[atomicdeploy]

Scope

Fix opcode drift and unsafe cross-namespace admission without renumbering existing packets. Part of #41 and atomicdeploy/PCController#702; canonical source owner is atomicdeploy/PCController#704, paired consumer is ToghrolTP/pealayer#223.

• Generate C++/Rust/Dart/PowerShell bindings from the exact immutable canonical source pin. Offline build preflights reject modified sources or stale generated views; CI verifies the upstream bytes too.
• Keep Pakar A5/0 and native-controller A5/1 as fixed namespaces, not negotiated generations. Remove hand-maintained numeric client/provisioning tables. Unknown native response contracts are rejected before sending instead of assuming ACK.
• Preserve every published allocation. Canonical owner has independent published fixtures and protected-base evolution checks; additive unknown optional operations retain Unsupported semantics.
• Share the bounded serial owner in provisioning tools rather than loose duplicate ACK/decoder paths.
• Preserve existing transport/service distinctions, settings, drafts and production hardware. No board, installed app or network setting was changed.

Verification

• Flutter analysis and 14 USB transport tests pass.
• Compiled native namespace/response coverage: 2 tests pass. Broader native USB filter: 49 tests pass.
• Actual C++ framing rejects all 255 foreign markers and recovers to the next valid frame; published wire fixtures retained.
• Mock identity/network/RX provisioning tests pass without serial devices.
• Generated bindings and four immutable source files byte-verified against GitHub.
• Transport donor gate passes with zero stale mapped sources; pending comparisons remain pending.
• Broad protocol wrapper exposed an unchanged forward-declaration slicing bug in a demand-source fixture. The assertion was corrected, original privacy/demand assertions retained and scoped demand tests pass; the aborted wrapper is not claimed wholly green.
• Quality prefix passed until stale generated report metadata. Refreshed/reviewed that metadata and reran the failed report check plus remaining suffix separately; exact-head CI remains independent.

Not claimed

No deployment/hardware acceptance, complete transport feature parity, new payload interoperability, encryption or protection for older firmware not yet updated. No unrelated PRs or stashes removed.

[atomicdeploy]

Windows CI fixture fix pushed as 80ea74d: the polled loopback listener could pass non-blocking mode to accepted Winsock sockets. Explicit blocking mode is restored before bounded HTTP/WebSocket I/O in both affected fixtures. All hostname/Host-header, actual TCP route, identity and admission assertions remain unchanged; no production transport code changed. Peer-fence and file-comparison fixtures pass locally. Native execution was blocked before Cargo by live Pealayer inventory drift; no bypass or local native pass claimed. Exact-head Build run 41095384542 is the Windows execution gate. The fix is also merged normally into stacked PR #44.