[vanedaltro]

The native datagram proof could classify a zero or short send as a permission refusal by reading stale errno after collapsing the return value to a boolean. Preserve the raw return and capture errno only after an actual -1 failure; require an attempted send plus -1/EACCES or -1/EPERM before counting refusal. Retain nullable raw-result diagnostics and preserve setup errors through cleanup.

Compile the shared send/result helpers in a deterministic fault-injection regression. Cover zero/short returns with stale errno, genuine permission failures, unknown errors, setup-before-send and first-failure preservation. A copied header with the old guards must execute and fail the named zero/stale-EPERM assertion. This verifier test is separate from the unchanged nine-row real IPC matrix, including concurrent host/private alias replacement; it cannot substitute for native acceptance.

The original Intel job at 3f7067d passed its nine primary IPC rows and correctly rejected the injected zero send, but its legacy comparison hit a separate real -1/EINVAL at an earlier unmodified row. Retain that failed source-bound evidence. The deterministic comparison removes that unrelated-race dependency; the native race cause remains unresolved, unknown errors still fail, and nothing is retried or reclassified for acceptance.

Validation at 62a3068:

• All eight exact native-signing workflow steps passed locally on macOS arm64, including the nine real IPC rows, native capability matrix, signature/exec controls and precise missing-grant/scope/rights/path controls.
• Six deterministic send-result cases passed; removing the guards executed and failed specifically on zero/stale-EPERM classification. Both source digests are retained.
• Actual fixture bytes independently matched all retained current report manifests.
• Strict OpenSpec: 114 passed, 0 failed. Spec lint: 0 errors, 25 warnings. Workflow YAML, shell/embedded Python syntax and diff whitespace checks passed.
• Fresh FileChanged platform workflow passed Linux/macOS/Windows at 3f7067d (run 41180219218); Rust sources/Cargo inputs are unchanged by this head.
• Hosted Intel/arm64 native signing jobs pass all eight steps at 62a3068 (run 41202794586). Both native report archives match GitHub digests; tested merge trees match the source head, and normal plus deterministic fixed/legacy source bytes were independently verified.
• All 55 configured checks passed on exact head 62a3068, including complete native Windows tests, metadata/migration controls, AppContainer launch/isolation, Rust macOS and all release-target builds. One historical staged-system diagnostic was intentionally skipped by its opt-in workflow condition.
• No additional Rust tests run locally for this probe-only correction.

This continues the single native admission workstream. Production native integration, Linux support/design review and parent acceptance tasks remain open.

Retained corrected native reports and verification bindings: source-bound evidence. They are retained on the upcoming Windows acceptance branch so recording evidence did not restart this head’s CI. The evidence commit changes no native or Rust implementation.