@@ -85,12 +85,26 @@ catalog covers child receipts, command outputs, process receipts, copied
 consumers/fixtures/client code, objects, depfiles, link maps, executable files
 and benchmark raw samples. Compilation must use installed public headers,
 C++20, and archive-distributed copied sources. Private headers, source/build
-includes and `HTTPSERVER_COMPILATION` cannot supply public proof. Static link
-commands/maps must name the selected installed archive; shared runtime
-inspection must resolve the selected installation. Readiness alone cannot
+includes and `HTTPSERVER_COMPILATION` cannot supply public proof. Every cell must retain its family's compile and dependency records, including
+H1 WebSocket, TLS profile/rotation, and H2/H3 example consumers where applicable.
+Static link maps must show contributing members from the selected installed
+archive and no foreign libhttpserver archive contribution; an unused LOAD entry
+cannot supply proof. Shared runtime inspection must resolve the selected
+installation. The first readiness line must contain at least one valid bound
+port. Readiness alone cannot
 supply response proof. Child inventories and decoded lifecycle/semantic
 observations remain subject to their original validators.
 
+H1 validation requires exact HTTP/1.0 or HTTP/1.1 response prefixes and exactly
+two recorded persistent and pipelined responses. WebSocket peer-close evidence
+records actual pending receive entry, completion with the public
+`connection_closed` outcome, and handler retirement before server stop. The
+legacy `cancelled_receive` count represents this observed transport termination;
+it does not assert an `outcome_code::cancelled` result. TLS profile rows retain
+and validate positive and negative authentication, handler deltas, decoded
+responses, callback cancellation/retirement, SNI generations, session rotation,
+and applicable ACME observations independently of their scenario names.
+
 TLS authentication rejection controls retain the independent provider client's
 exit 2 only with a decoded `connected=false` handshake and the exact bounded
 client argument shape. The explicit peer-close cancellation control retains its
 
@@ -34,7 +34,9 @@ def websocket(executable, loop, directory, env, codec):
         port = child.port()
         def counts():
             child.process.stdin.write(b'stats\n'); child.process.stdin.flush()
-            return [int(n) for n in child.line().split()]
+            observed = [int(n) for n in child.line().split()]
+            require(len(observed) == 8, 'missing WS receive counters')
+            return observed
         def wait(predicate):
             deadline = time.monotonic() + 3
             while True:
@@ -70,9 +72,15 @@ def open_peer(path='/echo'):
             require(refused.head().startswith(b'HTTP/1.1 426 '), 'invalid WS version accepted')
         finally: refused.close()
         rows.append(dict(case='refusal', status=426))
-        peer = open_peer(); peer.close()
-        wait(lambda c: c[0] == 2)
-        rows.append(dict(case='close_cancel', clean_close_code=1000, close_callbacks=2, cancelled_receive=1))
+        peer = open_peer('/cancel')
+        try:
+            wait(lambda c: c[3] == 1 and c[4:7] == [0, 0, 0])
+        finally: peer.close()
+        observed = wait(lambda c: c[0] == 2 and c[4:7] == [1, 1, 1])
+        require(observed[7] == 6, 'pending receive did not terminate with connection_closed')
+        rows.append(dict(case='close_cancel', clean_close_code=1000, close_callbacks=observed[0],
+                         receive_entered=observed[3], receive_completed=observed[4], receive_retired=observed[5],
+                         cancelled_receive=observed[6], receive_outcome='connection_closed'))
         peer = codec.Peer(port)
         try:
             peer.socket.setsockopt(__import__('socket').SOL_SOCKET, __import__('socket').SO_RCVBUF, 4096)
 
@@ -14,7 +14,7 @@ def validate_process(record, require_port=False):
     require(record.get('exit') == 0 and 'error' not in record and record.get('command'), 'process exit/cleanup failure')
     if require_port:
         lines = record.get('stdout', '').splitlines()
-        require(lines and all(word.isdecimal() and 0 < int(word) <= 65535 for word in lines[0].split()), 'missing bound readiness port')
+        require(lines and lines[0].split() and all(word.isdecimal() and 0 < int(word) <= 65535 for word in lines[0].split()), 'missing bound readiness port')
 
 
 def validate_compile(compiled, linkage, identity, artifacts, commands):
@@ -54,7 +54,8 @@ def bound(path, digest=None):
     require('-Wl,-Map,' + str(linkmap) in link, 'wrong link map command')
     if linkage == 'static':
         archive = str(prefix / 'lib/libhttpserver.a')
-        require(archive in link and archive in linkmap.read_text(), 'different installed static archive')
+        contributors = {str(Path(name).resolve()) for name in re.findall(r'([^\s()]+libhttpserver\.a)\([^()\n]+\)', linkmap.read_text())}
+        require(archive in link and contributors == {archive}, 'different or noncontributing installed static archive')
     compile_rows = [row for row in commands if '-c' in row['argv'] and '-o' in row['argv'] and
                     row['argv'][row['argv'].index('-o') + 1] in link and
                     row['argv'][row['argv'].index('-c') + 1] in sources]
@@ -170,15 +171,28 @@ def validate_fixture_client(client, identity, artifacts, commands):
     require(links[0]['argv'][:len(compiler)] == compiler, 'different independent client compiler')
 
 
-def validate_child_provenance(child, identity, artifacts, commands):
+def validate_child_provenance(child, identity, artifacts, commands, family=None):
     require(child.get('status') == 'passed' and child.get('run_id'), 'failed child receipt')
     for name, digest in child.get('source_hashes', {}).items():
         require(identity['archive']['members'].get(name) == digest, 'child source outside archive')
     require(child.get('library_hashes') and all(identity['package'].get(path) == digest for path, digest in child['library_hashes'].items()), 'different installed child library')
     cells = child.get('cells', [])
     require(len(cells) == 4 and {(c['linkage'], c['loop']) for c in cells} ==
             {(a, b) for a in ('shared', 'static') for b in ('managed', 'external')}, 'missing/duplicate child cells')
+    required = ['compile', 'dependencies']
+    if family == 'h1': required += ['websocket_compile']
+    elif family == 'tls':
+        required += ['profile_compile', 'profile_dependencies']
+        if identity['tls'] == 'yes': required += ['example_compile', 'example_dependencies']
+    elif family == 'h3': required += ['example_compile']
+    for cell in cells:
+        require(all(isinstance(cell.get(key), dict) and cell[key] for key in required), 'missing required public cell provenance')
+    examples = child.get('examples', [])
+    if family == 'h2' and identity['tls'] == 'yes':
+        require(len(examples) == 2 and {c.get('linkage') for c in examples} == {'shared', 'static'}, 'missing installed example provenance')
+        require(all(c.get('compile') and c.get('dependencies') for c in examples), 'missing installed example compile/runtime provenance')
     client = child.get('independent_client', child.get('credential_fixture_tool'))
+    require(family != 'tls' and not (family == 'h3' and identity['tls'] == 'yes') or client, 'missing independent client provenance')
     if client: validate_fixture_client(client, identity, artifacts, commands)
     seen = set()
     for cell in cells + child.get('examples', []):