# Retained observations / Observaciones conservadas

This document describes historical measurements only. No socket/API experiment was repeated for this publication package. Times below are UTC unless explicitly described as an installation date. No timestamp has been reconstructed from file modification time.

## Evidence map

| Public artifact | Provenance | Transformation |
| --- | --- | --- |
| `minimal-repro/fixture_native_probe.py` | SRC-SYNTHETIC | Exact original bytes; no changes |
| `evidence/synthetic-observation.json` | OBS-SYNTHETIC | Exact original bytes; only synthetic data present |
| `evidence/earlier-synthetic-sanitized.json` | OBS-EARLIER-FIXTURE | Selected fields; CIM JSON parsed; creation epoch also expressed as UTC |
| `evidence/application-observation-sanitized.json` | OBS-APPLICATION + OBS-HEALTH-PRIVATE | Selected rows, stable aliases, no unrelated connections or raw DWORD arrays |
| `evidence/environment-sanitized.json` | OBS-IDENTITY-PRIVATE + OBS-RESULT-PRIVATE + OBS-ENVIRONMENT-PRIVATE | Allowlisted OS/update/file-version information; private fields excluded |
| `evidence/custody.json` | Original bytes and repository read-only checks | Original artifacts identified by aliases, size and SHA-256, not private paths |

An original artifact with PRIVATE in its alias is **not** included. Its hash is only a continuity aid for the owner of the retained original. A reader cannot reconstruct or independently verify unpublished original bytes from a hash alone. The previous retained manifest also matches the source and synthetic-output hashes below.

## Chronology and timestamp limits

| Time | Meaning | Scope |
| --- | --- | --- |
| 2026-11-04T14:49:52.553360+00:00 | Creation time of an earlier fixture process, converted from epoch 1793803792.5533602 | Synthetic; **not** the TCP-sampling time, which was not recorded |
| 2026-11-04T16:50:35.761625+00:00 | Start timestamp in the native observer record | Two pre-existing services and two diagnostic client sockets; no per-call timestamps |
| 2026-11-04T16:52:41.4771265Z | Timestamp in the environment/identity collection record | Selected OS data retained; private process details withheld |
| 2026-11-04T16:53:29.120209+00:00 | Timestamp created before the standalone fixture opens its listener | Main synthetic reproduction; no per-call timestamps |
| 2026-11-04T16:55:42.774581+00:00 | Timestamp in the report assembled after two health GETs | Separate later application observation, not simultaneous with native tables |

Windows 11 26H2/build 26300.9818 and KB5127936 present are retained environmental observations. The update's installation value was a date, 2026-10-28, with no timezone or installation-time precision. No local update-removal experiment exists in these records.

## Main standalone fixture: exact measurement

The program's PID was 39428. It requested `127.0.0.1:0`; Windows allocated listener port 6226 and client port 6227. These historical numbers are **not** parameters for future reproductions. The listening, client and accepted sockets belonged to this one synthetic process.

Independent socket evidence:

- `SO_EXCLUSIVEADDRUSE=1` was configured before bind.
- `listen(1)` returned and `getsockopt(SO_ACCEPTCONN)` returned **1**.
- The client connected, the program accepted it, and both fixed byte-string assertions passed.
- The listening socket's context remained open during all before/during captures.
- All three socket descriptors were closed after their contexts exited.

Each phase called, in order: GetTcpTable, GetTcpTable2, GetExtendedTcpTable class 3, GetExtendedTcpTable class 4. The API calls were sequential, and the three phases were sequential.

| Phase | API/class | Returned selected rows |
| --- | --- | --- |
| Before connection | GetTcpTable | listener state 0; no PID field |
| Before connection | GetTcpTable2 | listener state 0; PID 39428 |
| Before connection | Extended/class 3 | listener state 0; PID 39428 |
| Before connection | Extended/class 4 | empty |
| During connection | GetTcpTable | listener 0, server/client connected rows 5/5; no PID fields |
| During connection | GetTcpTable2 | listener 0, connected rows 5/5; all PID 39428 |
| During connection | Extended/class 3 | listener 0; PID 39428 |
| During connection | Extended/class 4 | connected rows 5/5; both PID 39428 |
| After closure | GetTcpTable | one residual row, state 1; no PID field |
| After closure | GetTcpTable2 | one residual row, state 1, PID 0 |
| After closure | Extended/class 3 | empty |
| After closure | Extended/class 4 | one residual row, state 11, PID 0 |

All 12 final API return codes were **0**. Code **122** for the initial null-buffer size query is enforced by the executed source, but not stored separately in the JSON. No per-query allocation sizes or retry counters were retained. The source permits three bounded buffer attempts; this is not an application retry. The after-closure 1/11 rows are not treated as anomalous: calls are sequential and closing entries may remain after handles close. PID 0 on such a row is not evidence of a foreign listener.

The fixture uses Python/ctypes declarations, not a compiled SDK executable. The exact standalone interpreter version was not recorded; the surrounding validation environment's version is separately qualified in `environment-sanitized.json`. No assertion is made that the fixture passed repeatedly or on other systems.

## State comparison

| Value | Contract / interpretation | What the retained evidence supports |
| --- | --- | --- |
| 2 | LISTEN | Expected for the demonstrably listening fixture; not returned for its listening row in this run |
| 5 | ESTABLISHED | Returned for both directions of the successful synthetic connection |
| 6 | FIN_WAIT_1 (MIB_TCP_STATE_FIN_WAIT1) | Seen in earlier synthetic CIM data and selected pre-existing service rows; not reclassified as LISTEN |
| 0 | No normal state meaning assigned by this report | Returned for the main synthetic listener; not confused with API success code 0 or CLOSED=1 |
| 1 / 11 | CLOSED / TIME_WAIT | Observed after synthetic closure; no further defect inferred |

[Microsoft's state documentation](https://learn.microsoft.com/en-us/windows/win32/api/tcpmib/ns-tcpmib-mib_tcprow2) and [SO_ACCEPTCONN documentation](https://learn.microsoft.com/en-us/windows/win32/winsock/sol-socket-socket-options) define the expected interpretation. A table's final return code 0 means the API call succeeded; a row's **state** 0 is a different field.

## Earlier synthetic record: contextual, not a second run of the attached source

The earlier HTTP fixture used ephemeral port 24713. Its record reports HTTP 200, CIM process exit 0 with empty stderr, state 6 for the zero-peer endpoint with the fixture PID, and another state-0 row with PID 0 and a peer. psutil reported FIN_WAIT1 for the zero-peer endpoint. Cleanup reports the fixture closed.

This observation is retained in parsed form but is not claimed to have used the attached standalone source. It has no precise sample timestamp or native API return-code log. CIM subprocess exit 0 must not be confused with an IP Helper return code. psutil/CIM may depend on common OS facilities.

## Pre-existing services: contextual, pseudonymized

No live service was contacted while preparing this package. The prior capture is labelled with SERVICE_A/B and DIAGNOSTIC_CLIENT_PROCESS; original ports, process IDs and application identity are not exported. Zero-peer rows in all three stages were:

| API/class | SERVICE_A state | SERVICE_B state |
| --- | --- | --- |
| Extended/class 3 | 0 | 6 |
| Extended/class 5 | 0 | 0 |
| GetTcpTable2 | 0 | 0 |

The intentionally opened client pairs are included for during_1/during_2. Class 4 reported state 5 for both directions. On the SERVICE_B client side, class 5/TCP2 reported 6/2 during_1 and 0/6 during_2. These are sequential samples. A Python client handle still being open is not proof that its TCP connection cannot be closing; no root-cause claim is based on these differences alone.

Later health GETs returned HTTP 200 from both services. Their timestamps and sanitization are explicit; neither Health nor process metadata proves exclusive listener ownership. The contextual observer only opened its own diagnostic clients and closed them. It did not execute inference or control application processes.

## Source continuity and limits

| Artifact | SHA-256 |
| --- | --- |
| Original/exact public standalone source | `b82894f6b4cef00d91d9ac75858e13203a8dbd653f32119e4a1bb7ef26da97b3` |
| Original/exact public synthetic JSON | `dc7118c76d7e1fc717216e225a3df77d24322b4569043b802e4de2198a5d0268` |

Current documentary checks compare those bytes with retained originals and the previous manifest. They do not run the source. No compiled witness, kernel trace, IPv6 test, clean-system test or update A/B test has been added. The responsible layer remains unproven; third-party reports are not local evidence of installed security drivers.