
+
+- Complete as a native/WASM/browser schema hardening phase, still blocked for
+  execution.
+- `native-runtime-probe-summary.tsv` now records the proof key and opt-in
+  switch for each disabled native runtime probe:
+
+  ```text
+  required_native_proof
+  opt_in_env
+  probe_note
+  ```
+
+- The current rows explicitly require:
+  - `native_runtime_state_probe_required` with
+    `ENABLE_MILLTURN_USER_M_RUNTIME_PROBE=1`;
+  - `native_db_process_protocol_probe_required` with
+    `ENABLE_TOOL_DB_RUNTIME_PROBE=1`;
+  - `linuxcnc_python_runtime_lifecycle_probe_required` with
+    `ENABLE_PYTHON_REMAP_RUNTIME_PROBE=1`.
+- The native probe scripts now emit a `runtime_probe_note` for missing source,
+  missing host runtime, disabled-ready, pass, and fail states. On this host the
+  notes still report missing LinuxCNC host runtime and keep promotion disabled.
+- `runtime-probe-gate-alignment.tsv` now compares the gate
+  `required_native_proof` with the native runtime summary proof key and records
+  `native_opt_in_env`, so a ready host cannot silently drift from the intended
+  opt-in probe.
+- Native, Node inventory, and browser smoke all require these fields while
+  keeping `execution_enabled=0` and `promotion_allowed=0`.
+
+Batch 10: native runtime opt-in execution plan
+
+- Complete as a generated runbook/gate artifact, still blocked for execution on
+  this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/native-runtime-probe-execution-plan.tsv
+  ```
+
+- The artifact records the exact opt-in command, current runtime readiness,
+  current native probe status, expected pass status, missing requirements, gate
+  alignment status, and promotion prerequisites for:
+  - `axis/vismach/millturn/example.ngc`;
+  - `axis/db_demo/base.ngc`;
+  - `axis/remap/stop-lookahead/nc_files`.
+- Current opt-in commands are:
+  - `ENABLE_MILLTURN_USER_M_RUNTIME_PROBE=1 bash wasm-port/tests/native/probe_millturn_user_m_runtime.sh`;
+  - `ENABLE_TOOL_DB_RUNTIME_PROBE=1 bash wasm-port/tests/native/probe_tool_db_runtime.sh`;
+  - `ENABLE_PYTHON_REMAP_RUNTIME_PROBE=1 bash wasm-port/tests/native/probe_python_remap_runtime.sh`.
+- The expected native pass statuses are:
+  - `runtime_state_probe_passed`;
+  - `runtime_protocol_probe_passed`;
+  - `runtime_lifecycle_probe_passed`.
+- On this host all three rows remain:
+
+  ```text
+  runtime_ready=0
+  gate_alignment_ok=1
+  execution_enabled=0
+  promotion_allowed=0
+  plan_status=blocked_missing_host_runtime
+  ```
+
+- Promotion remains explicitly gated on native pass status, subsequent Node
+  inventory gate alignment, browser smoke gate alignment, and a manual promotion
+  lock update. The opt-in command alone does not promote any blocked row.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this execution plan.
+
+Batch 11: native runtime pass evidence contract
+
+- Complete as a generated stdout-evidence contract, still blocked for execution
+  on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/native-runtime-probe-pass-evidence-contract.tsv
+  ```
+
+- The artifact records the native stdout evidence keys that must be present
+  after each opt-in native runtime probe reports its expected pass status.
+- Current required pass statuses and evidence include:
+  - millturn user-M:
+    `runtime_state_probe_passed`,
+    `millturn_user_m_M128_runtime_state_ok=1`,
+    `millturn_user_m_M129_runtime_state_ok=1`;
+  - tool DB:
+    `runtime_protocol_probe_passed`,
+    `tool_db_protocol_version=v2.1`,
+    `tool_db_runtime_protocol_probe_ok=1`,
+    `tool_db_persistence_state_ok=1`;
+  - Python remap:
+    `runtime_lifecycle_probe_passed`,
+    `python_remap_lifecycle_generator_first_yield=2`,
+    `python_remap_runtime_lifecycle_probe_ok=1`.
+- On this host all three rows remain:
+
+  ```text
+  evidence_required_now=0
+  observed_evidence_ready=0
+  missing_evidence_keys=-
+  evidence_status=pending_until_native_pass
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- If a future opt-in probe reports its expected pass status, Node inventory will
+  require all declared stdout evidence keys before any Node/browser promotion
+  work can proceed. Browser smoke checks the same contract and still treats it
+  as non-promoting evidence.
+- The boundary phase completion summary now requires this evidence contract.
+
+Batch 12: runtime boundary promotion readiness summary
+
+- Complete as a generated final promotion-readiness gate, still blocked for
+  execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-promotion-readiness.tsv
+  ```
+
+- The artifact combines:
+  - native runtime execution plan status;
+  - native pass evidence status;
+  - blocked runtime promotion lock state;
+  - Node inventory gate completion state;
+  - browser smoke gate completion state;
+  - manual lock update requirement.
+- Current rows remain:
+
+  ```text
+  native_pass_ready=0
+  native_evidence_ready=0
+  node_inventory_gate_complete=0
+  browser_smoke_gate_complete=0
+  promotion_lock_active=1
+  manual_lock_update_required=1
+  promotion_ready=0
+  execution_enabled=0
+  promotion_allowed=0
+  blocking_reason=awaiting_native_runtime_probe_pass
+  ```
+
+- This gives each blocked runtime family one machine-readable final decision:
+  even if a native probe later passes, promotion still requires native evidence,
+  Node/browser promotion gates, and an explicit manual promotion lock update.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this readiness summary.
+
+Batch 13: runtime boundary promotion blockers
+
+- Complete as a generated blocker-summary gate, still blocked for execution and
+  promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-promotion-blockers.tsv
+  ```
+
+- The artifact expands each `promotion_ready=0` decision into concrete blocker
+  keys and the next unblock action. Current blocker keys include:
+  - `host_runtime_requirements_missing`;
+  - `native_runtime_probe_not_passed`;
+  - `native_pass_evidence_not_ready`;
+  - `node_inventory_gate_not_complete`;
+  - `browser_smoke_gate_not_complete`;
+  - `promotion_lock_active`;
+  - `manual_lock_update_required`.
+- Current missing runtime requirements are:
+  - millturn user-M: `halrun,halcmd,linuxcnc`;
+  - tool DB: `linuxcnc,milltask,halcmd`;
+  - Python remap: `linuxcnc`.
+- The current next unblock action is to provide the missing host runtime
+  requirements for each family. The artifact remains summary-only:
+
+  ```text
+  promotion_ready=0
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this blocker summary.
+
+Batch 14: post-native-pass promotion gates
+
+- Complete as a generated post-native-pass gate, still blocked for execution
+  and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-post-native-pass-gates.tsv
+  ```
+
+- The artifact records, for each blocked runtime family, the native pass
+  status, native evidence readiness, required Node proof, required browser
+  proof, Node gate status, browser gate status, manual lock requirement, and
+  active promotion lock state.
+- Current rows remain:
+
+  ```text
+  native_pass_ready=0
+  native_evidence_ready=0
+  node_gate_status=blocked_until_native_pass_evidence
+  browser_gate_status=blocked_until_node_gate_complete
+  manual_lock_update_required=1
+  promotion_lock_active=1
+  execution_enabled=0
+  promotion_allowed=0
+  gate_status=blocked_before_native_pass
+  ```
+
+- This closes the next machine-readable step after a future native probe pass:
+  native evidence must exist first, then Node inventory proof, then browser
+  smoke proof, then a manual promotion-lock update. Native pass alone still
+  cannot promote `L4-USER-M-PROCESS`, `L4-TOOL-DB`, or
+  `L4-PYTHON-REMAP`.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this post-native-pass gate.
+
+Batch 15: blocked runtime host preflight
+
+- Complete as a generated host-preflight summary, still blocked for execution
+  and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-preflight.tsv
+  ```
+
+- The artifact aggregates the three runtime probe gates into one host-facing
+  preflight table with:
+  - boundary class/kind/target;
+  - required LinuxCNC runtime family;
+  - full runtime requirement availability vector;
+  - missing host requirements;
+  - source proof readiness;
+  - required native proof key;
+  - opt-in environment variable;
+  - exact opt-in command;
+  - current native probe status;
+  - preflight status.
+- Current rows remain:
+
+  ```text
+  source_proof_ready=1
+  runtime_ready=0
+  current_probe_status=skipped_missing_host_runtime
+  preflight_status=blocked_missing_host_runtime
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- Current missing runtime requirements are summarized in one artifact:
+  - millturn user-M: `halrun,halcmd,linuxcnc`;
+  - tool DB: `linuxcnc,milltask,halcmd`;
+  - Python remap: `linuxcnc`.
+- This preflight does not run probes and does not relax promotion locks. It
+  only records when a future host is ready to run the already declared opt-in
+  native probe commands.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this host-preflight artifact.
+
+Batch 16: blocked runtime host requirement summary
+
+- Complete as a generated normalized host requirement summary, still blocked
+  for execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-requirement-summary.tsv
+  ```
+
+- The artifact expands the host preflight `runtime_requirements` vectors into
+  one row per required host command/source/module, with:
+  - requirement name;
+  - requirement kind (`host_command` or `source_or_module`);
+  - current availability;
+  - blocked runtime families that require it;
+  - blocked runtime families for which it is missing;
+  - opt-in probe environment variables affected by it;
+  - whether the missing requirement currently blocks runtime execution.
+- Current missing host commands are normalized as:
+
+  ```text
+  halcmd    available=0 required_by=L4-TOOL-DB,L4-USER-M-PROCESS
+  halrun    available=0 required_by=L4-USER-M-PROCESS
+  linuxcnc  available=0 required_by=L4-PYTHON-REMAP,L4-TOOL-DB,L4-USER-M-PROCESS
+  milltask  available=0 required_by=L4-TOOL-DB
+  ```
+
+- Current available prerequisites remain recorded but non-promoting, including
+  `python3`, `tclsh`, `axis/db_demo/db_nonran.py`, `linuxcnc.so`,
+  `tooldb.py`, `interp_python.cc`, `python_plugin.cc`, and the selected
+  stop-lookahead Python modules.
+- This summary does not run probes and does not relax promotion locks. It only
+  makes the host gap list machine-readable by requirement and affected blocked
+  family.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this host requirement summary.
+
+Batch 17: blocked runtime host unblock plan
+
+- Complete as a generated host unblock plan, still blocked for execution and
+  promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-unblock-plan.tsv
+  ```
+
+- The artifact filters the host requirement summary to only requirements that
+  are both unavailable and currently block runtime probes. Each row records:
+  - missing host command;
+  - affected blocked runtime families;
+  - affected target programs/families;
+  - affected opt-in native probe environment variables;
+  - exact affected opt-in native probe commands;
+  - remaining missing requirements after that one command becomes available;
+  - non-executing unblock status and next action.
+- Current blocking host commands are:
+
+  ```text
+  halcmd
+  halrun
+  linuxcnc
+  milltask
+  ```
+
+- Every current row remains a partial unblock because each affected runtime
+  family still has at least one other missing host requirement after any single
+  command is provided:
+
+  ```text
+  unblocks_when_available=partial_unblock_other_requirements_remain
+  next_action=provide_missing_host_requirement
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- This plan does not install host commands, run probes, or relax promotion
+  locks. It only makes the next host-runtime unblock actions and affected
+  opt-in probes machine-readable.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this host unblock plan.
+
+Batch 18: blocked runtime family host readiness
+
+- Complete as a generated per-family host readiness summary, still blocked for
+  execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-family-host-readiness.tsv
+  ```
+
+- The artifact records one row per blocked runtime family with:
+  - boundary class/kind/target;
+  - required LinuxCNC runtime family;
+  - missing host requirement count and list;
+  - currently available prerequisite count and list;
+  - opt-in native probe environment variable;
+  - exact opt-in native probe command;
+  - current probe and preflight status;
+  - per-family host status.
+- Current rows remain:
+
+  ```text
+  L4-USER-M-PROCESS  missing=halrun,halcmd,linuxcnc
+  L4-TOOL-DB         missing=linuxcnc,milltask,halcmd
+  L4-PYTHON-REMAP    missing=linuxcnc
+  ```
+
+- Current per-family status remains:
+
+  ```text
+  preflight_status=blocked_missing_host_runtime
+  family_host_status=blocked_missing_host_requirements
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- This summary does not run probes and does not relax promotion locks. It gives
+  each blocked family a single host-readiness row to check before running the
+  already declared opt-in native probe command.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this family host readiness summary.
+
+Batch 19: blocked runtime host readiness rollup
+
+- Complete as a generated aggregate host readiness rollup, still blocked for
+  execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-readiness-rollup.tsv
+  ```
+
+- The artifact reduces the per-family host readiness rows to one overall
+  decision for blocked runtime native probes:
+  - total blocked runtime family count;
+  - host-ready family count;
+  - host-blocked family count;
+  - blocked family list;
+  - unique missing host requirement list;
+  - ready opt-in command count/list;
+  - blocked opt-in command list;
+  - aggregate host readiness status.
+- Current aggregate state remains:
+
+  ```text
+  family_count=3
+  host_ready_family_count=0
+  host_blocked_family_count=3
+  missing_host_requirements=halcmd,halrun,linuxcnc,milltask
+  ready_opt_in_command_count=0
+  ready_opt_in_commands=-
+  host_readiness_status=host_blocked_for_all_opt_in_native_probes
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- The rollup does not run probes and does not relax promotion locks. It gives
+  the browser, Node inventory, and future automation one single non-promoting
+  answer: this host is not ready to run any blocked runtime opt-in native
+  probe.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this host readiness rollup.
+
+Batch 20: blocked runtime opt-in probe dispatch plan
+
+- Complete as a generated per-probe host dispatch plan, still blocked for
+  execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-plan.tsv
+  ```
+
+- The artifact turns the family host-readiness rows and aggregate host
+  readiness rollup into one row per blocked runtime opt-in native probe, with:
+  - boundary class/kind/target;
+  - opt-in environment variable;
+  - exact opt-in native probe command;
+  - per-family host status;
+  - missing host requirements;
+  - aggregate host readiness status;
+  - dispatch action and dispatch permission;
+  - next action.
+- Current dispatch rows remain:
+
+  ```text
+  L4-USER-M-PROCESS  host_action=skip_missing_host_requirements  missing=halrun,halcmd,linuxcnc
+  L4-TOOL-DB         host_action=skip_missing_host_requirements  missing=linuxcnc,milltask,halcmd
+  L4-PYTHON-REMAP    host_action=skip_missing_host_requirements  missing=linuxcnc
+  ```
+
+- Current dispatch state remains:
+
+  ```text
+  host_readiness_status=host_blocked_for_all_opt_in_native_probes
+  dispatch_allowed=0
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- This dispatch plan does not run probes and does not relax promotion locks. It
+  gives future automation a per-command action: skip each blocked runtime
+  native probe until the named host requirements are present, then require the
+  existing manual opt-in command before any promotion gates can move.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this opt-in probe dispatch plan.
+
+Batch 21: blocked runtime opt-in probe dispatch rollup
+
+- Complete as a generated aggregate dispatch rollup, still blocked for
+  execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-rollup.tsv
+  ```
+
+- The artifact reduces the per-probe dispatch plan rows to one overall
+  dispatch switch for blocked runtime native probes:
+  - total opt-in probe count;
+  - dispatch-allowed probe count;
+  - dispatch-blocked probe count;
+  - blocked family list;
+  - dispatch action set;
+  - dispatch-allowed command list;
+  - dispatch-blocked command list;
+  - unique missing host requirement list;
+  - aggregate dispatch status.
+- Current aggregate dispatch state remains:
+
+  ```text
+  probe_count=3
+  dispatch_allowed_count=0
+  dispatch_blocked_count=3
+  dispatch_actions=skip_missing_host_requirements
+  dispatch_allowed_commands=-
+  missing_host_requirements=halcmd,halrun,linuxcnc,milltask
+  dispatch_status=dispatch_blocked_for_all_opt_in_native_probes
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- The rollup does not run probes and does not relax promotion locks. It gives
+  browser smoke, Node inventory, and future automation a single non-promoting
+  dispatch answer: no blocked runtime opt-in native probe may run on this host.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this opt-in probe dispatch rollup.
+
+Batch 22: blocked runtime opt-in probe skip evidence contract
+
+- Complete as a generated per-probe skip/evidence contract, still blocked for
+  execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-contract.tsv
+  ```
+
+- The artifact joins the opt-in probe dispatch plan with the native pass
+  evidence contract so each currently skipped probe records:
+  - boundary class/kind/target;
+  - runtime probe id;
+  - opt-in environment variable;
+  - exact opt-in native probe command;
+  - host dispatch action;
+  - skip reason;
+  - missing host requirements;
+  - current probe status;
+  - whether native pass evidence is required now;
+  - observed native evidence readiness;
+  - skip/evidence status.
+- Current skip/evidence rows remain:
+
+  ```text
+  L4-USER-M-PROCESS  skip_reason=missing_host_requirements  missing=halrun,halcmd,linuxcnc
+  L4-TOOL-DB         skip_reason=missing_host_requirements  missing=linuxcnc,milltask,halcmd
+  L4-PYTHON-REMAP    skip_reason=missing_host_requirements  missing=linuxcnc
+  ```
+
+- Current evidence state remains:
+
+  ```text
+  current_probe_status=skipped_missing_host_runtime
+  evidence_required_now=0
+  observed_evidence_ready=0
+  native_evidence_status=pending_until_native_pass
+  skip_evidence_status=skip_valid_until_host_requirements_available
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- This contract does not run probes and does not relax promotion locks. It
+  makes the non-executed state explicit: skipped opt-in native probes do not
+  satisfy native pass evidence until host requirements are present and the
+  existing manual opt-in probe command passes.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this opt-in probe skip evidence contract.
+
+Batch 23: blocked runtime opt-in probe skip evidence rollup
+
+- Complete as a generated aggregate skip/evidence rollup, still blocked for
+  execution and promotion on this host.
+- Generated artifact:
+
+  ```text
+  wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-rollup.tsv
+  ```
+
+- The artifact reduces the per-probe skip/evidence contract rows to one
+  overall native evidence acceptance state for blocked runtime opt-in probes:
+  - total opt-in probe count;
+  - skipped probe count;
+  - current evidence-required count;
+  - observed evidence-ready count;
+  - skipped family list;
+  - skip reason list;
+  - unique missing host requirement list;
+  - current probe status list;
+  - native evidence status list;
+  - skip/evidence status list;
+  - aggregate evidence rollup status.
+- Current aggregate skip/evidence state remains:
+
+  ```text
+  probe_count=3
+  skip_count=3
+  evidence_required_now_count=0
+  observed_evidence_ready_count=0
+  skip_reasons=missing_host_requirements
+  missing_host_requirements=halcmd,halrun,linuxcnc,milltask
+  current_probe_statuses=skipped_missing_host_runtime
+  native_evidence_statuses=pending_until_native_pass
+  skip_evidence_statuses=skip_valid_until_host_requirements_available
+  evidence_rollup_status=no_native_pass_evidence_accepted_while_host_blocked
+  execution_enabled=0
+  promotion_allowed=0
+  ```
+
+- The rollup does not run probes and does not relax promotion locks. It gives
+  browser smoke, Node inventory, and future automation a single non-promoting
+  evidence answer: no native pass evidence is accepted while every blocked
+  runtime opt-in probe is skipped for missing host requirements.
+- Node inventory, browser smoke, and the boundary phase completion summary now
+  require this opt-in probe skip evidence rollup.
+
+Current next implementation recommendations
+
+Generated recommendation source:
+
+```text
+wasm-port/build/wasm/sim-configs-inventory/next-boundary-recommendations.tsv
+```
+
+1. Implement and run the LinuxCNC-owned millturn `M128/M129` HAL/Tcl state
+   runtime probe after a host runtime with `tclsh`, `halrun`, `halcmd`, and
+   `linuxcnc` is available. Keep the row blocked until the native state probe
+   passes and Node/browser coverage can prove a narrow standalone boundary
+   without full-process claims.
+2. Implement and run the tool DB protocol probe after
+   `tool-db-process-native-runtime-probe-gate.tsv` reports `runtime_ready=1`
+   with `python3`, `linuxcnc`, `milltask`, and `halcmd` available. The proof
+   must cover v2.1 handshake, `g`, `p`, `l`, `u`, state changes, and
+   persistence before `axis/db_demo/base.ngc` can move out of `L4-TOOL-DB`.
+3. Implement the minimal Python remap lifecycle proof for
+   `axis/remap/stop-lookahead` after the new native runtime probe gate reports
+   `runtime_ready=1` with both `python3` and `linuxcnc` available. Keep all
+   Python-remap families blocked until the LinuxCNC Python runtime lifecycle is
+   proven without JavaScript CNC semantics.
 
 Validation gates
 

wasm-port/docs/compatibility-validation.md

@@ -141,14 +141,28 @@ The native harness also emits machine-readable derived artifacts without
 changing the `summary.tsv` schema:
 
 ```text
+wasm-port/build/native/source-probes.tsv
+wasm-port/build/native/native-source-proof-summary.tsv
+wasm-port/build/native/native-runtime-probe-summary.tsv
+wasm-port/build/native/nc-files/summary.tsv
+wasm-port/build/native/sim-configs/summary.tsv
 wasm-port/build/native/sim-configs/class-summary.tsv
 wasm-port/build/native/sim-configs/path-matrix.tsv
+wasm-port/build/native/sim-configs/skipped.tsv
 ```
 
 `class-summary.tsv` aggregates class/status/expected-failure counts.
 `path-matrix.tsv` records each path, class, native status, expected-failure
 reason, INI, tool table, runtime family, and blocked kind for CI and Node
 inventory reconciliation.
+`source-probes.tsv` records the native source-probe entry points used by
+`verify_native_probes.sh`. `native-source-proof-summary.tsv` records
+LinuxCNC-owned source proof for user-M process, tool DB process, and Python
+remap runtime blockers without enabling execution or promotion.
+`native-runtime-probe-summary.tsv` records the guarded native opt-in runtime
+probe status and missing host requirements. `nc-files/summary.tsv` records the
+Layer 1 native `nc_files` baseline, and `sim-configs/skipped.tsv` records the
+Layer 2 native sim-config skipped or expected-skip accounting.
 
 The Node inventory layer writes its own machine-readable artifacts:
 
@@ -163,19 +177,34 @@ wasm-port/build/wasm/sim-configs-inventory/user-m-process-state-targets.tsv
 wasm-port/build/wasm/sim-configs-inventory/user-m-process-native-state-alignment.tsv
 wasm-port/build/wasm/sim-configs-inventory/tool-db-process-protocol-gates.tsv
 wasm-port/build/wasm/sim-configs-inventory/tool-db-process-native-protocol-alignment.tsv
+wasm-port/build/wasm/sim-configs-inventory/tool-db-process-native-runtime-probe-gate.tsv
 wasm-port/build/wasm/sim-configs-inventory/python-remap-boundary-summary.tsv
 wasm-port/build/wasm/sim-configs-inventory/python-remap-runtime-gates.tsv
 wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-alignment.tsv
 wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-readiness.tsv
+wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-probe-gate.tsv
 wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-state-plan.tsv
 wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-fixture-plan.tsv
 wasm-port/build/wasm/sim-configs-inventory/python-remap-family-summary.tsv
 wasm-port/build/wasm/sim-configs-inventory/boundary-phase-completion-summary.tsv
 wasm-port/build/wasm/sim-configs-inventory/native-proof-alignment-summary.tsv
 wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-native-alignment-summary.tsv
+wasm-port/build/wasm/sim-configs-inventory/native-runtime-probe-execution-plan.tsv
 wasm-port/build/wasm/sim-configs-inventory/blocked-runtime-promotion-lock.tsv
 wasm-port/build/wasm/sim-configs-inventory/next-boundary-worklist.tsv
+wasm-port/build/wasm/sim-configs-inventory/next-boundary-recommendations.tsv
 wasm-port/build/wasm/sim-configs-inventory/boundary-proof-gates.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-native-evidence-acceptance-gate.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-promotion-blockers.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-preflight.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-requirement-summary.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-unblock-plan.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-family-host-readiness.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-readiness-rollup.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-plan.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-rollup.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-contract.tsv
+wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-rollup.tsv
 ```
 
 The current skip/block summary is `ASSET-ONLY=65`, `L4-PYTHON-REMAP=53`,
@@ -243,6 +272,133 @@ blocked dependency row, records the required native/Node/browser proof, and
 keeps `execution_enabled=0` until the corresponding LinuxCNC-owned runtime
 boundary exists. The tracked matrix and inventory guard also require those two
 rows to remain non-representative in Node/browser until that proof exists.
+`runtime-boundary-host-preflight.tsv` is the host-facing preflight for the
+blocked runtime probes. It records each blocked family, the required LinuxCNC
+runtime commands, the opt-in environment variable, the exact native probe
+command, the current probe status, and keeps `execution_enabled=0` and
+`promotion_allowed=0`. It does not run probes or relax promotion locks.
+`runtime-boundary-host-requirement-summary.tsv` normalizes those preflight
+requirements into one row per host command or source/module prerequisite, so
+missing `halcmd`, `halrun`, `linuxcnc`, and `milltask` can be audited by the
+blocked families they affect. `runtime-boundary-host-unblock-plan.tsv`
+filters that table to unavailable requirements and records the affected
+opt-in commands and remaining missing requirements; it is a planning artifact
+only.
+`runtime-boundary-family-host-readiness.tsv` reduces the same host evidence to
+one row per blocked runtime family, and
+`runtime-boundary-host-readiness-rollup.tsv` gives the aggregate decision. On
+this host the rollup remains `host_blocked_for_all_opt_in_native_probes` with
+zero ready opt-in commands. These rows are non-executing and non-promoting.
+`runtime-boundary-opt-in-probe-dispatch-plan.tsv` turns each family readiness
+row into a per-probe dispatch action. `runtime-boundary-opt-in-probe-dispatch-rollup.tsv`
+then gives the aggregate dispatch switch; currently every blocked runtime
+probe is skipped for missing host requirements. Dispatch permission only means
+the guarded native probe may be manually run on a ready host, not that the row
+is promoted.
+`runtime-boundary-opt-in-probe-skip-evidence-contract.tsv` records why each
+non-dispatched probe is skipped and whether native pass evidence is required
+yet. `runtime-boundary-opt-in-probe-skip-evidence-rollup.tsv` gives the
+aggregate evidence decision. While probes are skipped for missing host
+requirements, no native pass evidence is accepted and every blocked family
+remains `execution_enabled=0` and `promotion_allowed=0`.
+`native-runtime-probe-execution-plan.tsv` records the exact opt-in command,
+required native proof key, current runtime readiness, expected pass status,
+missing requirements, and promotion prerequisites for the three guarded native
+runtime probes. On this host all rows remain
+`plan_status=blocked_missing_host_runtime`.
+`runtime-boundary-native-evidence-acceptance-gate.tsv` decides whether native
+pass evidence may be accepted for each blocked runtime family. It currently
+blocks evidence acceptance until host requirements are available and the
+native opt-in probe passes. `runtime-boundary-promotion-blockers.tsv` expands
+each non-ready promotion decision into concrete blocker keys such as missing
+host runtime, native probe not passed, Node/browser gates incomplete,
+promotion lock active, and manual lock update required.
+`next-boundary-recommendations.tsv` is the generated priority handoff for the
+next runtime boundary work. It ranks millturn user-M, tool DB, and Python
+runtime lifecycle work, while keeping `execution_enabled=0` and
+`promotion_allowed=0`. The Node inventory verifies the exact per-family
+`source_artifacts` set, duplicate-free source lists, and `primary_artifact`
+traceability for each recommendation, and requires every referenced artifact
+token to exist under the generated sim-config inventory artifact directory.
+The Node inventory also runs a cross-artifact guard over the blocked runtime
+opt-in target set. It requires recommendations, execution plan, host preflight,
+dispatch plan, skip/evidence contract, native evidence acceptance gate,
+promotion readiness, promotion blockers, and post-native-pass gates to agree
+on the same target, proof keys, opt-in command, missing runtime requirements,
+active promotion lock, and non-executing/non-promoting state.
+The browser smoke mirrors the promotion and opt-in gate consistency checks by
+cross-checking the promotion lock, readiness, blocker, post-native-pass, native
+evidence acceptance, pass-evidence, recommendation, host-preflight, family
+readiness, dispatch, and skip-evidence artifacts. This browser-side parity is
+non-executing and keeps every blocked runtime family locked until native,
+Node, browser, and manual promotion gates all agree.
+It also cross-checks `runtime-boundary-host-requirement-summary.tsv`,
+`runtime-boundary-host-unblock-plan.tsv`,
+`runtime-boundary-family-host-readiness.tsv`, and
+`runtime-boundary-host-preflight.tsv` so missing and available host
+requirements, affected opt-in commands, and family probe commands cannot drift
+between the host-readiness artifacts.
+It also checks that `boundary-phase-completion-summary.tsv` counts match the
+blocked-runtime and family-specific artifact rows the browser has already
+loaded, so completion criteria cannot drift from the generated gate artifacts
+seen by browser smoke.
+It also cross-checks the user-M, tool DB, and Python family-specific
+contract/readiness/probe artifacts against `runtime-boundary-contract-summary.tsv`
+so browser validation sees the same runtime-family contract alignment as the
+Node inventory, without running any blocked runtime process.
+It also checks `next-boundary-recommendations.tsv` row counts against the
+generated user-M probe-gate, tool DB probe-gate, and Python runtime-contract
+source rows, so recommendation priority handoffs cannot drift from their
+machine-readable source artifacts.
+It also checks each recommendation's `primary_artifact` and `source_artifacts`
+against the browser-visible generated artifact set, including duplicate
+detection, primary-artifact traceability, and exact per-family source artifact
+sets, while keeping execution and promotion disabled. The Node coverage gate
+also confirms the browser recommendation source-artifact check uses the same
+`wasmArtifactNames` returned by the artifact documentation coverage helper.
+It also fetches the compatibility, matrix, and full-process boundary docs in
+browser smoke and checks the documented artifact names/tokens for the generated
+WASM inventory TSVs and native TSVs. The same browser check fetches those TSV
+artifacts, requires a non-empty TSV header, and verifies the expected
+artifact/token lists are duplicate-free with fixed counts, mirroring the Node
+documentation coverage gate without executing native runtime probes. The native
+`build/native/sim-configs/skipped.tsv` artifact is allowed to be empty when the
+native strict sim-config baseline has no skipped rows.
+The same Node inventory run also checks generated artifact documentation
+coverage: every TSV emitted under
+`build/wasm/sim-configs-inventory/` must be named in
+`compatibility-validation.md`, `sim-configs-coverage-matrix.md`, or
+`full-process-boundary-design.md`. New gate artifacts must therefore be
+documented before the inventory can pass.
+The Node coverage gate also requires the generated WASM inventory artifact list
+to remain the exact duplicate-free 54-entry baseline and the native generated
+TSV token list to remain the exact duplicate-free 8-token baseline. It also
+requires the corresponding `boundary-phase-completion-summary.tsv`
+documentation-coverage counts to remain `54` and `8`, respectively. It also
+checks that the browser smoke source lists the same generated WASM and native
+artifact tokens and preserves the same fixed-count, duplicate-free,
+fetchability/header, documentation-missing, and completion count-parity guards
+before browser-side artifact coverage can pass. It also checks that browser
+smoke actually executes the artifact documentation coverage helper, fetches
+each generated WASM artifact by artifact name, fetches each native TSV by
+relative artifact token, calls the completion count-parity helper with the
+generated completion rows, still fetches and joins the exact compatibility,
+matrix, and full-process boundary review-document set for that coverage check
+before checking for missing artifact references, requires the browser
+missing-reference loops to iterate `wasmArtifactNames` and
+`nativeArtifactTokens` against that joined `documentationText`, keeps
+completion evidence reviewable for browser count parity, binds the
+documentation-coverage completion counts to the returned `wasmArtifactNames`
+and `nativeArtifactTokens` arrays, and preserves the native skipped-artifact
+empty allowance for `build/native/sim-configs/skipped.tsv`.
+Native generated TSVs under `build/native/` are checked the same way by their
+relative artifact path. This catches native baseline/source-proof/runtime-probe
+artifacts that are generated but not described in the compatibility, coverage,
+or full-process boundary documentation.
+It also checks native source proof consistency: the native source proof
+alignment rows, native runtime probe summary, and runtime probe gate alignment
+must cover the same blocked classes and agree that source proof is ready while
+execution and promotion remain disabled.
 `user-m-process-state-targets.tsv` expands the `millturn` M128/M129 process
 boundary into per-pin proof targets: two user-M codes, three axes, and four
 `ini.[xyz]` HAL pins per axis. Each row records the source Tcl file, remap
@@ -302,6 +458,10 @@ keeping `proof_status=pending`, `execution_enabled=0`, and
 vendored `DB_PROGRAM`, drives the LinuxCNC `tooldb.py` `v2.1`/`g`/`p`/`l`/`u`
 protocol, verifies nonrandom startup/update/load/unload state and persistence,
 and reports `runtime_protocol_probe_passed` without enabling promotion.
+`tool-db-process-native-runtime-probe-gate.tsv` combines the DB source proof
+and host readiness into the execution gate for that guarded native probe. It
+records `runtime_ready`, missing requirements, source proof readiness, and the
+non-promoting gate status before any manual opt-in run is allowed.
 `python-remap-boundary-summary.tsv` is the machine-readable companion for the
 Python remap inventory batch. It has one inventory-only row for each
 `L4-PYTHON-REMAP` path, records Python modules, remap/prolog/epilog functions,
@@ -323,6 +483,11 @@ prerequisites for guarded probes by family: `python3`, `linuxcnc`,
 LinuxCNC's `interp_python.cc` / `python_plugin.cc` owner source files, and the
 configured Python modules. It is a readiness gate only and keeps every row
 `proof_status=pending`, `execution_enabled=0`, and `promotion_allowed=0`.
+`python-remap-native-runtime-probe-gate.tsv` combines the selected Python
+runtime fixture, source proof, and host readiness into the execution gate for
+the guarded native lifecycle probe. It remains non-executing and
+non-promoting until `linuxcnc` is available and the dispatch gate permits the
+manual opt-in probe.
 `python-remap-native-runtime-state-plan.tsv` records the next native runtime
 probe target set by family: LinuxCNC Python phases, configured modules,
 callables, NGC-only subpaths, process assumptions, readiness counts, and
@@ -352,6 +517,50 @@ disabled, and proof that blocked runtime families carry LinuxCNC-owned user-M,
 tool DB, and Python runtime evidence fields. It also records native source
 proof alignment when the native proof summary is available, plus the aggregate
 native stdout alignment summary for user-M, tool DB, and Python runtime gates.
+The same completion summary now includes documentation-coverage criteria for
+generated WASM sim-config inventory TSV artifacts and native generated TSV
+artifacts, so artifact generation and review documentation stay in lockstep.
+It also exposes the blocked runtime worklist/recommendation consistency guard,
+the blocked runtime promotion gate consistency guard, the blocked runtime host
+requirement consistency guard, the blocked runtime host/dispatch/skip-evidence
+rollup consistency guard, the blocked runtime opt-in cross-artifact consistency
+guard, the native source proof/runtime probe consistency guard, and the runtime
+family contract/alignment consistency guard as completion criteria, so review
+can see those gates without reopening every individual TSV. The family
+contract/alignment guard checks that the user-M, tool DB, and Python-specific
+contract, readiness, probe-gate, and fixture/state-plan artifacts agree with
+`runtime-boundary-contract-summary.tsv` and
+`runtime-boundary-native-alignment-summary.tsv` while keeping execution and
+promotion disabled.
+The browser smoke consumes the same `boundary-phase-completion-summary.tsv`
+criterion list and fails on criterion drift. This is a browser-side parity
+check for generated gate artifacts only; it does not execute blocked native
+runtime probes or allow promotion.
+The browser smoke also checks that `runtime-boundary-contract-summary.tsv`
+points at the same runtime alignment artifact, row count, boundary kind, and
+disabled execution/promotion state reported by
+`runtime-boundary-native-alignment-summary.tsv`.
+It also cross-checks `native-proof-alignment-summary.tsv`,
+`native-runtime-probe-summary.tsv`, and `runtime-probe-gate-alignment.tsv` so
+browser validation sees the same source-proof readiness, runtime readiness,
+required native proof, target, and disabled execution/promotion state as the
+Node inventory.
+The browser smoke also cross-checks `native-runtime-probe-execution-plan.tsv`,
+`native-runtime-probe-pass-evidence-contract.tsv`,
+`runtime-boundary-host-preflight.tsv`,
+`runtime-boundary-opt-in-probe-dispatch-plan.tsv`, and
+`runtime-boundary-opt-in-probe-skip-evidence-contract.tsv`, keeping the
+current host-blocked probe status, missing requirements, opt-in command,
+evidence status, and disabled execution/promotion state aligned.
+It also checks the host requirement summary and unblock plan against family
+host-readiness and preflight rows, including unavailable requirement
+ownership, available prerequisite ownership, opt-in environment variables, and
+execution command traceability.
+It also cross-checks `runtime-boundary-host-readiness-rollup.tsv`,
+`runtime-boundary-opt-in-probe-dispatch-rollup.tsv`, and
+`runtime-boundary-opt-in-probe-skip-evidence-rollup.tsv` for family/probe
+counts, blocked families, missing requirements, blocked opt-in commands,
+host/dispatch/evidence status, and disabled execution/promotion parity.
 `native-proof-alignment-summary.tsv` aligns native source proof rows with the
 generated worklist and native proof gates for user-M, tool DB, and Python
 runtime blockers. It is proof-consumption accounting only and keeps execution

wasm-port/docs/full-process-boundary-design.md

@@ -487,6 +487,78 @@ this phase. It combines the worklist, native/Node/browser proof gates, and
 runtime alignment summary so every blocked target has `lock_active=1` until a
 LinuxCNC-owned runtime boundary replaces the pending gates.
 
+## Host Preflight Runbook
+
+The blocked runtime probes are manual opt-in probes. They must not be run just
+because the probe script exists. A future host must first pass the generated
+preflight and dispatch checks for the specific blocked family.
+
+Before attempting any opt-in probe, inspect:
+
+```bash
+wasm-port/tests/wasm/node/verify_sim_configs_inventory_wasm.sh
+cat wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-preflight.tsv
+cat wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-family-host-readiness.tsv
+cat wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-readiness-rollup.tsv
+cat wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-plan.tsv
+cat wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-rollup.tsv
+cat wasm-port/build/wasm/sim-configs-inventory/native-runtime-probe-execution-plan.tsv
+cat wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-native-evidence-acceptance-gate.tsv
+cat wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-promotion-blockers.tsv
+```
+
+The current host is not ready for any blocked runtime opt-in probe. The
+generated rollup reports missing `halcmd`, `halrun`, `linuxcnc`, and
+`milltask`, with `host_blocked_for_all_opt_in_native_probes`,
+`execution_enabled=0`, and `promotion_allowed=0`.
+
+The opt-in commands remain forbidden while their dispatch rows have
+`dispatch_allowed=0`:
+
+```bash
+ENABLE_MILLTURN_USER_M_RUNTIME_PROBE=1 bash wasm-port/tests/native/probe_millturn_user_m_runtime.sh
+ENABLE_TOOL_DB_RUNTIME_PROBE=1 bash wasm-port/tests/native/probe_tool_db_runtime.sh
+ENABLE_PYTHON_REMAP_RUNTIME_PROBE=1 bash wasm-port/tests/native/probe_python_remap_runtime.sh
+```
+
+A probe may be attempted only when all of these are true for that family:
+
+- the corresponding runtime probe gate reports `runtime_ready=1`;
+- `runtime-boundary-family-host-readiness.tsv` reports the family ready;
+- `runtime-boundary-opt-in-probe-dispatch-plan.tsv` reports
+  `dispatch_allowed=1`;
+- `runtime-boundary-opt-in-probe-dispatch-rollup.tsv` does not block that
+  command;
+- the probe is run manually with its explicit `ENABLE_*_RUNTIME_PROBE=1`
+  environment variable.
+
+Passing a native opt-in probe is not promotion. After a native pass, the row
+must still satisfy:
+
+- `native-runtime-probe-pass-evidence-contract.tsv`;
+- `runtime-probe-gate-alignment.tsv`;
+- `runtime-boundary-promotion-readiness.tsv`;
+- `runtime-boundary-post-native-pass-gates.tsv`;
+- `runtime-boundary-native-evidence-acceptance-gate.tsv`;
+- `runtime-boundary-promotion-blockers.tsv`;
+- Node inventory proof;
+- browser smoke proof where applicable;
+- manual update of `blocked-runtime-promotion-lock.tsv`;
+- documentation updates in this file, `compatibility-validation.md`, and
+  `sim-configs-coverage-matrix.md`.
+
+While the skip/evidence artifacts report
+`skip_valid_until_host_requirements_available` and
+`no_native_pass_evidence_accepted_while_host_blocked`, skipped probes provide
+no native pass evidence. They only prove that the current host is correctly
+blocked.
+
+`native-runtime-probe-execution-plan.tsv` and
+`next-boundary-recommendations.tsv` are planning handoffs, not permission to
+run probes. They name the next recommended boundary work and exact opt-in
+commands, but the host preflight and dispatch rows still decide whether those
+commands are allowed on the current machine.
+
 The first two priorities are the current designed-but-disabled full-process
 blocks:
 

wasm-port/docs/sim-configs-coverage-matrix.md

@@ -36,6 +36,8 @@ Current baseline:
   `wasm-port/build/wasm/sim-configs-inventory/tool-db-process-boundary-summary.tsv`
 - Node tool DB process transaction contract artifact:
   `wasm-port/build/wasm/sim-configs-inventory/tool-db-process-transaction-plan.tsv`
+- Node tool DB native runtime probe gate artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/tool-db-process-native-runtime-probe-gate.tsv`
 - Node Python-remap boundary inventory artifact:
   `wasm-port/build/wasm/sim-configs-inventory/python-remap-boundary-summary.tsv`
 - Node Python-remap family inventory artifact:
@@ -44,6 +46,8 @@ Current baseline:
   `wasm-port/build/wasm/sim-configs-inventory/python-remap-runtime-contract.tsv`
 - Node Python-remap native runtime readiness artifact:
   `wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-readiness.tsv`
+- Node Python-remap native runtime probe gate artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-probe-gate.tsv`
 - Node Python-remap native runtime state-plan artifact:
   `wasm-port/build/wasm/sim-configs-inventory/python-remap-native-runtime-state-plan.tsv`
 - Node Python-remap native runtime fixture-plan artifact:
@@ -52,8 +56,34 @@ Current baseline:
   `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-contract-summary.tsv`
 - Node boundary-phase completion artifact:
   `wasm-port/build/wasm/sim-configs-inventory/boundary-phase-completion-summary.tsv`
+- Node native runtime probe execution-plan artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/native-runtime-probe-execution-plan.tsv`
 - Node next-boundary worklist artifact:
   `wasm-port/build/wasm/sim-configs-inventory/next-boundary-worklist.tsv`
+- Node next-boundary recommendation artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/next-boundary-recommendations.tsv`
+- Node native evidence acceptance gate artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-native-evidence-acceptance-gate.tsv`
+- Node promotion blocker summary artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-promotion-blockers.tsv`
+- Node blocked-runtime host preflight artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-preflight.tsv`
+- Node blocked-runtime host requirement summary artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-requirement-summary.tsv`
+- Node blocked-runtime host unblock plan artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-unblock-plan.tsv`
+- Node blocked-runtime family host readiness artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-family-host-readiness.tsv`
+- Node blocked-runtime aggregate host readiness artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-host-readiness-rollup.tsv`
+- Node blocked-runtime opt-in probe dispatch plan artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-plan.tsv`
+- Node blocked-runtime opt-in probe dispatch rollup artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-rollup.tsv`
+- Node blocked-runtime opt-in probe skip/evidence contract artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-contract.tsv`
+- Node blocked-runtime opt-in probe skip/evidence rollup artifact:
+  `wasm-port/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-rollup.tsv`
 - Current Node inventory: `executed 28`, `passed 28`, `skipped 131`,
   `unexpected_fail 0`
 - Current Node skip/block counts: `ASSET-ONLY 65`, `L4-PYTHON-REMAP 53`,
@@ -160,6 +190,10 @@ Legend:
   `ENABLE_TOOL_DB_RUNTIME_PROBE=1` proves the LinuxCNC-owned `DB_PROGRAM`
   `v2.1`/`g`/`p`/`l`/`u` protocol, nonrandom state updates, and flat-file
   persistence.
+- `tool-db-process-native-runtime-probe-gate.tsv`: the execution gate for the
+  guarded native DB process protocol probe. It combines source proof and host
+  readiness, records missing runtime requirements, and keeps the DB boundary
+  non-executing and non-promotable until the manual opt-in probe is allowed.
 - `python-remap-boundary-summary.tsv`: one row for each `L4-PYTHON-REMAP`
   path. It records Python modules, remap/prolog/epilog functions, NGC-only
   subpaths, HAL/UI/HALUI assumptions, the LinuxCNC Python owner set, LinuxCNC
@@ -179,6 +213,11 @@ Legend:
   `linuxcnc`, LinuxCNC's Python interpreter/plugin owner source files, and the
   configured Python modules for each blocked family, while keeping every row
   pending, non-executing, and non-promotable.
+- `python-remap-native-runtime-probe-gate.tsv`: the execution gate for the
+  selected Python remap lifecycle fixture. It combines source proof and host
+  readiness, records missing runtime requirements, and keeps Python remap
+  execution blocked until the LinuxCNC host runtime and dispatch gate allow a
+  manual opt-in probe.
 - `python-remap-native-runtime-state-plan.tsv`: one row per blocked
   Python-remap family. It records the runtime phases, modules, callables,
   NGC-only subpaths, process assumptions, readiness counts, source-alignment
@@ -208,7 +247,68 @@ Legend:
   LinuxCNC-owned runtime proof fields for user-M, tool DB, and Python runtime
   blockers. When native source proof is available, it also requires that proof
   to be consumed by generated worklist/native proof-gate rows without enabling
-  execution or promotion.
+  execution or promotion. It also records WASM sim-config inventory artifact
+  documentation coverage and native generated TSV documentation coverage as
+  explicit completion criteria. It also records the blocked runtime
+  worklist/recommendation consistency guard, the blocked runtime promotion gate
+  consistency guard, the blocked runtime host requirement consistency guard,
+  the blocked runtime host/dispatch/skip-evidence rollup consistency guard, the
+  blocked runtime opt-in cross-artifact consistency guard, the native source
+  proof/runtime probe consistency guard, and the runtime family
+  contract/alignment consistency guard as explicit completion criteria. The
+  family contract/alignment check keeps the user-M, tool DB, and Python
+  contract/readiness/probe artifacts aligned with the aggregate runtime
+  contract and native-alignment summaries without enabling execution or
+  promotion.
+  Browser smoke mirrors this completion-summary criterion list and fails on
+  criterion drift, so browser-side validation sees the same boundary-phase
+  gate set as the Node inventory without executing blocked runtime probes.
+  It also checks selected completion-summary counts against the blocked-runtime
+  and family-specific artifact rows already loaded by browser smoke, so the
+  machine-readable completion summary cannot claim a different row count from
+  the visible gate artifacts.
+  The Node coverage gate also checks that browser smoke keeps the same
+  generated WASM/native artifact tokens, fixed-count guards, duplicate-free
+  guards, fetchability/header guards, documentation-missing guards, completion
+  count-parity guards, review-document fetches, and native skipped-artifact
+  empty allowance as the Node inventory gate.
+  It also checks that `runtime-boundary-contract-summary.tsv` and
+  `runtime-boundary-native-alignment-summary.tsv` agree on boundary kind,
+  runtime alignment artifact, alignment row count, and disabled execution and
+  promotion state.
+  It also cross-checks user-M, tool DB, and Python family-specific
+  contract/readiness/probe artifacts against `runtime-boundary-contract-summary.tsv`
+  so browser validation sees the same runtime-family contract alignment as
+  Node inventory without executing blocked runtime processes.
+  Browser smoke also cross-checks `native-proof-alignment-summary.tsv`,
+  `native-runtime-probe-summary.tsv`, and `runtime-probe-gate-alignment.tsv`
+  for source-proof readiness, runtime readiness, required native proof, target,
+  and disabled execution/promotion parity.
+  It also cross-checks the native runtime probe execution plan, pass evidence
+  contract, host preflight, dispatch plan, and skip-evidence contract so the
+  browser smoke sees the same host-blocked opt-in command, missing
+  requirements, evidence status, and disabled execution/promotion state as the
+  Node inventory.
+  It also cross-checks the host-readiness, dispatch, and skip-evidence rollups
+  for counts, blocked families, missing requirements, blocked commands,
+  host/dispatch/evidence status, and disabled execution/promotion parity.
+  It also cross-checks the promotion lock, promotion readiness, promotion
+  blockers, post-native-pass gates, native evidence acceptance gate, and pass
+  evidence contract so browser validation sees the same locked promotion state
+  as Node inventory.
+  It also cross-checks recommendations, execution plans, host preflight,
+  family readiness, dispatch plans, skip-evidence contracts, and evidence
+  acceptance gates so browser validation sees the same opt-in command, proof,
+  missing requirement, and disabled execution/promotion state as Node inventory.
+  It also checks recommendation artifact row counts against the generated
+  user-M probe-gate, tool DB probe-gate, and Python runtime-contract source
+  rows, so priority handoffs cannot drift from the visible source artifacts.
+  It also checks each recommendation primary artifact and source artifact list
+  against the generated WASM inventory artifact set, including duplicate
+  detection, primary-artifact traceability, and exact per-family source
+  artifact sets. The Node coverage gate also verifies that browser smoke passes
+  the `wasmArtifactNames` returned by artifact documentation coverage into this
+  recommendation source-artifact coverage check.
 - `native-proof-alignment-summary.tsv`: one row per native source proof class.
   It aligns the native source proof summary with generated worklist/native
   proof-gate consumers for user-M, tool DB, and Python runtime blockers.
@@ -217,6 +317,115 @@ Legend:
   LinuxCNC owner set and runtime owner evidence, records native, Node, and
   browser proof requirements, and names the next boundary-design action before
   any blocked family can be promoted.
+- `next-boundary-recommendations.tsv`: the generated priority queue for the
+  next blocked runtime-boundary work. It currently ranks millturn `M128/M129`
+  state proof, tool DB protocol proof, and Python remap lifecycle proof, while
+  preserving active promotion locks and disabled execution. The Node inventory
+  verifies exact per-family source artifact sets, duplicate-free source lists,
+  primary-artifact traceability, and generated artifact existence for each
+  recommendation.
+- `native-runtime-probe-execution-plan.tsv`: the guarded opt-in execution
+  plan for blocked runtime native probes. It records the exact command,
+  required native proof key, current runtime readiness, expected pass status,
+  missing requirements, gate alignment, and promotion prerequisites. It is not
+  a probe runner and does not promote rows.
+- `runtime-boundary-native-evidence-acceptance-gate.tsv`: one row per blocked
+  runtime family deciding whether native pass evidence may be accepted. While
+  probes are skipped for missing host requirements, evidence acceptance is
+  blocked and Node/browser gates remain blocked.
+- `runtime-boundary-promotion-blockers.tsv`: the expanded blocker summary for
+  non-ready promotions. Current rows record missing host runtime, native
+  probe not passed, native evidence not ready, Node/browser gates incomplete,
+  active promotion lock, and manual lock update required.
+- The Node inventory also performs a cross-artifact consistency guard across
+  the blocked runtime opt-in target set. The guard requires the
+  recommendations, execution plan, host preflight, family readiness, dispatch
+  plan, skip/evidence contract, native evidence acceptance gate, promotion
+  readiness, promotion blockers, and post-native-pass gates to agree on the
+  target, proof keys, opt-in command, missing host requirements, active
+  promotion lock, and disabled execution/promotion fields.
+- The Node inventory also checks documentation coverage for generated
+  sim-config inventory TSVs. Every artifact emitted under
+  `build/wasm/sim-configs-inventory/` must be referenced by the current
+  compatibility, matrix, or full-process boundary docs, so generated gate
+  artifacts cannot silently appear without review text. The generated WASM
+  inventory artifact list must remain the exact duplicate-free 54-entry
+  baseline, and every token plus the fixed-count, duplicate-free, and
+  fetchability guards must also be listed by browser smoke.
+- The same inventory check covers native generated TSV artifacts under
+  `build/native/` by relative path, including native source-proof,
+  runtime-probe, `nc_files`, and sim-config baseline artifacts. The native
+  generated TSV token list must remain the exact duplicate-free 8-token
+  baseline, and every token plus the fixed-count, duplicate-free, fetchability,
+  and empty-skipped allowance guards must also be listed by browser smoke.
+- Browser smoke mirrors this documentation coverage by fetching the current
+  compatibility, matrix, and full-process boundary docs and checking the
+  generated WASM inventory artifact names plus native TSV tokens against the
+  same completion-summary counts. The Node coverage gate also locks the two
+  documentation-coverage completion counts to the current `54` WASM inventory
+  artifacts and `8` native TSV artifacts. It verifies that browser smoke
+  executes the artifact documentation coverage helper, calls the completion
+  count-parity helper with the generated completion rows, fetches and joins the
+  exact compatibility, matrix, and full-process boundary review-document set
+  used for the missing-reference checks, requires those checks to iterate
+  `wasmArtifactNames` and `nativeArtifactTokens` against the joined
+  `documentationText`, fetches generated WASM TSVs by artifact name, fetches
+  native TSVs by relative artifact token, binds the documentation-coverage
+  completion counts to the returned `wasmArtifactNames` and
+  `nativeArtifactTokens` arrays, and keeps completion evidence reviewable when
+  browser-side count parity is checked. Browser smoke also requires a
+  non-empty TSV header, duplicate-free expected lists, and fixed artifact/token
+  counts. This is
+  documentation/artifact fetchability parity only and does not execute blocked
+  runtime probes. The native
+  `build/native/sim-configs/skipped.tsv` artifact may be empty when the native
+  strict sim-config baseline has no skipped rows.
+- The Node inventory also checks native source proof consistency. Native
+  source proof alignment rows, the native runtime probe summary, and runtime
+  probe gate alignment must cover the same blocked classes, agree that source
+  proof is ready, and keep execution and promotion disabled.
+- `runtime-boundary-host-preflight.tsv`: the host-facing preflight for the
+  guarded blocked-runtime native probes. It records each blocked family,
+  required host/runtime commands, opt-in environment variable, exact native
+  probe command, current probe status, and keeps execution and promotion
+  disabled. It does not run the probes.
+- `runtime-boundary-host-requirement-summary.tsv`: a normalized requirement
+  table for the blocked runtime probes. It records each required host command
+  or source/module, its availability, affected blocked families, affected
+  opt-in probe environment variables, and whether the missing requirement
+  currently blocks execution.
+- `runtime-boundary-host-unblock-plan.tsv`: the filtered plan for unavailable
+  host requirements. It records the affected blocked families, affected
+  opt-in commands, and remaining missing requirements after each single
+  requirement is provided. It is advisory only and does not install anything
+  or allow promotion.
+- `runtime-boundary-family-host-readiness.tsv`: one host-readiness row per
+  blocked runtime family. It records missing requirements, available
+  prerequisites, the opt-in command, current probe/preflight status, and keeps
+  `execution_enabled=0` and `promotion_allowed=0`.
+- Browser smoke cross-checks the host requirement summary, unblock plan,
+  family host readiness, and host preflight rows. The check verifies
+  unavailable requirement ownership, available prerequisite ownership,
+  affected opt-in environments, and exact probe command traceability while
+  remaining non-executing and non-promoting.
+- `runtime-boundary-host-readiness-rollup.tsv`: the aggregate host-readiness
+  decision for all blocked runtime families. On this host it records zero
+  ready families, missing `halcmd`, `halrun`, `linuxcnc`, and `milltask`, and
+  `host_blocked_for_all_opt_in_native_probes`.
+- `runtime-boundary-opt-in-probe-dispatch-plan.tsv`: one dispatch row per
+  guarded native runtime probe. It turns host readiness into a dispatch action
+  and remains non-promoting; a dispatchable row only means the manual opt-in
+  native probe may be attempted on a ready host.
+- `runtime-boundary-opt-in-probe-dispatch-rollup.tsv`: the aggregate dispatch
+  switch for blocked runtime probes. Current rows are blocked for missing host
+  requirements, so no opt-in native probe is dispatchable on this host.
+- `runtime-boundary-opt-in-probe-skip-evidence-contract.tsv`: the per-probe
+  skip/evidence contract. It records the skip reason, missing host
+  requirements, current probe status, whether native pass evidence is required
+  now, and keeps every skipped probe non-executing and non-promoting.
+- `runtime-boundary-opt-in-probe-skip-evidence-rollup.tsv`: the aggregate
+  evidence decision for skipped opt-in probes. While all probes are skipped for
+  missing host requirements, no native pass evidence is accepted.
 
 ## Summary
 

wasm-port/tests/browser/verify_interp_browser.sh

@@ -9,6 +9,9 @@ INI_BOUNDARY_SUMMARY="$ROOT_DIR/build/wasm/sim-configs-inventory/ini-boundary-su
 NATIVE_PROOF_ALIGNMENT_SUMMARY="$ROOT_DIR/build/wasm/sim-configs-inventory/native-proof-alignment-summary.tsv"
 NATIVE_RUNTIME_PROBE_SUMMARY="$ROOT_DIR/build/wasm/sim-configs-inventory/native-runtime-probe-summary.tsv"
 RUNTIME_BOUNDARY_NATIVE_ALIGNMENT_SUMMARY="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-native-alignment-summary.tsv"
+RUNTIME_PROBE_GATE_ALIGNMENT="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-probe-gate-alignment.tsv"
+NATIVE_RUNTIME_PROBE_EXECUTION_PLAN="$ROOT_DIR/build/wasm/sim-configs-inventory/native-runtime-probe-execution-plan.tsv"
+NATIVE_RUNTIME_PROBE_PASS_EVIDENCE_CONTRACT="$ROOT_DIR/build/wasm/sim-configs-inventory/native-runtime-probe-pass-evidence-contract.tsv"
 RUNTIME_BOUNDARY_CONTRACT_SUMMARY="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-contract-summary.tsv"
 USER_M_PROCESS_NATIVE_STATE_ALIGNMENT="$ROOT_DIR/build/wasm/sim-configs-inventory/user-m-process-native-state-alignment.tsv"
 USER_M_PROCESS_NATIVE_TRANSITION_ALIGNMENT="$ROOT_DIR/build/wasm/sim-configs-inventory/user-m-process-native-transition-alignment.tsv"
@@ -18,14 +21,30 @@ USER_M_PROCESS_NATIVE_RUNTIME_PROBE_GATE="$ROOT_DIR/build/wasm/sim-configs-inven
 USER_M_PROCESS_TRANSITION_PLAN="$ROOT_DIR/build/wasm/sim-configs-inventory/user-m-process-transition-plan.tsv"
 TOOL_DB_PROCESS_NATIVE_PROTOCOL_ALIGNMENT="$ROOT_DIR/build/wasm/sim-configs-inventory/tool-db-process-native-protocol-alignment.tsv"
 TOOL_DB_PROCESS_NATIVE_RUNTIME_READINESS="$ROOT_DIR/build/wasm/sim-configs-inventory/tool-db-process-native-runtime-readiness.tsv"
+TOOL_DB_PROCESS_NATIVE_RUNTIME_PROBE_GATE="$ROOT_DIR/build/wasm/sim-configs-inventory/tool-db-process-native-runtime-probe-gate.tsv"
 TOOL_DB_PROCESS_TRANSACTION_PLAN="$ROOT_DIR/build/wasm/sim-configs-inventory/tool-db-process-transaction-plan.tsv"
 PYTHON_REMAP_NATIVE_RUNTIME_ALIGNMENT="$ROOT_DIR/build/wasm/sim-configs-inventory/python-remap-native-runtime-alignment.tsv"
 PYTHON_REMAP_NATIVE_RUNTIME_READINESS="$ROOT_DIR/build/wasm/sim-configs-inventory/python-remap-native-runtime-readiness.tsv"
+PYTHON_REMAP_NATIVE_RUNTIME_PROBE_GATE="$ROOT_DIR/build/wasm/sim-configs-inventory/python-remap-native-runtime-probe-gate.tsv"
 PYTHON_REMAP_NATIVE_RUNTIME_STATE_PLAN="$ROOT_DIR/build/wasm/sim-configs-inventory/python-remap-native-runtime-state-plan.tsv"
 PYTHON_REMAP_NATIVE_RUNTIME_FIXTURE_PLAN="$ROOT_DIR/build/wasm/sim-configs-inventory/python-remap-native-runtime-fixture-plan.tsv"
 PYTHON_REMAP_RUNTIME_CONTRACT="$ROOT_DIR/build/wasm/sim-configs-inventory/python-remap-runtime-contract.tsv"
 BLOCKED_RUNTIME_PROMOTION_LOCK="$ROOT_DIR/build/wasm/sim-configs-inventory/blocked-runtime-promotion-lock.tsv"
+RUNTIME_BOUNDARY_PROMOTION_READINESS="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-promotion-readiness.tsv"
+RUNTIME_BOUNDARY_PROMOTION_BLOCKERS="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-promotion-blockers.tsv"
+RUNTIME_BOUNDARY_POST_NATIVE_PASS_GATES="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-post-native-pass-gates.tsv"
+RUNTIME_BOUNDARY_HOST_PREFLIGHT="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-host-preflight.tsv"
+RUNTIME_BOUNDARY_HOST_REQUIREMENT_SUMMARY="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-host-requirement-summary.tsv"
+RUNTIME_BOUNDARY_HOST_UNBLOCK_PLAN="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-host-unblock-plan.tsv"
+RUNTIME_BOUNDARY_FAMILY_HOST_READINESS="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-family-host-readiness.tsv"
+RUNTIME_BOUNDARY_HOST_READINESS_ROLLUP="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-host-readiness-rollup.tsv"
+RUNTIME_BOUNDARY_OPT_IN_PROBE_DISPATCH_PLAN="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-plan.tsv"
+RUNTIME_BOUNDARY_OPT_IN_PROBE_DISPATCH_ROLLUP="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-dispatch-rollup.tsv"
+RUNTIME_BOUNDARY_OPT_IN_PROBE_SKIP_EVIDENCE_CONTRACT="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-contract.tsv"
+RUNTIME_BOUNDARY_OPT_IN_PROBE_SKIP_EVIDENCE_ROLLUP="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-opt-in-probe-skip-evidence-rollup.tsv"
+RUNTIME_BOUNDARY_NATIVE_EVIDENCE_ACCEPTANCE_GATE="$ROOT_DIR/build/wasm/sim-configs-inventory/runtime-boundary-native-evidence-acceptance-gate.tsv"
 BOUNDARY_PHASE_COMPLETION_SUMMARY="$ROOT_DIR/build/wasm/sim-configs-inventory/boundary-phase-completion-summary.tsv"
+NEXT_BOUNDARY_WORKLIST="$ROOT_DIR/build/wasm/sim-configs-inventory/next-boundary-worklist.tsv"
 NEXT_BOUNDARY_RECOMMENDATIONS="$ROOT_DIR/build/wasm/sim-configs-inventory/next-boundary-recommendations.tsv"
 INVENTORY_SCRIPT="$ROOT_DIR/tests/wasm/node/verify_sim_configs_inventory_wasm.mjs"
 NATIVE_SOURCE_PROOF_SUMMARY="$ROOT_DIR/build/native/native-source-proof-summary.tsv"
@@ -49,6 +68,9 @@ for artifact in \
   "$INI_BOUNDARY_SUMMARY" \
   "$NATIVE_PROOF_ALIGNMENT_SUMMARY" \
   "$RUNTIME_BOUNDARY_NATIVE_ALIGNMENT_SUMMARY" \
+  "$RUNTIME_PROBE_GATE_ALIGNMENT" \
+  "$NATIVE_RUNTIME_PROBE_EXECUTION_PLAN" \
+  "$NATIVE_RUNTIME_PROBE_PASS_EVIDENCE_CONTRACT" \
   "$RUNTIME_BOUNDARY_CONTRACT_SUMMARY" \
   "$USER_M_PROCESS_NATIVE_STATE_ALIGNMENT" \
   "$USER_M_PROCESS_NATIVE_TRANSITION_ALIGNMENT" \
@@ -58,15 +80,31 @@ for artifact in \
   "$USER_M_PROCESS_TRANSITION_PLAN" \
   "$TOOL_DB_PROCESS_NATIVE_PROTOCOL_ALIGNMENT" \
   "$TOOL_DB_PROCESS_NATIVE_RUNTIME_READINESS" \
+  "$TOOL_DB_PROCESS_NATIVE_RUNTIME_PROBE_GATE" \
   "$TOOL_DB_PROCESS_TRANSACTION_PLAN" \
   "$PYTHON_REMAP_NATIVE_RUNTIME_ALIGNMENT" \
   "$PYTHON_REMAP_NATIVE_RUNTIME_READINESS" \
+  "$PYTHON_REMAP_NATIVE_RUNTIME_PROBE_GATE" \
   "$PYTHON_REMAP_NATIVE_RUNTIME_STATE_PLAN" \
   "$PYTHON_REMAP_NATIVE_RUNTIME_FIXTURE_PLAN" \
   "$PYTHON_REMAP_RUNTIME_CONTRACT" \
   "$NATIVE_RUNTIME_PROBE_SUMMARY" \
   "$BLOCKED_RUNTIME_PROMOTION_LOCK" \
+  "$RUNTIME_BOUNDARY_PROMOTION_READINESS" \
+  "$RUNTIME_BOUNDARY_PROMOTION_BLOCKERS" \
+  "$RUNTIME_BOUNDARY_POST_NATIVE_PASS_GATES" \
+  "$RUNTIME_BOUNDARY_HOST_PREFLIGHT" \
+  "$RUNTIME_BOUNDARY_HOST_REQUIREMENT_SUMMARY" \
+  "$RUNTIME_BOUNDARY_HOST_UNBLOCK_PLAN" \
+  "$RUNTIME_BOUNDARY_FAMILY_HOST_READINESS" \
+  "$RUNTIME_BOUNDARY_HOST_READINESS_ROLLUP" \
+  "$RUNTIME_BOUNDARY_OPT_IN_PROBE_DISPATCH_PLAN" \
+  "$RUNTIME_BOUNDARY_OPT_IN_PROBE_DISPATCH_ROLLUP" \
+  "$RUNTIME_BOUNDARY_OPT_IN_PROBE_SKIP_EVIDENCE_CONTRACT" \
+  "$RUNTIME_BOUNDARY_OPT_IN_PROBE_SKIP_EVIDENCE_ROLLUP" \
+  "$RUNTIME_BOUNDARY_NATIVE_EVIDENCE_ACCEPTANCE_GATE" \
   "$BOUNDARY_PHASE_COMPLETION_SUMMARY" \
+  "$NEXT_BOUNDARY_WORKLIST" \
   "$NEXT_BOUNDARY_RECOMMENDATIONS"; do
   if [[ ! -f "$artifact" || "$INVENTORY_SCRIPT" -nt "$artifact" ]]; then
     INVENTORY_REQUIRED=1
@@ -78,6 +116,54 @@ fi
 if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$NATIVE_RUNTIME_PROBE_SUMMARY" ]]; then
   INVENTORY_REQUIRED=1
 fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_PROBE_GATE_ALIGNMENT" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$NATIVE_RUNTIME_PROBE_EXECUTION_PLAN" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$NATIVE_RUNTIME_PROBE_PASS_EVIDENCE_CONTRACT" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_PROMOTION_READINESS" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_PROMOTION_BLOCKERS" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_POST_NATIVE_PASS_GATES" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_HOST_PREFLIGHT" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_HOST_REQUIREMENT_SUMMARY" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_HOST_UNBLOCK_PLAN" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_FAMILY_HOST_READINESS" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_HOST_READINESS_ROLLUP" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_OPT_IN_PROBE_DISPATCH_PLAN" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_OPT_IN_PROBE_DISPATCH_ROLLUP" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_OPT_IN_PROBE_SKIP_EVIDENCE_CONTRACT" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_OPT_IN_PROBE_SKIP_EVIDENCE_ROLLUP" ]]; then
+  INVENTORY_REQUIRED=1
+fi
+if [[ -f "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" && "$NATIVE_RUNTIME_PROBE_SOURCE_SUMMARY" -nt "$RUNTIME_BOUNDARY_NATIVE_EVIDENCE_ACCEPTANCE_GATE" ]]; then
+  INVENTORY_REQUIRED=1
+fi
 if [[ "$INVENTORY_REQUIRED" == "1" ]]; then
   SKIP_INTERP_BUILD=1 "$ROOT_DIR/tests/wasm/node/verify_sim_configs_inventory_wasm.sh"
 fi

wasm-port/tests/native/probe_millturn_user_m_runtime.sh

@@ -77,11 +77,13 @@ print_kv millturn_user_m_promotion_allowed 0
 
 if [[ "$source_ready" != "1" ]]; then
   print_kv millturn_user_m_runtime_probe_status "blocked_missing_source"
+  print_kv millturn_user_m_runtime_probe_note "missing_source_requirements_keep_user_m_process_blocked"
   exit 0
 fi
 
 if [[ "$runtime_ready" != "1" ]]; then
   print_kv millturn_user_m_runtime_probe_status "skipped_missing_host_runtime"
+  print_kv millturn_user_m_runtime_probe_note "missing_host_runtime_requirements_keep_user_m_process_blocked"
   exit 0
 fi
 

wasm-port/tests/native/probe_python_remap_runtime.sh

@@ -75,11 +75,13 @@ print_kv python_remap_promotion_allowed 0
 
 if [[ "$source_ready" != "1" ]]; then
   print_kv python_remap_runtime_probe_status "blocked_missing_source"
+  print_kv python_remap_runtime_probe_note "missing_source_requirements_keep_python_remap_blocked"
   exit 0
 fi
 
 if [[ "$runtime_ready" != "1" ]]; then
   print_kv python_remap_runtime_probe_status "skipped_missing_host_runtime"
+  print_kv python_remap_runtime_probe_note "missing_host_runtime_requirements_keep_python_remap_blocked"
   exit 0
 fi
 

wasm-port/tests/native/probe_tool_db_runtime.sh

@@ -74,11 +74,13 @@ print_kv tool_db_promotion_allowed 0
 
 if [[ "$source_ready" != "1" ]]; then
   print_kv tool_db_runtime_probe_status "blocked_missing_source"
+  print_kv tool_db_runtime_probe_note "missing_source_requirements_keep_tool_db_process_blocked"
   exit 0
 fi
 
 if [[ "$runtime_ready" != "1" ]]; then
   print_kv tool_db_runtime_probe_status "skipped_missing_host_runtime"
+  print_kv tool_db_runtime_probe_note "missing_host_runtime_requirements_keep_tool_db_process_blocked"
   exit 0
 fi
 

wasm-port/tests/native/verify_native_probes.sh

@@ -200,6 +200,8 @@ check_native_runtime_probe_summary_row() {
   local boundary_kind="$2"
   local target="$3"
   local runtime_probe="$4"
+  local expected_required_native_proof="$5"
+  local expected_opt_in_env="$6"
   local summary_file="$BUILD_DIR/native-runtime-probe-summary.tsv"
 
   local row
@@ -224,17 +226,28 @@ check_native_runtime_probe_summary_row() {
 
   local runtime_ready
   local source_proof_ready
+  local required_native_proof
+  local opt_in_env
   local probe_status
   local execution_enabled
   local promotion_allowed
   local missing_requirements
+  local probe_note
   local stdout_log
-  IFS=$'\t' read -r _ _ _ _ runtime_ready source_proof_ready probe_status execution_enabled promotion_allowed missing_requirements stdout_log <<< "$row"
+  IFS=$'\t' read -r _ _ _ _ required_native_proof opt_in_env runtime_ready source_proof_ready probe_status execution_enabled promotion_allowed missing_requirements probe_note stdout_log <<< "$row"
 
   if [[ "$source_proof_ready" != "1" ]]; then
     echo "$target runtime probe lacks source proof readiness: $source_proof_ready" >&2
     exit 1
   fi
+  if [[ "$required_native_proof" != "$expected_required_native_proof" ]]; then
+    echo "$target runtime probe required native proof drift: $required_native_proof" >&2
+    exit 1
+  fi
+  if [[ "$opt_in_env" != "$expected_opt_in_env" ]]; then
+    echo "$target runtime probe opt-in env drift: $opt_in_env" >&2
+    exit 1
+  fi
   if [[ "$execution_enabled" != "0" || "$promotion_allowed" != "0" ]]; then
     echo "$target runtime probe unexpectedly enables execution or promotion" >&2
     exit 1
@@ -247,10 +260,26 @@ check_native_runtime_probe_summary_row() {
     echo "$target runtime probe is not ready but did not skip: $probe_status" >&2
     exit 1
   fi
+  if [[ "$runtime_ready" == "0" && "$probe_note" != *"missing_host_runtime"* ]]; then
+    echo "$target runtime probe missing-runtime note drift: $probe_note" >&2
+    exit 1
+  fi
   if [[ "$runtime_ready" == "1" && "$missing_requirements" != "-" ]]; then
     echo "$target runtime probe is ready but lists missing requirements: $missing_requirements" >&2
     exit 1
   fi
+  if [[ "$probe_status" == "ready_disabled_by_default" && "$probe_note" != *"set_${opt_in_env%%=*}"* ]]; then
+    echo "$target runtime probe ready-disabled note drift: $probe_note" >&2
+    exit 1
+  fi
+  if [[ "$probe_status" == runtime_*_passed && "$probe_note" != *"without_promotion"* ]]; then
+    echo "$target runtime probe passed note drift: $probe_note" >&2
+    exit 1
+  fi
+  if [[ "$probe_note" == "-" || -z "$probe_note" ]]; then
+    echo "$target runtime probe lacks note" >&2
+    exit 1
+  fi
   if [[ ! -f "$BUILD_DIR/$stdout_log" ]]; then
     echo "$target runtime summary references missing stdout log: $stdout_log" >&2
     exit 1
@@ -266,7 +295,7 @@ check_native_runtime_probe_summary() {
   fi
 
   local expected_header
-  expected_header=$'boundary_class\tboundary_kind\ttarget\truntime_probe\truntime_ready\tsource_proof_ready\tprobe_status\texecution_enabled\tpromotion_allowed\tmissing_requirements\tstdout_log'
+  expected_header=$'boundary_class\tboundary_kind\ttarget\truntime_probe\trequired_native_proof\topt_in_env\truntime_ready\tsource_proof_ready\tprobe_status\texecution_enabled\tpromotion_allowed\tmissing_requirements\tprobe_note\tstdout_log'
   if [[ "$(sed -n '1p' "$summary_file")" != "$expected_header" ]]; then
     echo "native runtime probe summary header drift: $summary_file" >&2
     exit 1
@@ -283,17 +312,23 @@ check_native_runtime_probe_summary() {
     L4-USER-M-PROCESS \
     external_user_m_process \
     axis/vismach/millturn/example.ngc \
-    linuxcnc_millturn_user_m_runtime_probe
+    linuxcnc_millturn_user_m_runtime_probe \
+    native_runtime_state_probe_required \
+    ENABLE_MILLTURN_USER_M_RUNTIME_PROBE=1
   check_native_runtime_probe_summary_row \
     L4-TOOL-DB \
     tool_database_process \
     axis/db_demo/base.ngc \
-    linuxcnc_tool_db_runtime_probe
+    linuxcnc_tool_db_runtime_probe \
+    native_db_process_protocol_probe_required \
+    ENABLE_TOOL_DB_RUNTIME_PROBE=1
   check_native_runtime_probe_summary_row \
     L4-PYTHON-REMAP \
     python_runtime \
     axis/remap/stop-lookahead/nc_files \
-    linuxcnc_python_remap_runtime_probe
+    linuxcnc_python_remap_runtime_probe \
+    linuxcnc_python_runtime_lifecycle_probe_required \
+    ENABLE_PYTHON_REMAP_RUNTIME_PROBE=1
 }
 
 check_source_probe_coverage
@@ -609,6 +644,7 @@ grep -Fq "millturn_user_m_runtime_requirements=" "$MILLTURN_USER_M_RUNTIME_STDOU
 grep -Fq "millturn_user_m_source_proof_ready=1" "$MILLTURN_USER_M_RUNTIME_STDOUT"
 grep -Fq "millturn_user_m_execution_enabled=0" "$MILLTURN_USER_M_RUNTIME_STDOUT"
 grep -Fq "millturn_user_m_promotion_allowed=0" "$MILLTURN_USER_M_RUNTIME_STDOUT"
+grep -Fq "millturn_user_m_runtime_probe_note=" "$MILLTURN_USER_M_RUNTIME_STDOUT"
 if grep -Fq "millturn_user_m_runtime_ready=1" "$MILLTURN_USER_M_RUNTIME_STDOUT"; then
   grep -Eq "millturn_user_m_runtime_probe_status=(ready_disabled_by_default|runtime_state_probe_passed)" \
     "$MILLTURN_USER_M_RUNTIME_STDOUT"
@@ -648,6 +684,7 @@ grep -Fq "tool_db_runtime_requirements=" "$TOOL_DB_RUNTIME_STDOUT"
 grep -Fq "tool_db_source_proof_ready=1" "$TOOL_DB_RUNTIME_STDOUT"
 grep -Fq "tool_db_execution_enabled=0" "$TOOL_DB_RUNTIME_STDOUT"
 grep -Fq "tool_db_promotion_allowed=0" "$TOOL_DB_RUNTIME_STDOUT"
+grep -Fq "tool_db_runtime_probe_note=" "$TOOL_DB_RUNTIME_STDOUT"
 if grep -Fq "tool_db_runtime_ready=1" "$TOOL_DB_RUNTIME_STDOUT"; then
   grep -Eq "tool_db_runtime_probe_status=(ready_disabled_by_default|runtime_protocol_probe_passed)" \
     "$TOOL_DB_RUNTIME_STDOUT"
@@ -697,6 +734,7 @@ grep -Fq "python_remap_runtime_modules=axis/remap/stop-lookahead/python/remap.py
 grep -Fq "python_remap_source_proof_ready=1" "$PYTHON_REMAP_RUNTIME_STDOUT"
 grep -Fq "python_remap_execution_enabled=0" "$PYTHON_REMAP_RUNTIME_STDOUT"
 grep -Fq "python_remap_promotion_allowed=0" "$PYTHON_REMAP_RUNTIME_STDOUT"
+grep -Fq "python_remap_runtime_probe_note=" "$PYTHON_REMAP_RUNTIME_STDOUT"
 if grep -Fq "python_remap_runtime_ready=1" "$PYTHON_REMAP_RUNTIME_STDOUT"; then
   grep -Eq "python_remap_runtime_probe_status=(ready_disabled_by_default|runtime_lifecycle_probe_passed)" \
     "$PYTHON_REMAP_RUNTIME_STDOUT"

wasm-port/tests/opfs/node/verify_file_service.mjs

@@ -95,26 +95,126 @@ const storage = {
   getDirectory: async () => root,
 };
 
+function assertGcodeProgramStoragePath(filename, path) {
+  assert.equal(
+    path,
+    `linuxcnc/gcode/${filename}`,
+    `${filename} G-code OPFS path drift`,
+  );
+}
+
+function assertSessionSnapshotStoragePath(sessionId, path, filename = "snapshot.json") {
+  assert.equal(
+    path,
+    `linuxcnc/sessions/${sessionId}/${filename}`,
+    `${sessionId}/${filename} session snapshot OPFS path drift`,
+  );
+}
+
+function assertPreviewCacheStoragePath(cacheKey, path, filename = "preview.json") {
+  assert.equal(
+    path,
+    `linuxcnc/preview-cache/${cacheKey}/${filename}`,
+    `${cacheKey}/${filename} preview cache OPFS path drift`,
+  );
+}
+
+function assertMachineFileStoragePaths(machineId, paths) {
+  assert.deepEqual(
+    paths,
+    {
+      ini: `linuxcnc/machines/${machineId}/machine.ini`,
+      toolTable: `linuxcnc/machines/${machineId}/tool.tbl`,
+      parameters: `linuxcnc/machines/${machineId}/linuxcnc.var`,
+    },
+    `${machineId} machine file OPFS path drift`,
+  );
+}
+
+function assertParameterBridgePaths(
+  machineId,
+  result,
+  wasmPath,
+  filename = "linuxcnc.var",
+) {
+  assert.equal(
+    result.opfsPath,
+    `linuxcnc/machines/${machineId}/${filename}`,
+    `${machineId}/${filename} parameter bridge OPFS path drift`,
+  );
+  assert.equal(
+    result.wasmPath,
+    wasmPath,
+    `${machineId}/${filename} parameter bridge WASM path drift`,
+  );
+}
+
+function assertToolTableBridgePaths(
+  machineId,
+  result,
+  wasmPath,
+  filename = "tool.tbl",
+) {
+  assert.equal(
+    result.opfsPath,
+    `linuxcnc/machines/${machineId}/${filename}`,
+    `${machineId}/${filename} tool table bridge OPFS path drift`,
+  );
+  assert.equal(
+    result.wasmPath,
+    wasmPath,
+    `${machineId}/${filename} tool table bridge WASM path drift`,
+  );
+}
+
+function assertSessionBridgePaths(
+  machineId,
+  result,
+  {
+    iniWasmPath = "/work/machine.ini",
+    parameterWasmPath = "/work/linuxcnc.var",
+    toolTableWasmPath = "/work/tool.tbl",
+  } = {},
+) {
+  assert.equal(result.machineId, machineId, `${machineId} session machine id drift`);
+  assert.equal(
+    result.ini.opfsPath,
+    `linuxcnc/machines/${machineId}/machine.ini`,
+    `${machineId} session INI OPFS path drift`,
+  );
+  assert.equal(result.ini.wasmPath, iniWasmPath, `${machineId} session INI WASM path drift`);
+  assertParameterBridgePaths(machineId, result.parameters, parameterWasmPath);
+  assertToolTableBridgePaths(machineId, result.toolTable, toolTableWasmPath);
+}
+
 assert.equal(await getOpfsRoot(storage), root);
 
 assert.equal(normalizeOpfsPath("linuxcnc/machines/xyzab.ini"), "linuxcnc/machines/xyzab.ini");
 assert.equal(machineIniPath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/machine.ini");
 assert.equal(toolTablePath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/tool.tbl");
 assert.equal(parameterFilePath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/linuxcnc.var");
-assert.equal(gcodeProgramPath("fixture.ngc"), "linuxcnc/gcode/fixture.ngc");
-assert.equal(gcodeProgramPath("custom-fixture.ngc"), "linuxcnc/gcode/custom-fixture.ngc");
-assert.equal(previewCachePath("fixture"), "linuxcnc/preview-cache/fixture/preview.json");
-assert.equal(sessionSnapshotPath("session-1"), "linuxcnc/sessions/session-1/snapshot.json");
-assert.equal(
-  sessionSnapshotPath("session-1", "custom-snapshot.json"),
-  "linuxcnc/sessions/session-1/custom-snapshot.json",
+assertGcodeProgramStoragePath("fixture.ngc", gcodeProgramPath("fixture.ngc"));
+assertGcodeProgramStoragePath(
+  "custom-fixture.ngc",
+  gcodeProgramPath("custom-fixture.ngc"),
 );
-assert.deepEqual(defaultMachinePaths("xyzab-tdr"), {
-  ini: "linuxcnc/machines/xyzab-tdr/machine.ini",
-  toolTable: "linuxcnc/machines/xyzab-tdr/tool.tbl",
-  parameters: "linuxcnc/machines/xyzab-tdr/linuxcnc.var",
-});
-assert.deepEqual(machineFilePaths("xyzab-tdr"), defaultMachinePaths("xyzab-tdr"));
+assertPreviewCacheStoragePath("fixture", previewCachePath("fixture"));
+assertPreviewCacheStoragePath(
+  "fixture",
+  previewCachePath("fixture", "custom-preview.json"),
+  "custom-preview.json",
+);
+assertSessionSnapshotStoragePath(
+  "session-1",
+  sessionSnapshotPath("session-1"),
+);
+assertSessionSnapshotStoragePath(
+  "session-1",
+  sessionSnapshotPath("session-1", "custom-snapshot.json"),
+  "custom-snapshot.json",
+);
+assertMachineFileStoragePaths("xyzab-tdr", defaultMachinePaths("xyzab-tdr"));
+assertMachineFileStoragePaths("xyzab-tdr", machineFilePaths("xyzab-tdr"));
 
 const snapshotPayload = {
   files: {
@@ -171,6 +271,10 @@ await saveSessionSnapshot("session-1", snapshotPayload, {
   createdAt: "2026-06-08T00:00:00.000Z",
   metadata: { source: "node-smoke" },
 });
+assertSessionSnapshotStoragePath(
+  "session-1",
+  sessionSnapshotPath("session-1"),
+);
 assert.deepEqual(await loadSessionSnapshot("session-1", { storage }), snapshot);
 const customSnapshot = await saveSessionSnapshot("session-1", snapshotPayload, {
   storage,
@@ -178,6 +282,11 @@ const customSnapshot = await saveSessionSnapshot("session-1", snapshotPayload, {
   createdAt: "2026-06-08T00:00:00.000Z",
   metadata: { source: "node-smoke-custom" },
 });
+assertSessionSnapshotStoragePath(
+  "session-1",
+  sessionSnapshotPath("session-1", "custom-snapshot.json"),
+  "custom-snapshot.json",
+);
 assert.equal(
   customSnapshot.metadata.source,
   "node-smoke-custom",
@@ -200,14 +309,14 @@ assert.deepEqual(await loadMachineTextFiles("xyzab-tdr", { storage }), {
   toolTable: "T0 P0 ; no tool\nT2 P2 Z1.25 D0.25\n",
   parameters: "5161 0.0\n5162 0.0\n",
 });
-assert.equal(
+assertGcodeProgramStoragePath(
+  "fixture.ngc",
   await saveGcodeProgram("fixture.ngc", "G0 X0 Y0\nM2\n", { storage }),
-  "linuxcnc/gcode/fixture.ngc",
 );
 assert.equal(await loadGcodeProgram("fixture.ngc", { storage }), "G0 X0 Y0\nM2\n");
-assert.equal(
+assertGcodeProgramStoragePath(
+  "custom-fixture.ngc",
   await saveGcodeProgram("custom-fixture.ngc", "G1 X1 F10\nM2\n", { storage }),
-  "linuxcnc/gcode/custom-fixture.ngc",
 );
 assert.equal(await loadGcodeProgram("custom-fixture.ngc", { storage }), "G1 X1 F10\nM2\n");
 
@@ -316,6 +425,19 @@ assert.deepEqual(restoredParameters, {
   result: "restore_parameters=0\nrestore_path=/work/bridge.var\n",
 });
 assert.equal(bridgeFiles.get("/work/bridge.var"), "5161 0.0\n5162 0.0\n");
+assertParameterBridgePaths("xyzab-tdr", restoredParameters, "/work/bridge.var");
+
+const restoredDefaultParameters = await restoreMachineParametersFromOpfs(
+  bridgeInterp,
+  "xyzab-tdr",
+  { storage },
+);
+assertParameterBridgePaths("xyzab-tdr", restoredDefaultParameters, "/work/linuxcnc.var");
+assert.equal(
+  restoredDefaultParameters.result,
+  "restore_parameters=0\nrestore_path=/work/linuxcnc.var\n",
+);
+assert.equal(bridgeFiles.get("/work/linuxcnc.var"), "5161 0.0\n5162 0.0\n");
 
 const savedParameters = await saveMachineParametersToOpfs(
   bridgeInterp,
@@ -323,7 +445,7 @@ const savedParameters = await saveMachineParametersToOpfs(
   { 5161: 12.34, 5162: 56.78 },
   { storage, wasmPath: "/work/bridge.var" },
 );
-assert.equal(savedParameters.opfsPath, "linuxcnc/machines/xyzab-tdr/linuxcnc.var");
+assertParameterBridgePaths("xyzab-tdr", savedParameters, "/work/bridge.var");
 assert.equal(savedParameters.backupOpfsPath, "linuxcnc/machines/xyzab-tdr/linuxcnc.var.bak");
 assert.equal(savedParameters.result.includes("save_parameters=0"), true);
 assert.equal(
@@ -334,6 +456,18 @@ assert.equal(
   await loadTextFile("linuxcnc/machines/xyzab-tdr/linuxcnc.var.bak", storage),
   "5161 0.0\n5162 0.0\n",
 );
+const savedDefaultParameters = await saveMachineParametersToOpfs(
+  bridgeInterp,
+  "xyzab-tdr",
+  { 5161: 12.34 },
+  { storage },
+);
+assertParameterBridgePaths("xyzab-tdr", savedDefaultParameters, "/work/linuxcnc.var");
+assert.equal(
+  savedDefaultParameters.backupOpfsPath,
+  "linuxcnc/machines/xyzab-tdr/linuxcnc.var.bak",
+);
+assert.equal(savedDefaultParameters.result.includes("save_path=/work/linuxcnc.var"), true);
 
 const loadedToolTable = await loadMachineToolTableFromOpfs(
   bridgeInterp,
@@ -346,6 +480,19 @@ assert.deepEqual(loadedToolTable, {
   result: "tooldata_load=0\nload_tool_path=/work/bridge-tool.tbl\nrandom_toolchanger=0\n",
 });
 assert.equal(bridgeFiles.get("/work/bridge-tool.tbl"), "T0 P0 ; no tool\nT2 P2 Z1.25 D0.25\n");
+assertToolTableBridgePaths("xyzab-tdr", loadedToolTable, "/work/bridge-tool.tbl");
+
+const loadedDefaultToolTable = await loadMachineToolTableFromOpfs(
+  bridgeInterp,
+  "xyzab-tdr",
+  { storage },
+);
+assertToolTableBridgePaths("xyzab-tdr", loadedDefaultToolTable, "/work/tool.tbl");
+assert.equal(
+  loadedDefaultToolTable.result,
+  "tooldata_load=0\nload_tool_path=/work/tool.tbl\nrandom_toolchanger=0\n",
+);
+assert.equal(bridgeFiles.get("/work/tool.tbl"), "T0 P0 ; no tool\nT2 P2 Z1.25 D0.25\n");
 
 const loadedRandomToolTable = await loadMachineToolTableFromOpfs(
   bridgeInterp,
@@ -366,11 +513,19 @@ const savedToolTable = await saveMachineToolTableToOpfs(
 );
 assert.equal(savedToolTable.opfsPath, "linuxcnc/machines/xyzab-tdr/tool.tbl");
 assert.equal(savedToolTable.wasmPath, "/work/bridge-tool.tbl");
+assertToolTableBridgePaths("xyzab-tdr", savedToolTable, "/work/bridge-tool.tbl");
 assert.equal(savedToolTable.result.includes("tooldata_save=0"), true);
 assert.equal(
   await loadTextFile("linuxcnc/machines/xyzab-tdr/tool.tbl", storage),
   "T2   P2   Z+1.250000 D+0.250000 ;loaded by LinuxCNC\n",
 );
+const savedDefaultToolTable = await saveMachineToolTableToOpfs(
+  bridgeInterp,
+  "xyzab-tdr",
+  { storage },
+);
+assertToolTableBridgePaths("xyzab-tdr", savedDefaultToolTable, "/work/tool.tbl");
+assert.equal(savedDefaultToolTable.result.includes("save_tool_path=/work/tool.tbl"), true);
 
 const loadedSession = await loadMachineSessionFromOpfs(
   bridgeInterp,
@@ -399,6 +554,11 @@ assert.deepEqual(loadedSession, {
     result: "tooldata_load=0\nload_tool_path=/work/session-tool.tbl\nrandom_toolchanger=0\n",
   },
 });
+assertSessionBridgePaths("xyzab-tdr", loadedSession, {
+  iniWasmPath: "/work/session.ini",
+  parameterWasmPath: "/work/session.var",
+  toolTableWasmPath: "/work/session-tool.tbl",
+});
 assert.equal(bridgeFiles.get("/work/session.ini"), "[EMC]\nMACHINE = xyzab-tdr\n");
 assert.equal(bridgeFiles.get("/work/session.var"), "5161\t12.340000\n5162\t56.780000\n");
 assert.equal(
@@ -406,6 +566,19 @@ assert.equal(
   "T2   P2   Z+1.250000 D+0.250000 ;loaded by LinuxCNC\n",
 );
 
+const loadedDefaultSession = await loadMachineSessionFromOpfs(
+  bridgeInterp,
+  "xyzab-tdr",
+  { storage },
+);
+assertSessionBridgePaths("xyzab-tdr", loadedDefaultSession);
+assert.equal(bridgeFiles.get("/work/machine.ini"), "[EMC]\nMACHINE = xyzab-tdr\n");
+assert.equal(bridgeFiles.get("/work/linuxcnc.var"), "5161\t12.340000\n5162\t56.780000\n");
+assert.equal(
+  bridgeFiles.get("/work/tool.tbl"),
+  "T2   P2   Z+1.250000 D+0.250000 ;loaded by LinuxCNC\n",
+);
+
 const loadedRandomSession = await loadMachineSessionFromOpfs(
   bridgeInterp,
   "xyzab-tdr",
@@ -608,6 +781,10 @@ assert.throws(
   () => sessionSnapshotPath("session-1", "nested/snapshot.json"),
   /Invalid session snapshot filename/,
 );
+assert.throws(
+  () => previewCachePath("fixture", "nested/preview.json"),
+  /Invalid preview cache filename/,
+);
 assert.throws(
   () => gcodeProgramPath("../escape.ngc"),
   /Invalid G-code filename/,

wasm-port/tools/build_native_probes.sh

@@ -424,8 +424,10 @@ append_native_runtime_probe_summary_row() {
   local boundary_kind="$3"
   local target="$4"
   local runtime_probe="$5"
-  local prefix="$6"
-  local stdout_log="$7"
+  local required_native_proof="$6"
+  local opt_in_env="$7"
+  local prefix="$8"
+  local stdout_log="$9"
 
   local runtime_ready
   local source_proof_ready
@@ -433,41 +435,49 @@ append_native_runtime_probe_summary_row() {
   local execution_enabled
   local promotion_allowed
   local missing_requirements
+  local probe_note
   runtime_ready="$(stdout_value "$stdout_log" "${prefix}_runtime_ready")"
   source_proof_ready="$(stdout_value "$stdout_log" "${prefix}_source_proof_ready")"
   probe_status="$(stdout_value "$stdout_log" "${prefix}_runtime_probe_status")"
   execution_enabled="$(stdout_value "$stdout_log" "${prefix}_execution_enabled")"
   promotion_allowed="$(stdout_value "$stdout_log" "${prefix}_promotion_allowed")"
   missing_requirements="$(stdout_value "$stdout_log" "${prefix}_missing_requirements")"
+  probe_note="$(stdout_value "$stdout_log" "${prefix}_runtime_probe_note")"
 
-  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
     "$boundary_class" \
     "$boundary_kind" \
     "$target" \
     "$runtime_probe" \
+    "$required_native_proof" \
+    "$opt_in_env" \
     "$runtime_ready" \
     "$source_proof_ready" \
     "$probe_status" \
     "$execution_enabled" \
     "$promotion_allowed" \
     "${missing_requirements:-"-"}" \
+    "${probe_note:-"-"}" \
     "${stdout_log#"$BUILD_DIR"/}" >> "$tmp"
 }
 
 write_native_runtime_probe_summary() {
   local tmp
   tmp="$(mktemp)"
-  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
     boundary_class \
     boundary_kind \
     target \
     runtime_probe \
+    required_native_proof \
+    opt_in_env \
     runtime_ready \
     source_proof_ready \
     probe_status \
     execution_enabled \
     promotion_allowed \
     missing_requirements \
+    probe_note \
     stdout_log > "$tmp"
 
   append_native_runtime_probe_summary_row \
@@ -476,6 +486,8 @@ write_native_runtime_probe_summary() {
     external_user_m_process \
     axis/vismach/millturn/example.ngc \
     linuxcnc_millturn_user_m_runtime_probe \
+    native_runtime_state_probe_required \
+    ENABLE_MILLTURN_USER_M_RUNTIME_PROBE=1 \
     millturn_user_m \
     "$BUILD_DIR/linuxcnc_millturn_user_m_runtime_probe.run.stdout.log"
 
@@ -485,6 +497,8 @@ write_native_runtime_probe_summary() {
     tool_database_process \
     axis/db_demo/base.ngc \
     linuxcnc_tool_db_runtime_probe \
+    native_db_process_protocol_probe_required \
+    ENABLE_TOOL_DB_RUNTIME_PROBE=1 \
     tool_db \
     "$BUILD_DIR/linuxcnc_tool_db_runtime_probe.run.stdout.log"
 
@@ -494,6 +508,8 @@ write_native_runtime_probe_summary() {
     python_runtime \
     axis/remap/stop-lookahead/nc_files \
     linuxcnc_python_remap_runtime_probe \
+    linuxcnc_python_runtime_lifecycle_probe_required \
+    ENABLE_PYTHON_REMAP_RUNTIME_PROBE=1 \
     python_remap \
     "$BUILD_DIR/linuxcnc_python_remap_runtime_probe.run.stdout.log"