# Standalone reproducer — exact historical source

`fixture_native_probe.py` is a byte-for-byte copy of the retained Python source that produced the main synthetic observation. No behavior, constant, path expression or output statement was changed for publication. It contains no user name, absolute private path, credential, application import, model reference or application configuration. It is not a newly invented or compiled reproducer.

- Historical source SHA-256: `b82894f6b4cef00d91d9ac75858e13203a8dbd653f32119e4a1bb7ef26da97b3`.
- Historical output: `../evidence/synthetic-observation.json` (exact retained bytes).
- Source/output hashes also match the previous retained evidence manifest.
- **Executions during this documentary task: 0.** The public destination has not been executed. Its empty `evidence/` subdirectory is prepared only for optional future manual use.

## Optional manual reproduction by a reviewer

These are instructions, not operations performed for this package. Use a fresh writable copy of this directory on Windows with standard Python 3 available. Preserve any prior output; the source intentionally refuses to overwrite its output file.

```powershell
# From the fresh minimal-repro directory; creates only the local output directory if needed.
New-Item -ItemType Directory -Path .\evidence -Force | Out-Null
python -I -B .\fixture_native_probe.py
```

Do not add `-O` or `-OO`: assertions are part of the historical source's checks. `-I` ignores Python environment settings. No package installation, application startup or model is required. The original run did not record its elevation level; do not infer a requirement for administrator privileges from this report.

The program binds **127.0.0.1, port 0**, so Windows chooses a new port. Do not configure the historical ports from the sample. The unchanged source rejects two reserved port constants before listening if either happens to be allocated. It uses one listener, one client and one accepted socket, exchanges only two fixed fictional strings, then closes its own sockets. It neither stops nor adopts other processes, changes system settings, nor connects to an external address.

Expected output location: `evidence/fixture-native-probe.json`. A normal table would report state 2 for the listening endpoint; the retained anomalous run reports 0 before and during a successful exchange. Both connected directions reported 5. Final data-call success is code 0 and is distinct from row state 0. The source reports observations rather than asserting that the anomaly must occur on every machine.

## Known scope and measurement limitations

- The API returns a machine-wide IPv4 table in memory. The historical source exports rows whose local **or remote port** matches the fixture's allocated port. It does **not** filter export by process ID or require every row to be loopback. An unrelated connection with a coincidentally matching port could therefore appear in a future output. Review and sanitize any newly generated output before sharing. The supplied historical JSON has been checked: all nonzero-address endpoints are loopback, and all nonzero PIDs are the fixture's own PID.
- This is handwritten Python/ctypes layout decoding, not a compiled SDK verifier. Header offset and row strides are visible in the source. No new compiled validation was performed.
- A single timestamp is recorded before socket creation. There are no per-API timestamps, exact interpreter metadata, raw table buffers or allocation retry counts in the historical JSON.
- Initial size-query code 122 is asserted. Data retrieval allows at most three allocation attempts and records the final code. No indefinite retry loop exists.
- Calls are sequential. Closing rows after handle closure are not evidence of a remaining listener by themselves.
- The small test uses single `recv(128)` calls for its fixed strings. TCP does not generally guarantee one receive returns a whole application message; a partial read could fail an assertion on a future run. The retained run passed. This limitation is documented instead of silently changing tested code.
- `product_access=0` in the source is a descriptive constant, not an independent security audit. The script itself has no product-specific imports or operations.
- No changes were made merely to improve the reproducer, because doing so would require distinguishing unexecuted code from the historically executed source.

## Revisión en español

El código es idéntico al ejecutado; no se ha vuelto a ejecutar ni compilar. El JSON histórico se entrega por separado. Una ejecución futura debe ser manual, en una copia nueva y con revisión de privacidad de su salida: el filtro histórico se limita al puerto y podría recoger una conexión ajena coincidente. Las limitaciones anteriores se conservan explícitamente, sin presentar una versión corregida pero no probada como evidencia histórica.