test(ci): qualify browser retention and snapshot fault ownership

[schlessera]

Closes #2126. Closes #2190. Refs #1837. Closes #2340. Closes #2355.

Browser proof must execute fresh while its native producer has ambient filesystem inputs, installed inputs differ, or its Worker audit is stale. This change qualifies the complete selected browser domain for guarded same-PR retention: the native SVG/PNG/PDF producer runs in a separate network-disabled, read-only container with only private source, copied dependencies, captured Bun and an initially empty output directory. Browser consumers validate and write the captured artifact bytes. Execution bootstrap acquires and verifies the canonical RepoDigest; metadata lookup and native execution never pull.

The canonical image parser is side-effect-free and shared by current capture verification, historical cost refresh and the real workspace-lease execution consumer. Unknown ownership, computed bindings and competing named exports refuse. Historical runner, producer and package declarations come from the same immutable checkout; legacy provenance keeps its original execution identity. No compatibility image tag or additional authority is introduced.

The candidate incorporates delivered main PR #2352: ordinary compilation when build inputs are unqualified, bounded callout cases that drain their entire owned work, async React teardown, and the auth-snapshot fixture correction. Conflict resolution preserves this PR's exact document guards, producer pins and repeat-observer fixture copies. The native inputs remain unchanged. No new native, capture or broad local execution is claimed for the final auth-only integration.

Frozen candidate and qualification

Material	Identity
Head	ca8b4e0dc814ade2eaaa178f08d45a2942e9c8b2
Tree	57a12a415f07188fb1d3d4c8658d435d7994a9bf
Integrated delivered main	2a0b77f675da2f01c32adba3f4920650a5ee09fa
Reviewed Worker audit	795abd5839096c4c451db7ff42ea5264b3ad7652439f8c927858505708a597b5
Native source, 859 inputs	e8502b6ffb3c575f2e9a1c93dea8dbf5ceda93ece367da9d542cb10b1c9ac32b
Private installation, 843 packages / 59,516 files / 1,833,832,361 bytes	0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245
Native image and captured Bun	bf65590d9d594d238c2c7b6e01e038a26402a676ccf16a1caf596f1179bdc9fb

The selected browser domain is 309 project/file pairs from 374 discovered pairs, with 231/78 partitions and 2,295 closure files. The Chromium/WebKit callout pairs retain all original geometry, source/index, column and capture obligations under the existing 15-second budget. Layout remains a separate fresh category. The enforced PDF Worker exception remains the sole unresolved input; no additional unknown is waived.

The complete installation comparison found exactly 220 file-mode differences between the earlier local and hosted copies, with identical paths and content. A fresh private copy normalized only those observed modes and then matched the complete hosted installation identity. Actual offline native SVG, 1440×1176 PNG and one-page PDF with both expected fonts passed on that installation/runtime. Original installation and shared cache remain untouched. Cause and full comparison, private-copy qualification.

The delivered callout/build source changes were explicitly reviewed in the Worker material. Directory, external and native identities remain equal; stale audit admission refuses before the new qualification. The main integration changes only two auth-fixture blobs relative to the prepared candidate; the later #2355 correction changes only the device-local runtime test. These paths are outside the qualified browser material. The final complete offline Inputs deeply equal both actual successful AE7 browser receipts at fingerprint 23c4b733169e118ff5a12944c8505a856ccc9f33b141d78021365e1764008f56 under the copied prior hosted runner label. This final source comparison is an offline projection; the distinct actual hosted baseline and prior failed retained follow-up are described below.

Source-bound validation

• Required broad preflight passes on predecessor a42f807e2d2b4411c59aa3e0d7b4a02bee55f5d0: 956 fast tests / 6,328 assertions and 584 feedback tests / 7,679 assertions. That receipt is preserved with its actual source, not relabeled as a new run.
• Prepared integration b03e6550688723f644b5efc4b97d243c832963a0 passes 31 focused tests / 285 assertions and strict types. The reviewed audit update passes eight tests / 34 assertions at 762fe6e0cc06c2ba33235ddd345e82050b032ef0; final main integration ae7dfacc2cbae1936083638d8665844c970175f9 passes those eight tests / 34 assertions and strict types. No broad refresh follows the auth-only delta.
• Actual three-format qualification at 8d6dcb0bfd62980183180c600dc3f9b48b386a8f covers the exact native e850 source with unchanged installation/runtime. Later projections establish unchanged native inputs without claiming another execution.
• Exposing original checkout or host-state mounts fails the named absent-data controls. Changing prepared PNG bytes fails artifact/pixel assertions; restored captured bytes pass. Replacing the original host Bun pathname fails the unsafe-path control while captured bytes execute all three formats. Omitting bootstrap fails the real cold-reference control; an incorrect RepoDigest refuses before execution. These receipts retain their original source attribution.
• Canonical image export ownership and historical-checkout mutants fail their named assertions and restore. Named/namespace export collisions, wrong import owners, comments/string lookalikes and mismatched declarations remain refused. Untouched capture verification passes five recipes, thirteen exact files and ten paint-history pairs at its recorded parser source; later guard-only changes do not claim a repeated full capture.
• The actual workspace-lease wrapper consumer fails with the controlled absent legacy reference before repair; the canonical immutable argument passes all four ownership assertions. Focused lease/parser tests pass 29 tests / 82 assertions and strict types at 735cf331e9e833871e136e430110456f62e41a60.
• Exact replay producer and eight-site callout caller bindings preserve fail-closed source ownership. Bypassing the callout source hash fails the named drift refusal; extra callers, changed sinks, missing producer ownership and unknown inputs remain rejected. Repeat observations never authorize unqualified build reuse.

Actual hosted experiment

Historical CI 39045731249 remains FAILED and ineligible: checkout 9c13dc97540b8529f5d3e257b67e077cb0222bd8, tree 34fa110a1d081ea3ecf1e0292c9483dd2c162ff8, fourteen successful jobs plus browser (1) and aggregate failures. Browser (1) failed only the two old WebKit callout deadlines; the aggregate independently rejected the moved live base. Both browser shards admitted equal complete Inputs, but that did not establish whole-workflow eligibility. The delivered #2352 repairs resolve the concrete callout/teardown/auth blockers; their separate successful workflow is not this PR's baseline.

Earlier parser/bootstrap/installation failures and cheap draft feedback remain separately attributed in #2126. Successful project-sync or cheap metadata is never CI confirmation. No failed, cancelled, incomplete or retained/skipped chain can authorize this experiment.

Fresh baseline CI 39056975850, attempt 1, completed SUCCESS with all sixteen jobs successful on head ae7dfacc2cbae1936083638d8665844c970175f9. Actual synthetic checkout aee687a092f8ec6dfc1c29e3914de3cc6a63b4b8, tree 941c4c70c6ec28a1a19809e423aa192eca0a124a, has exact parents delivered main 2a0b77f675da2f01c32adba3f4920650a5ee09fa and that head. Both fresh browser jobs/checks (117467084915 / 117467084914) emit deeply equal complete Inputs at fingerprint 23c4b733169e118ff5a12944c8505a856ccc9f33b141d78021365e1764008f56. Artifact API digests and ZIP CRCs match; all 309 browser project/file pairs execute exactly once (9,050 passed cases, ten existing pointer skips, no unhandled errors). All 1,075 unit files execute exactly once across eight private workers (14,540 passed cases, 28 existing explicit skips, no TODOs). The aggregate independently passes the complete selected membership.

The historical 62fb9b368c64f55020ca205195c4b551ee39604a follow-up adds only the held seven-line docs/process/testing.md control. Its scoped preflight passes with no affected runtime tests. The entire complete Inputs object deeply equals the actual successful baseline, and the nominal confirmation plan remains global with browser and every other category selected. Actual follow-up CI 39058613916, attempt 1, validates browser retention from that exact baseline and intentionally skips fresh browser execution while browser remains selected. Its current checkout is e80759902c18e0c64a345f842fcf6a18bd8709d3, with exact main/head parents and tree fab3768222f8fc0848f461de6d25bb54c9824250. The entire complete Inputs object matches the actual baseline; the escaped ledger is 61,909 bytes. The independent aggregate reaches its selected-unit check after retained-domain revalidation, then correctly rejects the failed unit category. The workflow is FAILURE: twelve successful jobs, one validated browser skip, and unit (4) plus aggregate failures. The sole native assertion failure is local-work-runtime.test.ts:515, immediate failed status after the expected AbortError (expected true, received false), tracked in #2355. Its original source/artifact and successful categories are preserved; no retry, complete-cycle success or merge is claimed. Browser retention never authorizes skipping unit, packaging, types, captures, runtime or endurance obligations; layout remains fresh.

Corrected confirmation candidate

The #2355 repair addresses the concrete failing test without changing product status behavior. The original abort fixture restored its IndexedDB methods before checking failure and persisted data. A queued autosave could then commit successfully and correctly clear that failure. An actual native transaction trace plus a controlled queued-autosave completion reproduces the original immediate status assertion (the AbortError assertion passes). This is causal interleaving evidence; the raw failed hosted scheduling trace was not retained.

The fixture now keeps its records/readwrite abort fault through all original observations, restores complete property descriptors, and drains its owned native transaction cohort on success and failure. The existing 500 ms open-transaction check, immediate AbortError/status/disk assertions, two-tab release behavior and 120/180-second budgets remain. A genuine later autosave exercises the added guard. Omitting only that guard fails ABORTED_SNAPSHOT_REJECTS_QUEUED_RECOVERY (expected true, received false); exact restoration passes all seven containing tests / 86 assertions. A separate early-body failure retains its named original error while proving one held transaction settled and all descriptors restored; that intentionally failed test is cleanup evidence, not green test evidence.

Direct child d0a65205db16fc05486e6a0cf46ef61650a6ca6f changes only packages/ui-react/tests/local-work-runtime.test.ts. Strict types pass. Required scoped preflight against the already-tested parent 62fb9b3 passes 54 fast tests / 181 assertions and the exact one-file feedback selection (seven native tests / 86 assertions), including lint/env/changeset gates. The earlier broad and hosted receipts retain their source identities; no unrelated broad refresh is claimed. The coordinator independently reviewed the entire one-file diff and deeply compared every complete browser Inputs field with the successful baseline: fingerprint, runner, inventory, partitions and native source/installation/runtime all remain equal. Corrected fresh CI 39062246171, attempt 1, now passes all sixteen jobs, including the independent aggregate. Every actual job checks out e84e683b01b9cd4a01f3195d36e6f01942dce42a, tree 6fb1e0e35a2751b15cb897ab3baf0d712cfdba57, with exact parents main 2a0b77f675da2f01c32adba3f4920650a5ee09fa and corrected head d0a65205db16fc05486e6a0cf46ef61650a6ca6f. Both browser shards execute fresh, with complete Inputs deeply equal at 23c4b733169e118ff5a12944c8505a856ccc9f33b141d78021365e1764008f56. All 309 browser pairs execute exactly once (9,050 passes, ten existing skips, no unhandled errors); all 1,075 unit files execute exactly once across eight private workers (14,540 passes, 28 existing skips, no failures or TODOs), including all seven corrected device-local runtime cases. Actual artifact API digests, ZIP CRCs, discovery membership and aggregate validation pass. This is the corrected eligible fresh baseline; no retention or savings occurred in this run. The three-run bounded lookup correctly missed the older baseline after intervening cheap draft runs; its limit is unchanged.

Current direct child ca8b4e0dc814ade2eaaa178f08d45a2942e9c8b2 adds only five documentation lines recording the persistence fault-fixture rule. Scoped preflight against the successful parent passes, with the explicit no-affected-tests result. Every complete browser Inputs field deeply equals the actual corrected baseline. This meaningful documentation follow-up will request one candidate confirmation within the existing lookup budget; its hosted retention and whole-workflow result are pending.

The final cost audit separates avoided fresh browser runner consumption from event elapsed time. Corrected fresh baseline 39062246171 spends 1,729 job seconds on its two browser jobs (1,623.261 seconds inside proof commands); its aggregate job takes 25 seconds, including four seconds validating proof, and event-to-final-job time is 1,220 seconds. Historical failed retained follow-up 39058613916 avoided its equivalent-source 1,712 browser job seconds, but its stopped unit worker and failed aggregate cannot establish a completed green cycle or critical-path improvement. The current documentation follow-up remains pending. No completed green retention cycle or merge is claimed.

This PR changes proof infrastructure only, with no shipped package or consumer contract change and no changeset. PR #2293 and issues #2126/#2190/#2340/#2355/#1837 retain release 0.44.0. #2126/#2190 remain open until the complete successful retention cycle is established; #2355 is fixed and qualified but remains open pending delivery; #1837 retains its separately completed attribution result. Main, scheduled and manual runs keep fresh-execution obligations.

Completed cycle and merge assessment

Completed controlled retention cycle (2026-10-17): CI 39063935324, attempt 1, is SUCCESS at head ca8b4e0dc814ade2eaaa178f08d45a2942e9c8b2. All fourteen executed jobs pass; browser remains selected and intentionally retained. Every actual execution job checks out 1ae6164542ba50d19d4a8439ece88ff92ffce3b0, tree 57a12a415f07188fb1d3d4c8658d435d7994a9bf, with exact parents main 2a0b77f675da2f01c32adba3f4920650a5ee09fa and that head. The aggregate independently validates complete equal browser Inputs and original source run39062246171/attempt1/jobs117482652349+117482652319. Retained jobs keep their original checkout identity and are not executions on the follow-up. Digest/CRC-verified current unit artifacts reconcile all 1,075 files exactly once across eight private workers: 14,540 passes, 28 existing explicit skips, zero TODOs. The fresh baseline covers all 309 browser pairs, 9,050 passes, ten existing pointer skips and no unhandled errors. Layout, captures, endurance, both native runtime categories, packaging, types and units execute fresh and pass.

The completed experiment avoids 1,729 equivalent-source browser job seconds (1,623.261 proof-command seconds); lookup costs 27.290 seconds. Follow-up aggregate validation takes 43 seconds (60-second job), versus four seconds (25-second job) at baseline. Event-to-last-job elapsed is 1,253 seconds versus 1,220 seconds. This proves reduced browser runner consumption, with no elapsed-time improvement claimed. Prior failed workflows retain their original conclusions.

Live main subsequently advances only by 5c670c6f93842717c9a3723606ebcbd7aa52406f, fourteen documentation lines in AGENTS.md and docs/process/github.md requiring blocker priority inheritance. These do not change any runtime, workflow, proof input or selected test. The maintainer explicitly permits merging after one successful complete proof without full refreshes for such movement. The tested base/tree above remains unchanged in this evidence; actual squash parent/tree and scoped postmerge checks will be reconciled separately. Release 0.44.0 remains assigned to this PR and every completed or advanced issue.

[schlessera]

Current voice adapter confirmation run 39023395726 at head 1a6cb2cefa0326f4e65421898e94fc3c4eb02122 exposes the same diagram binding prerequisite already recorded by #2293. Actual checkout e3da8cef9ce9a4f4cbdd713bbd85aceadee792fa has parents 8c4d191e761bec31f3267d3b612a77712692f54a and that voice head.

Unit (3), job 117369944061, fails the exact diagram binding test at tests/bound-browser-documents.test.ts:40: the declaration has no binding, so reading its values throws. The unchanged focused suite reproduces locally: eight pass, one fails on that same expression. Both actual diagram owner/caller files are byte-identical to the tested main base. Their SHA-256 values are respectively d7280cf23ba24bd636f7737d8552801e37f8c03c1e773aee660c9e07ded524a9 and dbac044e90a3b7b84e308a96cca8396874afb9b96d8cc23b2fddb4293d85706c; neither matches its declaration. The voice diff changes neither the checker nor these producers.

Unit (4), job 117369944070, separately fails the real-host restart case because its fixture tries to create an existing inode-pin directory. This is the exact helper line repaired by merged #2305. A controlled run applying only that delivered helper passes the named real-host restart test (one pass, seven assertions); the original helper was then restored byte for byte. This is a scoped upstream-repair control, not a new current-head whole-run receipt. Other completed selected jobs currently pass, including both browser shards, runtime, native host, endurance, verify and packaging; remaining jobs are still in progress. This is not a whole-run success.

Resume #2070 by incorporating the delivered restart repair and #2293 after it lands, verifying both named failures and the voice contracts, then requesting current selected confirmation. Keep the diagram proof correction with its existing owner; no gate weakening or unchanged failing-job rerun is proposed.

[schlessera]

Delivered by merged PR #2293 at squash 0d780605fe1ea9a281cce947b1f0074f3f3e7acc. The actual parent is live-main documentation commit 5c670c6f93842717c9a3723606ebcbd7aa52406f; actual tree a7a9294d9ca0630164e7829892f6d71e00c81b67 exactly equals the independently reconstructed merge. Remote main contains the squash. The only difference from the successful tested head is the fourteen reviewed blocker-priority documentation lines. Scoped postmerge reconstruction, diff validation and leakage checks pass. The original whole-CI proof retains its actual old base/tree; it is not relabeled as combined-tree proof.

#2126/#2190/#2340/#2355 close through the PR. PR and all completed/advanced issues, including already-completed #1837, read back at 0.44.0 after closure. Automatic main-push CI 39068036318 has started; its full result is pending and separate from the successful PR experiment. No push to the merged branch or manual dispatch follows.