CONTRACT: fix(ui-sdk): qualify separate-UID native maintenance inputs

[schlessera]

What changed

Separate-UID native maintenance previously tried to enumerate worker-private stage data as the server and then launched under the wrong principal. It now prepares masks through the existing authenticated stage metadata, binds fixed Git/index inputs to the retained owner and command generation, and runs credential-free maintenance through the configured helper.

Frozen Git configuration, nested attributes and repository hooks use a bounded first-party collector under existing checkpoint authority. Fixed absent-input scaffolds remain protected without becoming invented publications. The disposable SQLite database family is copied into worker ownership with exact modes, WAL/journal preservation, bounds and poison-on-failure guards. Trusted server-state placement keeps transient identity sentinels out of brain checkpoints. Credentialed/no-helper paths retain their existing behavior.

Closes #2300
Closes #2343
Closes #2345
Closes #2347
Closes #2354

Refs #2364 (reproduction and safe fixture isolation only; persistent product history remains open)

Proof

Final correction head fca177100d20078d121b54f9f7491db3fe5bdfc4 addresses the actual hosted failures without changing production ownership/masking guards:

• Hosted run-KwnCWw found a server-private strict-publication fixture inherited by the next positive app. The new transition preserves exact owner/modes/bytes, proves real collector attrs/EACCES, then unlinks only the verified file and removes its now-empty parent. Persistent product histories remain unresolved in ui-sdk: strict private publication prevents later helper maintenance #2364.

• Intermediate run-rIgIKE passed that transition and fresh/warm indexes, then hit the original 90-second combined child deadline. The default now always executes controls → fresh → warm → strict children on the same manager, brain and UI database. Each retains 90 seconds, root retains 180 seconds; no control or outcome is deselected.

• Complete default run-pGRW4w at the final frozen head passes: controls 26.236s, fresh 19.833s, warm 27.800s, strict 18.114s; authenticated indexes return 200/success in all app phases. Original broker, reader, SDK and native manager controls plus both prepared-backend controls pass. All owned cleanup is immediate/zero with unchanged quota. The default non-shared Git fresh CLI warning remains explicit; supported shared-Git CLI/scratch criteria retain the separate scoped receipts below.

• In-process collector diagnostics now use the injected structured Logger; child CLI JSON uses exact stdout/stderr protocol writes. Named no-console failure restores to pass. An emission omission fails COLLECTOR_REFUSAL_REACHES_INJECTED_LOGGER (1 versus 0).

• Ready CI 39070881983 at head 991f0ee661550f728807d66ae45e844f0a4e0ac1 / merge 34ac80f874719684d2ba9158f7f278517396253a passed every selected non-unit category, including complete hosted native proof. The run remains failed overall because unit shards found the two fixture classes corrected here.

• The helper problem was ownership mapping, not an unresolved executable alias. CI unit workers preserve a single non-root UID with unshare --map-current-user; installed root-owned executables are then observed as unmapped UID 65534. Local installed metadata under that exact mapping confirms regular 0755 /usr/bin/true, UID/GID 65534, and the status file reproduces the same three named failures. The earlier alias-only explanation was incomplete.

• Status/gate/placement tests already replace probe execution. Their scoped lookup fixture now recognizes one fictional qualified marker, delegates every other input to the real lookup, and restores the complete original export descriptor. Invalid helper configuration still exercises the production guard. The exact mapped-namespace run passes 33 tests/200 assertions. Broadening the marker or omitting restoration fails the named no-helper/descriptor assertions.

• The owned-prune diagnostic producer now matches the logger-aware source call. Missing/duplicate source anchors still refuse; real original/generated method execution checks all four command/output/signal/logger argument identities. Dropping the generated logger argument fails OWNED_PRUNE_GIT_ARGUMENT_COUNT_PRESERVED. Restored helper/prune/citation checks pass 48 tests/213 assertions. Production and default-native inputs are unchanged by this eight-file fixture correction.

• An optional extra local sync-mirror consumer batch was mistakenly selected after the native pass. It included the stopped ui-server: retain unsafe host-writer admission through actual descendant lifetime #2284 writer-lifetime controls, so it was interrupted (exit 130); its partial failures remain failed/incomplete, with no passing receipt or cause attribution. No targeted writer investigation, diagnosis or rerun follows. Standard complete hosted affected CI remains required and unchanged.

• Retained fast preflight groups at head 991f0ee66 pass: lint, env docs, pending changeset validation, all 47 selected fast-invariant files (950 tests/6314 assertions) and the contribution changeset gate. The earlier long import-graph feedback retains its original recorded head/base under the maintainer no-refresh instruction; it is not called a run on the correction.

• Current frozen fixture correction lint/types pass. Logger/console/citation checks pass (56 tests/202 assertions); phase/retention/boot checks pass (9 tests/71 assertions). Omitting strict fails DEFAULT_NATIVE_FULL_PHASE_INVENTORY. Earlier broad preflight and scoped runtime results retain their original identities below; the final production delta is diagnostic transport/logger wiring only.

• Required bun run check:pr --base origin/main passed at head 045f5cf212ef4a4ce02507f5ec15b57d11c25ae7, base 2a0b77f675da2f01c32adba3f4920650a5ee09fa: 2884 passed, 0 failed, one existing delegated-cgroup skip; 23352 assertions. Production code is identical through the first PR candidate 986fc96904d48d4a00c9663b03fca625247b5b5e. Later eight fixture/runner files have 53 focused passing tests/232 assertions and final strict types. Final lint, environment docs, pending changeset manifest validation and complete changeset status pass.

• Offline native governed run-PjQDLa: actual private attributes/repository hook commit, fresh Git object/index/ref publication, fresh/warm createApp, authenticated index, canonical/backend governed WebSocket execution, joined automatic boot prune and empty diagnostics. Independent strict run-3CZfgK passes its own private/Git/app history.

• Final same-brain DB-repeat run-O4Crjn: fresh app followed by two actual authenticated warm HTTP index publications, both 200/success, on the same application, brain and UI database. Each request correlates to a distinct attested checkpoint, manager stage UUID and keeper process generation. Numeric mount device/inode recycling is accepted only after independent generation validation; held-FD identity checks remain intact. The exact fixed observer substitution and eight frozen fixture hashes match retained artifacts.

• Each scoped native run removes owned broker/source/worker resources, filesystem mount, loop/backing and container with unchanged namespace quota. Prior completed unchanged-source controls cover six private-input refusals, six ordinary relay cases, 28 restricted relay cases and stage/principal/mask/publication/generation controls.

• Failing-first receipts retain the actual original descriptor denial and old-principal output denial. Copy-up omission fails ACTUAL_MANAGED_WARM_AUTHENTICATED_INDEX; poison omissions fail ACTUAL_INDEX_POISONED_RETRY_readonly / ACTUAL_INDEX_POISONED_PUBLICATION_readonly; restoration passes all eight native refusal cases. WAL omission fails INHERITED_INDEX_MEMBER_IS_COPIED_brain.db-wal; restored SQLite WAL/SHM/hot-journal checks pass. Collector foreign-root omission fails FOREIGN_ROOT_REFUSES_BEFORE_GIT. Trusted-placement omission fails PROBE_STATE_ORIGINAL_COLLECTOR_SUCCEEDS; restored native placement passes. Five final fixture omissions/owner/generation mutations fail their named assertions and restore to pass.

• The broad preflight describes its recorded base. Live main subsequently added priority-inheritance documentation and PR test(ci): qualify browser retention and snapshot fault ownership #2293 browser-retention/build-diagnostics proof tooling. Those changes do not alter native maintenance production inputs; their combined candidate must receive fresh hosted confirmation. Retained local evidence is not relabelled as a run on that newer tree. Hosted candidate proof remains pending.

Checklist

• Complete selected hosted proof passed; local and scoped native receipts above retain their actual head/base identities.
• Scoped issue acceptance is covered by the named application and adverse scenarios; remaining limits are below.
• PR and five completed issues target confirmed upcoming release 0.44.0; registry currently publishes 0.43.1.
• Changesets name the affected shipped packages; full pending release plan validates.
• Leakage gate passes; fixtures use fictional data.
• Internal package API report and integration contract component reflect the added fixed preparation operations.
• Relevant decision records, source citations and environment docs are updated.
• No provider-history rewrite.

Anything left open

The original full/default native failures remain failed/censored. Earlier named application scenarios capture the existing automatic boot-prune promise, and DB-repeat adds a hash-only stage observer; those receipts retain their scoped attribution. The final corrected default run executes the entire default runner without variant flags and is separately recorded above. Earlier failed immediate cleanup and later eventual OS cleanup remain separately attributed. No deadline, secret-mask policy, helper authority, default profile or provider routing is widened.

The safe fixture transition does not repair persistent strict-private-publication→maintenance compatibility; #2364 retains that product gap.

Host-writer descendant/lifetime investigation #2284 remains stopped and unresolved. This PR does not claim universal writer-topology completion, production installation, live provider access or autonomous activation.

[schlessera]

Post-merge proof reconciliation: automatic main-push CI 39074386791 at squash 498270fbdc4ef2788fdd3babb259b647d77f6c77 completed cancelled, not green. Browser shard 1 (job 117518567724) exceeded its 15-minute job limit; the selected-proof aggregate failed accordingly. All other selected pre-aggregate jobs passed, including native runtime and all four unit shards. No unchanged rerun was requested.

Later automatic main runs 39076525398 at 82a64a13a08c44f2daef425d1a9df2c10840ea8e and 39078216213 at 63fde3c8fe76e754aa4524f95b23f9786f4447fe separately passed. Those later results retain their own identities; they do not rewrite the original cancellation. The passing ready-PR candidate, exact landed tree/parent and five delivered issue closures remain as recorded.