test(core): control malformed conformance fixture deadlines

[schlessera]

Current local qualification — 2026-10-19

Resumed under coordinator claim release044-1942-r1-20261019. New candidate a0a8fc2866b31c810b1f7ccf8fd3b0aee62c23c1 merges independently fetched live main 90a95123cfceb169bd2ecf7c213544db742eaed7 into retained head cdacd179b47ea83b069589458283713d2cd1a071, preserving both parents and all prior history. Tree: 054c8df8ee6f8751265a1b12ddf65dbc6c920421. The original four-file implementation diff remains unchanged in scope; integration required no source repair.

#2365 and #2366 are delivered. #2374 supplies the scoped passing ready proof for #2365; its separate automatic-main failure remains attributed to #1229. Neither prerequisite qualification nor the non-blocking #1946 ruling waives any selected job for this candidate.

Input assessment: all eight published testing-helper files, the private clock, its controls, malformed self-tests and all three native caller files are byte-identical to original 1d3867e0 and retained cdacd179. Lockfile, test wrapper, preload, lease and Bun configurations match the retained candidate. Original timing/mutation measurements used Bun 1.4.2; current Bun 1.4.3 matches the later 98/613 receipt. Original lock/dependency changes were already integrated before that retained receipt. Current CI planning, browser distribution and native-qualification changes require fresh candidate qualification; historical proof is not relabeled as current.

Fresh owned frozen/offline copyfile installation leaves the lockfile unchanged: 59,516 audited regular dependency files have link count 1, and all 76 links resolve inside the owned checkout. Tests retain the ordinary wrapper/preload in a verified private network/mount namespace, normal inherited HOME, original /tmp, ordinary UID/GID and zero capabilities. Only loopback and the task-owned reserved dummy address are present; both unfiltered main-route guards pass. Private temporary storage remains above the unchanged 2 GiB/5% floor.

Current local proof:

• Focused clock/restoration, malformed contracts and existing native callers: 98 tests / 613 assertions, exit 0, 30.754 s whole command. The existing native runner outer test requires child exit 0 and all 24 child cases passing. No native process/browser clock is replaced.
• Actual bun run check:pr --base origin/main --plan: exit 0, selecting 14 fast files and ordinary import-graph feedback; no broad UI audio feedback is selected.
• Exactly one actual default bun run check:pr --base origin/main: exit 0, 72.032 s whole command; all contribution gates, 292 fast tests / 3,070 assertions, then 35 feedback tests / 488 assertions pass. No full/all mode, selection override, shortened deadline, mutation retry or failed-test retry.

The matched 31-case 35.94→16.59 s comparison, final 35/488 historical command, nine intended mutation/restoration receipts, historical 63-outer native receipt and later 98/613 plus 292/3070 receipts retain their exact original identities. No benchmark or mutation campaign was repeated because the clock/oracle inputs are unchanged from the retained source. Current focused execution validates ordering, promise outcomes, cancellation and complete timer/elapsed descriptor restoration after both success and genuine assertion failure.

Cleanup verifies all sampled owned process identities exited (23 focused, 14 plan, 160 preflight), the caller network namespace stayed unchanged, private ledgers are empty and owned temporary roots are removed after retaining residual fixture files. The dedicated worktree and parent claim remain preserved. Local preflight slot is released.

Remaining: PR stays OPEN DRAFT. The coordinator owns the ready/hosted window. Complete selected current-candidate hosted proof, actual checkout/aggregate reconciliation, review and eventual delivery remain outstanding. No ready transition, confirmation request, merge, issue closure or whole-main-green claim is made here. Historical failed/cancelled workflows below remain failed/cancelled.

Capacity prerequisite delivered — 2026-10-18

#2366 is delivered by merged #2379, squash 63fde3c8fe76e754aa4524f95b23f9786f4447fe. Complete automatic ready39076714711 and exact-squash main39078216213 each pass all16 selected jobs and aggregate. Browser whole-job elapsed is796/837seconds on ready and644/746seconds on main, all within the840-second acceptance bar. All309 project/file case inventories are preserved exactly:9,050 passes and the same ten existing pointer skips, without unhandled errors. Two shards,15-minute outer bounds, assertions,pins,offline/native/Worker guards and artifacts remain unchanged; no whole-CI speedup is inferred.

The capacity dependency is satisfied. The existing partial implementation remains open/draft and needs its owner's relevant-main integration and fresh exact-candidate qualification. Earlier failed receipts keep their source/run identities; this delivery does not qualify this candidate or complete its original acceptance criteria. No claim or branch is taken over.

The independent #2365 prerequisite is now delivered by #2374; its scoped proof and separate failed automatic-main receipt remain distinct.

Refs #1942

What changed

Eight malformed in-memory conformance fixtures now drive the actual published contract callbacks with a private clock. Their timers, real promise outcomes and elapsed assertions still execute; the 31 original cases, 468 assertions and exact failed-case lists remain. Three clock controls cover ordering, cancellation and restoration after a genuine assertion failure; a fourth control prevents clock errors from being counted as expected contract failures. Published helpers, public bounds, native provider/runner callers, and the remaining self-tests are unchanged.

Why this shape

The six fixed deadlines and two never-settling controls prove that the oracle rejects known counterexamples. Their elapsed wait is fixture scheduling. Each case owns its timers; the clock dispatches by due time/registration order and lets real promise continuations finish between callbacks. Infrastructure errors escape the failed-case collector. The wait guide maps each malformed fixture to its independent boundary and identifies the native integration guarantee. No consumer-visible change or changeset.

Proof

Base: 58f572c4d2f86fe55d76ff053fb315b83e549158. All runs retain the test preload inside an ordinary-UID user/network namespace with loopback only, no routes, and dropped capabilities. The shared benchmark lease serialized test/build activity. Bun 1.4.2, Linux WSL2 x86_64, 32 logical CPUs, 48,169 MiB RAM; shared-host background load remains uncontrolled. No observer instrumentation was used in the paired runs. GNU time measures the complete bun run test packages/core/tests/seam-contracts-nonconforming.test.ts command inside the namespace; namespace preparation and lease queue time are excluded.

Same 31-case command	Before	Candidate
Whole command	35.94 s	16.59 s
Bun file elapsed	35.85 s	16.50 s
Sum of test bodies	35.82546 s	16.48106 s
Eight changed bodies	19.34948 s	0.00631 s
User + system CPU	0.53 s	0.40 s
Peak RSS	42,908 KiB	43,608 KiB

One matched local pair saves 19.35 s (53.8%); RSS increases 700 KiB. Dependency setup was separately 1.07 s; no build was required for these source tests. These are not hosted critical-path or runner-minute claims. The paired original self-test SHA-256 is 80e8daaeda9ddf0cdf1b1007a7cb02d0e29ecd5e0eb74f0a8085e7a9652f96f5; paired candidate is 3cac32bd998c4a6147c9faecfba9853a84ae01b3d29104e008e4833806aab48a (subsequent two-line indentation cleanup only). All 27 original matcher ASTs, 27 original test-name expressions and 27 published-contract invocation ASTs compare identical. The final source adds one collector guard; the original failed-case expectations are unchanged.

Nine intended mutations failed named assertions (all subsequently restored):

• Fixed runner 600→2600 ms changed the expected long-case failure into the short-case failure; fixed embedding 40→1500 ms changed the expected live-signal failure into the abort-case failure.
• Contract long boundary 2500→500 ms returned an unexpected empty failed-case list; reporting rejection as resolution added an unexpected short-case failure.
• Omitted cancellation exposed a cancelled tied callback and changed cancelled from false to true.
• Delivering one millisecond early produced 38/39 instead of the independently expected 39/40.
• Skipping the actual elapsed descriptor restoration failed descriptor equality after the deliberate assertion failure. An initial absent-property-branch edit was a no-op on this runtime and is not counted as evidence.
• Flushing pending callbacks during teardown made the clean successor observe contaminated === true.
• Swallowing driver errors made the collector guard receive a resolved Promise where it required rejection.

Final source: 1d3867e0dbbcc54db5f42e60a4e26d1e958cd557 on the same base. Restored original cases plus all four new controls passed: 35 tests / 488 assertions, 16.56 s command / 16.48 s Bun, 16.46605 s summed bodies, 0.29 s CPU, 44,172 KiB RSS. Added-control bodies sum to 1.64 ms; this final-source receipt is separate from the 31-case pair above, not a repeat-baseline speedup estimate.

Native receipt: unchanged seam-contracts.test.ts and agent-runner-contracts.test.ts pass 63 outer tests / 125 assertions in 14.09 s (0.99 s CPU, 71,824 KiB RSS). The outer runner test checks actual child exit 0, all 24 cases passing and zero failures across the four built-in runners. Published testing sources and all three native caller files are byte-identical to the base. Standalone strict TypeScript checking passes for the private helper; complete selected hosted types remain required. Its initial explicit-file command needed TypeScript 6's --ignoreConfig; that CLI diagnostic is not mutation evidence.

Actual committed-head bun run check:pr --base origin/main passed on 1d3867e0d against 58f572c4d: all local gates plus 288 tests / 3062 assertions in the selected 14-file preflight. Selected hosted proof remains required before merge.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issue are all met, or the gap is named below.
• PR test(core): control malformed conformance fixture deadlines #1943 and issue tests: control known-bad conformance deadlines while retaining native contract proof #1942 both read back release milestone 0.44.0 (ui-server: decide whether the digest gets an agent-written prose pass #58).
• This changes nothing a consumer can see; no changeset.
• No personal data anywhere in the diff; leakage gate passed.
• Nothing in the machine surface moved.
• The wait guide reflects the guarantee distribution.

Anything left open

Ready qualification 38638401326 finished with 10 passed execution jobs, two failed browser jobs and a failed aggregate; the plan intentionally omitted pack. All 13 executed jobs checked out 884d9cad35e0be9126c41beeb3f3f5a7a63d04ec, parents base 58f572c4d2f86fe55d76ff053fb315b83e549158 and head 1d3867e0dbbcc54db5f42e60a4e26d1e958cd557, tree 6184a08b338c8ad7caebfc01fce04ce21436f841. Job logs, immutable commit API/local parents and both failure artifact manifests agree. The full run's executed-job cost is 6115 seconds; queue and concurrent wall time are different measures. No cancelled execution or unchanged retry is hidden.

The browser failures are independent supporting issues: #1946, ActionCard outgoing opacity 1 at the intermediate assertion (job 116107668394), and #1938, the stable mixed-pointer Files paint mismatch at 150 ms (job 116107668408). All 346 browser inventory entries / 206 unique source files have identical base/head blobs. Unit shards, both layout shards, runtime and captures passed. This establishes scoped success, not a green selected run. The original run remains failed. #1938 has since been resolved; PR remains draft pending remaining candidate qualification; #1946 is non-blocking under the 2026-10-17 maintainer ruling.

Resumption — 2026-10-15

#1938 is resolved by its qualified correction on main 3100afa2b8efa25ea31114cdee1f2a89a48dd013; #1946 remains an unresolved, non-blocking animation investigation under the 2026-10-17 maintainer ruling. Its bounded exact-historical-checkout 218-file native shard passes 4,567 cases with four existing exclusions and does not reproduce the original opacity-1 state. Failure-only diagnostic PR #1984, merged as 131f3a7d70c829bd27a3fa8ddac9fda0261918b9 after all 13 selected PR jobs passed, now preserves that native state on recurrence, with 34 restored local ActionCard cases passing and controls for paused animation, omitted diagnostics and diagnostic exceptions. It does not establish a causal repair.

This optimization head remains unchanged. Reinspection against main 200efc8d4e5e2ef6bd7c5385440a9289bd14c774 found a clean prospective merge; only the shared wait guide overlaps. New diagnostic delivery and relevant main inputs must be assessed before complete current-candidate qualification. Existing matched local time remains 35.94 to 16.59 seconds; this investigation does not establish an additional performance gain.

Maintainer ruling — 2026-10-17: The known ActionCard intermediate-opacity and final-disappearance timing findings in #1946 remain under evidence collection and are non-blocking for other issues. Matching failures must retain their actual failed identities and explicit attribution; this is accepted animation risk, not a repair or a green CI claim. Other proof and merge requirements remain applicable.

Resolution of #1946 is no longer a prerequisite for this PR. Existing failed receipts remain failed; assess relevant base changes and complete the remaining candidate qualification before delivery. This update does not promote or merge the draft.

Current qualification — 2026-10-17

Resumed the explicitly released handoff for #1849. Integrated remote main 5c670c6f93842717c9a3723606ebcbd7aa52406f without conflicts at head a0629e60c. The four-file implementation diff is unchanged; published testing helpers and original native callers remain byte-identical to the preserved candidate. Existing paired timings and nine mutation receipts remain attributed to their original source; no new saving is claimed.

Own frozen dependencies, Bun 1.4.3. Offline ordinary-UID route-free network namespace with loopback and dropped capabilities: full private-clock, malformed self-tests and unchanged native contract caller files pass 98 tests / 613 assertions (30.48 s). Actual committed-head bun run check:pr --base origin/main passes, including 35 affected tests / 488 assertions (16.65 s) and contribution gates. Earlier current-main fixes are integrated; historical workflow failures remain failed. Complete selected hosted confirmation, actual checkout/aggregate reconciliation, review, release readback and matching-head delivery remain required.

Current final local candidate cdacd179b47ea83b069589458283713d2cd1a071 integrates #2293/main 0d780605fe1ea9a281cce947b1f0074f3f3e7acc because it changes CI planning/proof inputs. The implementation diff remains the same four files. Original temporary-storage preflight fails 277/5 at unrelated SQLite WRITE/SHMSIZE setup paths; the exact observation preserves source, errors and limits. Changing only TMPDIR to owned disk-backed storage passes the three affected files (27/764), then actual committed-head full preflight passes all contribution gates, 292 fast tests / 3,070 assertions and 35 feedback tests / 488 assertions (16.67 s). This is separately attributed recovery evidence, not a source repair or a cause for #1249. No durability, guard, selected check or assertion is relaxed. Fresh complete hosted confirmation is requested for this candidate.

Current blocked handoff — 2026-10-17

Blocked by #2365

Ready confirmation 39068372996, attempt 1, completed FAILURE on exact head cdacd179b47ea83b069589458283713d2cd1a071. All fifteen executed checkout logs identify merge d776e31f6e5859c63da97902bd35543fd06ad066, parents main 0d780605fe1ea9a281cce947b1f0074f3f3e7acc and that head, tree 7994c310523897958ff9765f27f512597ce73bb9; immutable GitHub commit evidence agrees. Twelve jobs succeed, unit (1) and aggregate fail, browser (1) is cancelled by its 15-minute whole-job limit. Packaging was planner-unselected. No whole-candidate green is claimed.

#2365 owns the unrelated native diagram self-test's invalid assumption that current package bytes must always equal the frozen qualified source. The actual binder correctly refuses these two legitimate private-test additions: 861 current inputs versus the 859-file pinned identity, with all source pins and installation identity unchanged. A bounded log-only diagnostic reproduces source-mismatch on this exact head; all observation edits are restored. Do not update qualification hashes or weaken drift refusal to make this contribution pass.

#1788 owns the separate outer-job capacity failure. Browser (1) finishes 231 files / 4,822 passing tests and four existing skips, with successful 852.681-second build-plus-proof commands, but the complete job exceeds its limit. Cancellation remains incomplete selected proof. Original failed/cancelled workflows and the fresh 7,907 summed job-second / 1,049 event-second ready cost are retained; this cost excludes draft/contract/project-sync and local commands.

#1943 is draft after every selected job drained. Local 98/613 focused proof, 292/3,070 fast preflight and 35/488 affected proof remain attributed to their actual source/storage; original matched timing and nine mutations remain historical. The complete implementation is preserved. Resume after source-valid self-test correction and qualified browser-capacity evidence: integrate relevant changes, rerun required affected preflight/current-candidate hosted proof, inspect every actual checkout/aggregate and review, then read back 0.44.0 milestones and verify matching-head squash/main delivery. No unchanged retry or proof waiver is selected. Claim e1849-1942-qualification-r2-20261017 is released after fresh ownership readback.

2026-10-17 capacity dependency reconciliation: #1788 completes its written investigation and recommends a browser-only measured weight refresh with the existing two jobs and 15-minute bound. Implementation and required automatic ready/main whole-job headroom qualification are now scoped in #2366. That correction is not delivered by the spike closure. The canonical capacity blocker is #2366; preserve this draft, its other blockers and all historically attributed failed receipts. Resume only after the implementation evidence satisfies its criteria, then reassess live source and obtain this candidate's own required proof.

[schlessera]

Claim e1849-1942-f4e75e84: blocked handoff; preserving PR #1943 and branch test/1942-conformance-clock-e1849-f4e75e84 at 1d3867e0dbbcc54db5f42e60a4e26d1e958cd557.

Ready qualification 38638401326 finished with 10 passed execution jobs, two failed browser jobs and a failed aggregate; the plan intentionally omitted pack. All 13 executed jobs checked out 884d9cad35e0be9126c41beeb3f3f5a7a63d04ec, parents base 58f572c4d2f86fe55d76ff053fb315b83e549158 and head 1d3867e0dbbcc54db5f42e60a4e26d1e958cd557, tree 6184a08b338c8ad7caebfc01fce04ce21436f841. Job logs, immutable commit API/local parents and both failure artifact manifests agree. The full run's executed-job cost is 6115 seconds; queue and concurrent wall time are different measures. No cancelled execution or unchanged retry is hidden.

The browser failures are independent supporting issues: #1946, ActionCard outgoing opacity 1 at the intermediate assertion (job 116107668394), and #1938, the stable mixed-pointer Files paint mismatch at 150 ms (job 116107668408). All 346 browser inventory entries / 206 unique source files have identical base/head blobs. Unit shards, both layout shards, runtime and captures passed. This establishes scoped success, not a green selected run. PR remains draft until both supporting issues have qualified corrections and the candidate completes required proof.

The matched original cases improved 35.94 → 16.59 seconds; final 35 tests / 488 expectations pass in 16.56 seconds. Nine intended mutations failed their named assertions and restoration passed. Native callers pass 63 outer tests / 125 expectations, including 24 child cases; committed preflight passes 288 / 3,062. CPU and RSS costs remain in the PR. Release milestone 0.44.0 (#58) stays on both issue and PR.

Resume after #1938 and #1946 have qualified corrections: assess relevant base changes, retain the original/native and private-clock controls, run current committed preflight and every selected hosted job. No product or browser correction is included here. The claim is released after fresh ownership readback; implementation and clean worktree are preserved.