[schlessera]

Closes #1783

What changed

The sync-mirror proof distinguishes a teardown-created file from a descendant surviving into credentialed transport. It observes real writer and namespace-init PID/start identities at sync settlement and later transport launches, under ordinary scheduling and a controlled pre-monitor-exit write. Immutable mirror metadata, the 1,100 ms delayed-write observation and successful push coverage remain. A teardown-created alternates file must produce the exact refusal, no subsequent transport and no outward push.

Why this shape

The previous file-absence assertion could reject a safe refusal after a pre-settlement teardown write. Source comments and hosting documentation now describe the existing completion behavior: maintenance awaits the outer monitor and namespace-owned output EOF. No executable runtime, permission, contract or deadline changes. The ui-sdk/ui-server patch changeset covers shipped source explanations.

Proof

Current candidate f16a8385e8737b29378e8d7a0307e68265554be8 integrates main 45908608df63b07ee3d10d84ac608d132aa21caa, including the delivered #1993 correction (#1998) and native rejection correction (#2000). Sync-mirror test, maintenance/sync source and lockfile bytes are unchanged from previously reviewed head e7bb1e727c5849f5d5310f71ad89451ee6e7e92e. The hosting paragraph merged cleanly with the newer worker-identity disclosure. This relevant-base refresh requires fresh qualification.

Fresh frozen installation with private cache and copyfile backend, workspace build, pending changeset package validation and full changeset plan pass. The fixed group plans a minor; this contribution retains its patch changeset. Focused sync-mirror runtime passes 14 tests / 267 assertions in 26.66 s (ordinary/held-monitor cases 3,324.04 / 3,128.54 ms). Committed-candidate bun run check:pr --base origin/main passes 434 tests / 2,716 assertions in 18.88 s plus all lint, leakage, metadata and compilation gates. Complete selected hosted qualification remains required before merge.

Original behavioral receipts remain attributed to their actual source, Bun 1.4.2 / bubblewrap 0.9.0:

• At base c95223333a83fd3049749a2e68fb0c07963b7ba5, holding only the outer monitor produces a real pre-monitor-exit teardown write, terminated writer/init and exact alternates refusal before later transport. The old assertion fails MAINTENANCE_CHILD_GONE_BEFORE_TRANSPORT: 0 pass / 1 fail / 15 assertions, 5.38 s.
• Disabling only the alternates guard makes the corrected case fail TEARDOWN_ALTERNATES_REFUSED (no sync error received). Restoring passes 2 tests / 49 assertions in 7.57 s. The separate no-parent-death lifetime control passes in 26.62 s; it is a control, not a failing mutation. Mutations were restored.
• Prior Bun 1.4.2 transpilation of the two comment-only production source changes matches main byte-for-byte at JavaScript output.

Historical qualifications remain distinct:

• Run 38701054497, attempt 1, failed separate ui-sdk: native checkpoint release sync aborts automatic-index completion #1967 native runtime and ui-react: hosted destination proof observes no opening animations #1915 browser cases. Checkout 410193357730888067bd7541f44030357d9ac4a7, tree 109a9ec5ca1a2b629edc25218ce482990ddcb445; sync-mirror subset passed 14 cases / 267 assertions. Both blockers are delivered.
• Run 38794498839, attempt 1, passed all fourteen selected jobs on checkout 29702827f6d272fac0d20e2a9c135afa2a88069d, parents d9ac37b82700d7b45406ba47c0850ae46251fa9b + 920ff17a8120cdd9f71d8725cb934ce33325e2a7, tree 5b29efade873d8a24c38713194c00251cbf3b73e. It proves that older tree only.
• Run 38797867268, attempt 1, failed ci: native parallel-session proof reports unbound Playwright response objects #1993 in unit shard 2 and aggregate; twelve selected jobs passed. Checkout ee8aa00e4b1cd3e255e4e905153a4d4f55c33f27, parents 838f05d2ff611c72bdea8405c46f2504dccb6f24 + e7bb1e727c5849f5d5310f71ad89451ee6e7e92e, tree dfcdcf5efc091711a5d038fb89fd535f8d148f6d. Its sync-mirror subset passed 14 cases / 267 assertions. ci: native parallel-session proof reports unbound Playwright response objects #1993 is now delivered by test(ui-react): await rejection before matching browser failures #1998; no failed job was retried unchanged.

The original website/main failures and detailed artifact receipts remain on #1783. Passing scoped cases never relabel failed overall qualification as green.

Final ready qualification run 38825487554, attempt 1, passes all fourteen selected jobs, including aggregate 116739327728. Every actual job checkout log agrees on 0c8f5e11145bb02f615a5deae6a7ca78f8534363, parents main 45908608df63b07ee3d10d84ac608d132aa21caa + head f16a8385e8737b29378e8d7a0307e68265554be8, tree 98628318fbfb19f6c943dfefb94279f7422da81b. Immutable Git API and local object agree. Metadata, strict verification, packaging, all four units, both browser/layout shards, captures, native runtime and aggregate pass with no unexpected skipped jobs. The synchronize-triggered draft run was superseded by ready-for-review before substantive qualification; the completed ready run is the qualifying receipt.

Unit shard 1 artifact 12015855043 records all 14 sync-mirror cases / 267 assertions, no failures/skips, 21.239 s summed case time. Ordinary/held-monitor lifecycle cases take 3,168.11 / 3,103.00 ms. Native runtime artifact 12015885016 qualifies all four healthy backend/UID cells; the retained-reference invocation is a separately verified expected failure. All five invocations complete cleanup without forced shutdown and preserve runner quotas. Live main is still the tested base. Historical red/restored evidence remains attributed above.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issue are all met, or the gap is named below.
• Issue and PR retain milestone 0.44.0; registry latest is 0.43.1 and the full pending plan is minor (verified 2026-10-16).
• Existing patch changeset is included and full pending plan validated.
• No personal data; leakage gate remains required.
• Nothing in the machine surface moved.
• Documentation matches the measured lifecycle.

Anything left open

Nothing in this scoped correction. #736 and downstream #1854 remain separately owned. Publishing/deployment are outside this task.

[schlessera]

Post-merge verification complete: automatic main-push run 38827978296, attempt 1 passes all fourteen selected jobs and the proof aggregate on exact squash 9bebef7bfed47139792ccaf1d22d4ac7f5f093e9. All fourteen actual checkout logs agree. Main JUnit again confirms all 14 sync-mirror cases / 267 assertions, no skips/failures; ordinary/held-monitor lifecycle cases pass at 3,239.65 / 3,065.39 ms. The original qualified squash parent/tree and ancestry checks remain verified. Issue #1783 is closed and both issue/PR retain milestone 0.44.0. Dependent #1854's stale blocker is cleared and its body records the delivered prerequisite. The checkout is clean and this invocation is finished.

The separate automatic website run 38827978335 fails the known HTML-preview heading assertion and skips deployment. Its exact source/release evidence is recorded on existing #1772; no retry or unrelated fix was attempted. Package qualification passing does not relabel that website run as green.