# Installed native bridge diagnostic — attempt A stopped at its ownership guard

The approved fixed-200 diagnostic did **not complete**. One measured native
child started; it stopped during its first operation because the harness required
an identity keychain association that the installed .NET wrapper allows to be
absent. This is a diagnostic model error. There is no repeated native retention
result, no production mitigation or resource-budget decision, and no change to
#799's status.

The separate SDK 2.0.1 seed completed with the expected RSA leaf/key pair,
observed application manager disposal, and private fixture files. The measured C
child loaded the pinned native bridge, checked its export image and rejected CLR
and SDK images. The C build succeeded with six unsuppressed deprecation warnings
for the exercised public keychain APIs; the seed build reported zero warnings
and errors. This was macOS **26.5.2** build **25F84** arm64; installed managed
cryptography was .NET **10.0.14**. [The inspected design](NATIVE_IMPORT_DESIGN.md)
records the exact native/managed binary paths and ABI.

| Observation | Recorded result |
|---|---|
| Before snapshot | AppleDatabase **1 / 768 shallow bytes**; Mach RSS **7,815,168 bytes**; 3 numeric FDs |
| DER import, modern RSA creation, private keychain create/lock, external representation and legacy ephemeral import | All reached bridge calls succeeded |
| Move to private keychain | Bridge return **1**, OSStatus **0**; post-move certificate keychain copy returned a verified private association |
| Post-move identity keychain copy | Bridge-normalized OSStatus **0**, **no returned keychain reference** |
| Stop | Before identity certificate copy; its uncalled status is the `INT32_MIN` sentinel, not a native OSStatus |
| Error-path cleanup | **9** owned CF outputs / **9** releases; logical owners **0**; verified private keychain native delete OSStatus **0**; no fallback cleanup |
| Process and fixture | Native exit **1**, reported elapsed **1.172310 s**; both builds, seed and native process confirmed reaped; no remaining owned keychain files before collector cleanup; private task files overwritten and unlinked after reaping; root removed |

Only four JSONL rows exist: before fingerprint, before checkpoint, partial
operation 1, failure. No first/repeated/idle snapshot or after fingerprint was
collected. The before-only default/search query succeeded; equality across the
attempt was **not measured**. The measured child made no setter or restore call.
No estimate of native heap growth can be drawn from its single before sample.

## Why the guard did not match the installed wrapper

`SafeTemporaryKeychainHandle.TrackItem` obtains a copied keychain and returns
without adding a logical owner when the copied handle is invalid. The installed
native bridge `AppleCryptoNative_SecKeychainItemCopyKeychain` at `0x8a04` normalizes
`errSecNoSuchKeychain` (`-25294`) and `errSecInvalidItemRef` (`-25304`) to success;
the receipt records the bridge result, not the underlying raw Apple status. The
installed move wrapper validates the move result and identity handle; it does
not require the identity's `TrackItem` to add an owner. Attempt A incorrectly
made that association mandatory before identity certificate copy.

Any separately reviewed follow-up should model ownership from actual validated
associations: keep all nine expected native copy calls and their statuses; add a
logical owner only when the returned keychain matches the generated private
reference/path; record no association when it is null. Reject a disappearing
association during Untrack of a previously tracked owner. Record the actual
zero-owner deletion stage and which item/copy references remain alive, rather
than requiring deletion at identity Untrack. A single partial attempt cannot
predict the copied certificate's association or a fixed number of non-null
copies. This correction concerns the diagnostic only, not production SDK
ownership or certificate selection.

Selected receipts and verified raw/projection hashes are in
[`evidence/2026-11-10-native-import-attempt-a`](evidence/2026-11-10-native-import-attempt-a/verification.json).
The unchanged raw directory is `/tmp/opcua2-native-import-20261110a`. It contains
raw native snapshots but no retained private fixture. The native executable
SHA-256 is `e5c5caf2a8f882f82b738396156b378fd157ebd1a825d462449cd2a0497830fd`;
the seed DLL SHA-256 is
`1fa7de542aee11acab18dcc8d4096b21fcbc16e4edc1fca2243159dd1176adc0`.
This was a single serialized execution. No retry or counterfactual arm ran.