[isomorphisms]

Stacked on #152 for the remaining reader-side private descriptor handoff in #151.

Adds a native C11 Binder provider/receiver contract that:

• adds an Android NDK (API 29+) private provider transaction that checks the reader UID and refuses backing Arena files, writable FDs and shell UID as reader identity;
• obtains a read-only anonymous pipe through Binder's ParcelFileDescriptor from an already authenticated private provider handle; the reply also includes receipt-bound length/SHA, both checked against the browser-held ticket;
• validates source ticket/request ID, navigation epoch, length ≤4 MiB, a finite EOF-terminated byte stream, and SHA-256 before publishing bytes;
• refuses corrupt/short/extra/stale/unbounded input without replacing the previous source;
• has cross-process FD simulation and host/Android ARM32+ARM64 CI (cross-compilation only).

This is a draft transport implementation, not a working C67 URL reader. The native private Binder provider is now wired to a canonical Arena receipt verifier and bounded pipe writer through an app-host assembly, but no Android application lifecycle has registered or distributed its Binder handle; no checked Idriç Material reader DEX uses the new C receiver; no physical Shizuku/ICU/Binder/PFD event has occurred. The current PR #152 v2 emits observed ICU #35 metadata with conditional navigation admission; legacy v1 remains unadmitted. The cross-process Linux SCM_RIGHTS test is a transport surrogate, not Android Binder acceptance.

Remaining: instantiate the host assembly and deliver its private Binder handle to the checked Idriç DEX; implement authorized cross-UID worker-to-app-private Arena ingress, checked Idriç DEX/native bridge to #129/#147, prepaint, and physical C67 testing. No Java/Kotlin browser implementation or direct reader networking.

Additional source-owner slice: ib_arena_source_owner reopens only 0700 app-private Arena root + immutable receipt, checks canonical .used and offset/count, hashes the actual bytes, and produces a finite nonblocking-background-writer pipe. ib_reader_host_assembly assigns the checked callback to the Binder provider and generation authority. Fast synthetic host PFD tests passed on an earlier source revision; real canonical appendfat+ICK and Android ARM32/ARM64 exact-head CI pending. Pending latest branch acceptance, real Binder transaction, Idriç DEX, Shizuku, C67 and APK. No URL navigation admission.

2026-10-14 v2 admission upgrade — exact-head evidence

• Reconciled this stacked draft with IB #152 head 1180b237e02a297b7c2ae9c4603af2b73ec64ae3, preserving its v2 Arena reader rather than overwriting it with an old v1 copy. Reconciled Verify private Binder/PFD source delivery before Android reader publication #153 head: 3e769cbc4913d0a300114b383d9a98503de3e8e3. The draft is mergeable but still not approved for merge.
• The native source owner now refuses a v1 body-only receipt and requires all 23 v2 fields, navigation_admitted=YES, observed 200/text/html/explicit UTF-8, complete byte provenance and source generation equal to the requested reader navigation epoch. It reopens and hashes the canonical Arena range before handing off a read-only pipe. Both producer and consumer remain independently bounded.
• Exact-head CI run 38664402695: PASS both pfd-host-fast and pfd-source-admission, including real pinned canonical appendfat reading, v1 refusal, forged-field and stale generation mutants, and Android ARM32/ARM64 libbinder_ndk cross-builds. Still synthetic PFD/host transport, not a physical Android Binder transaction.
• Control plane / independent acceptance: Flexible Pipes SUN #142. Existing direct commits cannot substitute FP/Kitchen/Ike execution and AI-CI independent acceptance receipts.

Still NOT_RUN: production Idriç Android DEX, real C67 Shizuku/ICU HTTPS, authorized worker-to-app-private Arena ingress, actual app Binder handle lifecycle and ParcelFileDescriptor transaction, #154 real-source prepaint, C67 URL-field APK and navigation. Keep draft; no release/merge authority.

Main-target promotion candidate

IB #158 carries the exact source-owner and Binder/PFD blobs from this stacked PR together with #152 onto an additive main-target candidate. Preserve this PR for source history and do not merge into its old source branch as a substitute for main promotion. FP/ICK/Ike run #143 and its actual receipts remain separate gates.

[isomorphisms]

Dependency update for C67 Binder/PFD: IB HTML→Prepaint PR #154 has compiled the actual Idriç converter, generated Version 1 wire for example.com/arXiv-shaped offline fixtures, and passed the separately pinned AI-CI verifier on the produced bytes (IB CI 38653082213, artifact 11935167962). The Version 1 wire does not serialize source-key/generation/SHA; the converter/admission receipt retains those out of band. The private reader handoff must bind its ticket to the same source_key + source_generation + SHA-256 and retain last valid projection. No new app-owned HTML parse/fetch. Reader PFD acceptance and physical C67 are NOT_RUN until a real admitted #152 ICU source, package lifecycle registration, actual projection receipt and device observation. This is not a request to relabel fixtures live or merge drafts.