[GTrunSec]

The native build-projection consumer failed while expanding Core's generated POO import when gxtest initialized before the workspace package environment. Establish the SDK environment with gerbil env gxtest, retaining the existing runner, filters, error scanning, heap limit and watchdogs.

Migrate the consumer from removed Profile paths to the public compiled root and current flat Library target. Keep specification identity and changed-root refusal checks, and assert one canonical Config target. The separate actual root source build remains a required gate. English Org, D2 and source-bound SVG/PNG/lossless WebP receipts are synchronized.

Baseline validation before the subsequent cold controls (9841086), with natural exit and complete native markers:

• Root source build under 180 seconds; compiled build consumer and all six user configuration cases.
• All eight real C/C++ source-contract cases, including independent controls and actual CBMC/native execution.
• Actual native-owner C/C++ execution, ASCENT registration/query, downstream Profile extension, budget invalidation, history retention and C-only disable controls.
• Native package metadata and compiled public ABI checks.
• Six renderer example tests (104 assertions), REUSE 778/778, and matching source receipts with decoded PNG/WebP pixel equality.

Limits remain explicit: the native Core clean rebuild exceeded 180 seconds; successful incremental recovery is not cold-build acceptance. Complete cold dependency installation is still open. PR #9's macOS CI passed, while Linux failed Ubuntu mirror DNS resolution during Chromium dependency installation; neither establishes this new revision's remote CI. Per-process 2 GiB heaps, 120-second tests, 180-second builds and machine-derived compilation concurrency are unchanged. No dependency, assertion, native manifest or compatibility layer is removed or fabricated.

Follow-up to merged #9. This PR remains draft.

Qualification audit (9018785):

• Correct stale design-only/not-implemented statements in 10.147 and distinguish actual bounded C/C++ evidence, external authorization and whole-package qualification. Synchronize Org/D2 and regenerated SVG/PNG/lossless WebP receipts.
• Native Core diagnostic cold build with verbosity 2 exits 0 in 127.41 seconds; specifications finish at 20.30 seconds and native Make begins at 21.57. It generates 274 distinct targets and schedules 587 Gambit jobs; twelve gsc children were observed. This does not establish ordinary cold acceptance.
• The ordinary control starts after native clean and a zero-product inventory, but hits the unchanged 180-second watchdog and five-second termination grace (185.32 seconds, signal 9). A later ordinary root build also hits its deadline. These failures are retained.
• Instrumented recovery restores Core/root products. Subsequent genuine package metadata/compiled ABI checks and actual C/C++ native-owner execution with ASCENT support, budget invalidation, history retention and C-only disable pass. These are scoped consumer results, not ordinary cold-build acceptance.
• Current Core PR #19 is 188 commits ahead of the installed Core and selects a newer POO, while Parser PR #23 and ASCENT PR Align native POO Library declarations, functional projection and dependency ownership #1 still pin the older Core. Orgize PR #18 and Parent PR #34 also require their own dependency updates and qualification. No dependency pin was changed in this audit.
• Both Org files pass org-lint. Updated view receipts have 38 matching source bindings and decoded PNG/WebP equality. REUSE 778/778 passes. One renderer example run times out while native compilation overlaps; the unchanged full suite subsequently passes sequentially (6 tests, 104 assertions, 22.00 seconds). The failed run is retained; budgets are unchanged.
• On the prior head, macOS CI passes and Linux is cancelled during dependency installation. New-head remote checks remain separate. Shared-host load above thirty on twelve cores is recorded as context, not a proven sole cause or justification for changing workers/heaps.