Cancellation/custody sits on the F2 border and the drift probe drew the
line sharply. Quiet side, landed: the D07 Emergency Stop delta on
ouroboros/server_control.py - execute_panic_stop takes bound_port as a
keyword instead of lazy-importing the composition root, server.py hands
down _actual_bound_port() - applied in place onto tip bytes with an exact
two-way byte proof (vs tip: only the D07 hunks; vs the reference leaf:
only upstream's dc4c0204 reconcile_delegate_custody hunk). Four reference
pins ride along: test_panic_stop_port_sweep.py and
test_owner_stop_fences_s6.py re-pinned to tip bytes where upstream
genuinely moved (kill_workers kwargs, 5 host leaves not 11, the bounded
re-sweep's two token-less calls - each noted in-line),
test_cascade_chatless_residual_s6.py and
test_preflight_process_containment.py verbatim-green.
Hot side, HOT-DEFERRED with evidence in docs/v7next/LEDGER_CORRECTIONS.md
(entries 7-12): the 16-symbol cancel_custody extraction (upstream 65b5d19f
re-decomposed the same ownership differently), the cancel_intents D08
corruption rule (upstream absorbed it for request_cancel/claim_intent,
four mutators still fail open), the S7b test split bound to the deferred
extraction, and two D09-listed pins that belong to D07's module delta and
the delegation organ (delegate_start now refuses selectorless starts).
The E-suite stays with F2/F4 per the lane charter; cross-domain test
adaptations (events_task_done, loop_delivery, shell_process/git_ops_reset)
are left for their owning lanes. scripts/v7next_transplant.py +
tests/test_v7next_transplant.py byte-synced from the hardened def681bd (no
tool-emitted leaves in this lane; the in-place proof above is the byte
gate). 204 tests green in isolation at the lane base; size-ratchet
manifest regeneration is a no-op and lane 5 passed; ruff F clean.
(cherry picked from commit f1a37d3b413b66a9167fcf7e1a6fee5e229e60be)
