@@ -306,7 +306,7 @@ check-v3-native-linkage:
 	@$(MAKE) -n -C src -W libhttpserver_v3core.la libhttpserver.la AM_LDFLAGS= >check-v3-cxx-link.log
 	@grep -E -- '--tag=CXX.*--mode=link.*-o libhttpserver.la ' check-v3-cxx-link.log >/dev/null || { cat check-v3-cxx-link.log; echo "FAIL: aggregate must use the C++ linker"; exit 1; }
 	@echo "=== check-v3-native-linkage: native provider surface audit ==="
-	@$(MAKE) $(AM_MAKEFLAGS) -C "$(top_builddir)/test" native_linkage >/dev/null
+	@$(MAKE) $(AM_MAKEFLAGS) -C "$(top_builddir)/test" native_linkage$(EXEEXT) >/dev/null
 	@BUILD_DIR="$(abs_top_builddir)" SRC_DIR="$(top_srcdir)" V3_TLS_MODE="$(enable_v3_tls)" $(top_srcdir)/scripts/audit-v3-native-linkage.sh
 
 # Enforce the explicit native v3 example source/build inventory.
 
@@ -1,13 +1,95 @@
 #!/usr/bin/env python3
-"""Adversarial inspector-output fixtures; real binary proof runs separately."""
+"""Make gate and inspector-output fixtures; real binary proof runs separately."""
 import os
 from pathlib import Path
+import shutil
 import subprocess
 import tempfile
 import unittest
 
 SOURCE = Path(__file__).resolve().parent.parent
 
+class MakeGateFixtures(unittest.TestCase):
+    """Run the production recipe with GNU make and controlled build/inspector outputs."""
+
+    def gate(self, suffix='', mode='no', linker='CXX', dependency=None,
+             symbols='', build_fails=False):
+        make = shutil.which('gmake') or shutil.which('make')
+        self.assertIsNotNone(make, 'GNU make is required for native linkage gate tests')
+        recipe = (SOURCE / 'Makefile.am').read_text().split(
+            '\ncheck-v3-native-linkage:\n', 1)[1].split('\n\n', 1)[0]
+        if dependency is None:
+            dependency = 'KERNEL32.dll' if suffix else '/usr/lib/libc++.1.dylib'
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory).resolve()
+            for name in ['src', 'test', 'tools']:
+                (root / name).mkdir()
+            (root / 'src/Makefile').write_text(
+                'libhttpserver.la:\n'
+                f'\tlibtool --tag={linker} --mode=link -o libhttpserver.la archive\n')
+            # Like Automake, expose only the configured executable target.
+            (root / 'test/Makefile').write_text(
+                'native_linkage$(EXEEXT):\n'
+                + ('\t@exit 1\n' if build_fails else
+                   '\t@mkdir -p .libs ../src/.libs\n'
+                   '\t@printf "#!/bin/sh\\nexit 0\\n" > .libs/$@\n'
+                   '\t@chmod +x .libs/$@\n'
+                   '\t@touch ../src/.libs/libhttpserver_v3core.a\n'))
+            inspectors = {'nm': symbols}
+            if suffix:
+                inspectors.update(uname='MINGW64_NT-10.0', objdump=(
+                    'fixture.exe: file format pei-x86-64\n'
+                    + '\n'.join(' DLL Name: ' + n for n in dependency.splitlines())))
+            else:
+                inspectors['otool'] = 'fixture:\n' + dependency
+            for name, output in inspectors.items():
+                path = root / 'tools' / name
+                path.write_text("#!/bin/sh\ncat <<'OUTPUT'\n" + output + '\nOUTPUT\n')
+                path.chmod(0o755)
+            env = dict(os.environ, PATH=str(root / 'tools') + os.pathsep + os.environ['PATH'])
+            return subprocess.run(
+                [make, '--no-print-directory', '-f', '-', 'check-v3-native-linkage',
+                 'top_srcdir=' + str(SOURCE), 'top_builddir=' + str(root),
+                 'abs_top_builddir=' + str(root), 'EXEEXT=' + suffix,
+                 'enable_v3_tls=' + mode],
+                input='check-v3-native-linkage:\n' + recipe + '\n', cwd=root,
+                env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+    def test_configured_executable_suffix_reaches_real_audit(self):
+        for suffix in ['', '.exe']:
+            with self.subTest(suffix=suffix):
+                result = self.gate(suffix=suffix)
+                self.assertEqual(0, result.returncode, result.stdout)
+                self.assertIn('A1 PASS', result.stdout)
+                self.assertIn('A2 PASS', result.stdout)
+
+    def test_configured_tls_mode_reaches_real_audit(self):
+        for suffix, dependency in [('', '/tmp/libssl.3.dylib'), ('.exe', 'libssl-3.dll')]:
+            for mode in ['yes', 'no']:
+                with self.subTest(suffix=suffix, mode=mode):
+                    result = self.gate(suffix=suffix, dependency=dependency, mode=mode)
+                    self.assertEqual(mode == 'yes', result.returncode == 0, result.stdout)
+                    self.assertIn('A2 PASS' if mode == 'yes' else 'TLS-off load dependency',
+                                  result.stdout)
+
+    def test_cxx_linker_gate_stops_before_audit(self):
+        result = self.gate(linker='CC')
+        self.assertNotEqual(0, result.returncode)
+        self.assertIn('aggregate must use the C++ linker', result.stdout)
+        self.assertNotIn('A1 PASS', result.stdout)
+
+    def test_build_failure_stops_before_audit(self):
+        result = self.gate(build_fails=True)
+        self.assertNotEqual(0, result.returncode)
+        self.assertNotIn('A1 PASS', result.stdout)
+
+    def test_static_provider_rejection_propagates(self):
+        result = self.gate(symbols=' U _SSL_set_quic_tls_cbs')
+        self.assertNotEqual(0, result.returncode)
+        self.assertIn('A1 PASS', result.stdout)
+        self.assertIn('TLS-off provider symbols', result.stdout)
+        self.assertNotIn('A2 PASS', result.stdout)
+
 class AuditFixtures(unittest.TestCase):
     def audit(self, dependency=None, symbols='', mode='no', binary=True, archive=True, windows=False):
         if dependency is None:
 
@@ -0,0 +1,62 @@
+# FEATURE-ci-native-linkage-exeext: respect configured executable suffix
+
+Status: Implemented and locally verified; caller validation/finalization pending.
+Base: `v3` at `794ecc08f86e72469eed791c6b13d5a5490cefb4`.
+
+Windows package job `120420001573` in run `39955436208` and archive job
+`120420935368` build the library, then fail because the native linkage gate asks
+make for `native_linkage`, while Automake exposes `native_linkage.exe`.
+The recursive target now uses `native_linkage$(EXEEXT)`, retaining the empty
+suffix on Unix and using the configured suffix on Windows.
+
+Action items:
+
+- [x] Create an isolated Groundwork worktree from the recorded v3 head;
+  preserve the bauth worktree and prior closed repairs.
+- [x] Retain both original native Windows logs and bind the relevant unchanged
+  Makefile/audit inputs to the failed and local base revisions.
+- [x] Add a regression executing the actual production recipe with GNU make
+  for empty and `.exe` suffixes; observe the original missing-target failure
+  before editing production code.
+- [x] Respect configured `EXEEXT` in the recursive native linkage target.
+- [x] Verify both suffixes reach the real source/header and artifact audit;
+  preserve configured TLS mode, C++ linker rejection, build failure propagation
+  and provider rejection.
+- [x] Preserve the complete production inspector and all existing adversarial
+  tests, including static symbols, missing archive and Windows import controls.
+- [x] Run the affected 17-test module, bootstrap, out-of-tree TLS-off configure,
+  generated-target dry runs for both suffixes, Python syntax and diff checks.
+- [x] Retain raw commands, results, source bindings and journal under main
+  `.debug/FEATURE-ci-native-linkage-exeext/`.
+- [ ] Caller: Groundwork validation and local finalization into v3.
+- [ ] CI / v3 PR: native Windows package and archive builds and audits.
+
+Local verification: the five new make-gate tests and all 12 existing inspector
+tests pass. The original `.exe` RED fails with `No rule to make target
+'native_linkage'`; empty suffix behavior passes before and after the change.
+The regression reads the production recipe from `Makefile.am`, executes it
+with real GNU make, and runs the unchanged production audit against the real
+source tree. Small build Makefiles and inspector outputs are controlled
+fixtures; they do not compile or inspect native Windows binaries. TLS-on
+fixtures accept OpenSSL while TLS-off fixtures reject the same dependencies.
+The C linker, failed build and static provider cases fail the gate as required.
+
+Bootstrap and configure pass with existing Automake/Autoconf warnings and
+missing optional documentation tools recorded in the logs. Generated test
+Makefile dry runs resolve both `native_linkage` and `native_linkage.exe`; the
+unbuilt v3core archive is explicitly excluded from those dry runs with `-o`.
+These are target-resolution checks, not binary build evidence. The production
+audit bytes and entire original `AuditFixtures` class are unchanged. Python
+scripts have no documented standalone linter; no C++ files changed.
+
+Native Windows execution remains incomplete and CI / v3 PR owned under
+AGENTS. No full native baseline, unrelated repairs, CI reruns, validation loop,
+merge or publication was performed. Older Linux parity causality remains
+UNCERTAIN after its previously closed bounded diagnosis. Prior production
+unwind/entropy fixes, audit policy and nonlocal checks remain untouched.
+
+Project notes: Autotools/C++20 setup uses `bash bootstrap`, out-of-tree
+`configure --disable-v3-tls --disable-examples`, then make. This task uses only
+targeted Python unittest, GNU make fixtures and configure/dry-run checks.
+The worktree identity came verbatim from the Groundwork helper; Git metadata
+writes required sandbox escalation.