test(ci): bind native positive fixture to frozen source

[schlessera]

Current candidate qualified — 2026-10-19

Ready confirmation 39174651919, attempt 1, passes every selected job and the final aggregate for head 2da0ef1d309d86bfb0725eaa6a6821b0a0b34bf6, base/live main 685d83e22cc452e97a2c92ef7ae683f34ceb2371, actual checkout 8b2af25d86150e31b547e056fc7a8c251d206f6b, tree b1d10ffddd898b01c04574a48611696004a2450a.

The parent inspected actual checkout logs from changeset 117814730975, verify 117814962053, unit shards 117814961987 / 117814962067 / 117814962016 / 117814962017, and proof 117815901086. All seven checked out that immutable merge; requested BASE_SHA/HEAD_SHA, all four unit resource receipts and the final ready-candidate receipt agree. The immutable Git API and local objects confirm exactly base/head parents and the same tree. The aggregate confirms all remaining skips are planner-intended; no domains were retained. Current contract proof also passes. Independent review found no code findings; existing genuine failing-first and restored mutation/preflight/type receipts retain their recorded source attribution.

Both PR and completed issue #2365 retain milestone 0.44.0. The parent owns the matching-head merge and post-merge squash tree/ancestry, closure and automatic-main proof reconciliation. Prior incomplete and historical runs remain separately attributed.

Current confirmation window — 2026-10-19

Independent review found no code findings in the one-file native qualification self-test correction. The documented REST pull-request update with base=main resolved the stale requested-base metadata without changing source, head or target branch. Separate parent readbacks confirm REST base and independently queried live main 685d83e22cc452e97a2c92ef7ae683f34ceb2371, unchanged head 2da0ef1d309d86bfb0725eaa6a6821b0a0b34bf6, and immutable synthetic merge 8b2af25d86150e31b547e056fc7a8c251d206f6b with exactly those base/head parents and tree b1d10ffddd898b01c04574a48611696004a2450a.

The existing complete local preflight, types and restored mutation receipts remain attributed to this unchanged head/base/tree. Production binder, complete inventory, frozen fixture and qualification hashes remain unchanged. Historical confirmations retain their actual identities; none is relabelled as current proof.

The current campaign owns the first final-confirmation and merge window under transferred claim 044-native-20261018. Fresh ready-candidate confirmation is now requested. Every selected job, actual requested identity, checkout and aggregate must qualify before matching-head merge and main reconciliation. Both issue and PR retain milestone 0.44.0. No merge or current hosted success is claimed.

Closes #2365.

What changed

The native diagram qualification self-test now materializes its positive control from the complete raw Git blobs and executable modes owned by immutable delivered commit 0d780605fe1ea9a281cce947b1f0074f3f3e7acc. Legitimate current source drift is tested separately as requiring fresh native proof. Named controls preserve the complete 859-file inventory, source content/modes, all three pins, importer sealing and installed origin. Controls run separately within the unchanged 30-second per-test limit.

Why this shape

Copying current candidate package bytes made the positive fixture contradict the frozen qualification identity. The delivered Git artifact provides independently owned expected bytes without duplicating the corpus. The existing raw-blob snapshot protocol preserves original modes and avoids archive substitutions. Production binder code, qualification hashes, source inventories, runtime requirements and retention policy are unchanged. No consumer-visible behavior or changeset.

Proof

Own frozen dependencies, Bun 1.4.3; ordinary-UID, route-free network namespace with loopback only and dropped capabilities, retaining the test preload:

• Failing-first: the unmodified test on actual CONTRACT: enclose diagram groups and honor scene origins #2369 merge checkout 50c1bb81b6b96d7fc2d6cb92936dfa5b97f3253b (parents main 498270fbdc4ef2788fdd3babb259b647d77f6c77 and head 42c83eb2a2d6ba77dc5fc6fe74909a7e822420f9, tree 651c4b0acc7eb3081401b3829fbf967bcc1fbda0) fails the original COMPLETE_NATIVE_QUALIFICATION_WITHOUT_DOCKER_OR_IMAGE_LOOKUP: expected 859, received undefined. This independently reproduces run 39074479367 / job 117518971447. The original test(core): control malformed conformance fixture deadlines #1943 / run 39068372996 receipt remains separately failed.
• An additional unchanged-test attempt on main 498270fbd timed out at its existing 30-second limit after 13 assertions. It remains failed; splitting independent controls changes no deadline or refusal assertion.
• The corrected self-test plus source materialization, installed identity and worker-audit controls on the same actual CONTRACT: enclose diagram groups and honor scene origins #2369 checkout pass 28 tests / 51,880 assertions (44.85 seconds). After all mutations are restored, the same 28 tests / 51,880 assertions pass (38.00 seconds). The actual changed candidate stays unqualified while the independent frozen positive qualifies.
• Removing the source mismatch refusal fails both NATIVE_SOURCE_ADDITION_REQUIRES_REQUALIFICATION and CHANGED_CANDIDATE_MUST_KEEP_FRESH_NATIVE_PROOF (binding unexpectedly returned). Removing importer sealing fails NATIVE_IMPORTER_REQUIRES_FRESH_PROOF; removing pin refusal fails NATIVE_PIN_REQUIRES_FRESH_PROOF for the proof script; removing mixed-installation-origin refusal fails NATIVE_INSTALLED_ORIGIN_REQUIRES_FRESH_PROOF. Replacing the frozen artifact with current HEAD fails COMPLETE_FROZEN_SOURCE_INVENTORY (expected 859, received 861). Every failure is an intended assertion failure; production scripts are restored byte-identically.
• Required bun run check:pr --base origin/main passes all contribution gates and 453 tests / 53,904 assertions across 22 affected files; the final import-graph feedback also passes 10 tests / 51,804 assertions. Original implementation source commit e7410e696c5ef8eb8efedd88aaa3749af853c89e, base 498270fbdc4ef2788fdd3babb259b647d77f6c77, tree 2aefb2b8f97668bd1c4b19749fbd7d850135c156. The tested self-test SHA-256 is 57e1392dacc28540455035f24983297312e5d4b0dc06c07fb1650b2a4281f690; it is byte-identical to the corrected/restored CONTRACT: enclose diagram groups and honor scene origins #2369 control.
• Complete selected hosted current-candidate proof remains required before merge. The planner selects strict types and complete affected unit/proof tooling; packaging, browser/layout/endurance/capture/native-runtime categories are intentionally unselected for this test-only change. The scoped local controls do not claim a hosted native producer execution or a retention hit.

Prior ready confirmation 39076303374, attempt 1, used head e7410e696c5ef8eb8efedd88aaa3749af853c89e, base 498270fbdc4ef2788fdd3babb259b647d77f6c77, synthetic checkout f7393c4920c5c67177eb313dc8b2e96ed968819c, tree 2aefb2b8f97668bd1c4b19749fbd7d850135c156. Verify job 117524363094 failed strict tsc --noEmit with TS2769 at test line 88: optional diagnostic status was passed as the expected string. The workflow concluded cancelled: unit (1)/(2) succeeded, unit (3)/(4) and proof were cancelled. These are incomplete failed/cancelled receipts, not passing candidate proof. The earlier opened-draft run 39076284499 remains separate cheap feedback.

The correction explicitly requires the current diagnostic before comparing its status. A whole-file/diff audit also replaces optional source/pin expected-value comparisons with assertions requiring the diagnostic, actual source identity and expected pin record/actual pin before comparing. The expected source still equals the independent frozen constant, and all refusal comparisons remain. Full repository bun run typecheck reproduces the exact TS2769 error before correction; unlike focused preflight, this command executes the complete tsc --noEmit configuration.

Prior correction candidate: head 80968a3b183af958ddebcb756b632f04909ffec1, integrated base 82a64a13a08c44f2daef425d1a9df2c10840ea8e, tree 6856786f9d61611cae52b060d37a28fa29778a22. The intervening main change #2371 adjusts TCP test listener ports and does not change the production binder or frozen qualification; it is integrated for candidate freshness. Self-test SHA-256 df368d2c560c1c2ebc8b94a333742258e0b272d2112a035795c6bf1dfc46addd.

• Complete repository bun run typecheck (tsc --noEmit, unchanged strict configuration) exits 0 after correction. The exact pre-correction TS2769 receipt remains failed.
• Offline native/source/installation/worker-audit controls pass 28 tests / 51,871 Bun assertions, with additional explicit Node strict assertions establishing diagnostics and pin identities.
• Committed bun run check:pr --base origin/main passes contribution gates, 453 affected tests / 53,907 Bun assertions and 10 import-graph feedback tests / 51,807 Bun assertions. This preflight does not replace the separately executed full strict typecheck or hosted proof.
• Two additional test-fixture mutations remove the current diagnostic or expected pin record. Existing controls fail at CURRENT_CANDIDATE_MUST_REPORT_DIAGNOSTIC and PIN_REFUSAL_MUST_REPORT_EXPECTED_PIN, respectively. Both mutations are restored byte-identically; restored targeted controls pass 2 tests / 10,357 Bun assertions; the original five production-refusal/positive-ownership mutation receipts above keep their original candidate attribution.

Historical confirmation 39077107584 / attempt 1 passed the selected changeset, verify, four-unit and aggregate jobs at head 80968a3b183af958ddebcb756b632f04909ffec1, base 82a64a13a08c44f2daef425d1a9df2c10840ea8e, synthetic ff4a2b4d590353772b102f596a76a22259b1e9c6, tree 6856786f9d61611cae52b060d37a28fa29778a22. Earlier draft and failed receipts remain separately attributed.

Historical confirmation 39086344533 / attempt 1 passed on head bedb7ba0396df63c3d93a609e1143f1227ca464e, base 68e12f27eb249c9fe7262a498a0397c04bbda8f4, synthetic 566105cd9cae2b76f87a47168dec6c78500b6134, tree 9775660cd663116e39d76b0655f31aa7c6970e62. Selected jobs: changeset 117553667291, verify 117553827444, unit (1) 117553827496, unit (2) 117553827400, unit (3) 117553827431, unit (4) 117553827405, proof 117554702356. Actual requested BASE_SHA/HEAD_SHA and all selected checkouts agree; all four unit resource receipts and the final candidate receipt agree. The aggregate confirms remaining skips were planner-intended, with no retained domains. That is historical passing proof only.

Previous candidate, 2026-10-18

2026-10-18 refreshed candidate: head a67c4196699d0c7b73f28f712de0ea13f6d2f5db, verified integrated base/live main 7f22bb6ac2892360f3a5c4d3a1f93d9997af43e8. Before ready, REST PR requested base, independent live main, fetched synthetic merge and immutable Git API agree: synthetic 5819700fb710620090258ab9902e1494462af62e, parents exactly base/head, tree c6cb485a8816a2945dd36bad23ce0f4b51128ea9. The tested committed head has the same tree.

Five intervening main commits deliver independently frozen generated stylesheet fixtures (#2388), cancellation fixture temp placement (#2407), worker XDG import-order correction (#2299), sandbox-note prepared-output cleanup (#2411) and the callout geometry/capture split with document-binding re-audit (#2393). Worker source changes legitimately change current native source identity. GitHub cached the previous PR base, so verified main was integrated without rewriting history. No conflicts. The PR diff remains only the native self-test; production binder, complete inventory, qualification pins/hashes and frozen source owner remain unchanged. Generated stylesheet and native positives keep their independently owned raw Git blobs.

Fresh ordinary-UID route-free offline controls, with loopback only, dropped capabilities and the unchanged preload/deadlines, pass 28 tests / 51,871 Bun assertions in 17.87 seconds. Full strict bun run typecheck passes. Committed bun run check:pr --base origin/main passes all contribution gates, 453 affected tests / 53,907 assertions and 10 import-graph feedback tests / 51,807 assertions. Self-test SHA-256 remains df368d2c560c1c2ebc8b94a333742258e0b272d2112a035795c6bf1dfc46addd. Original failing-first, TS2769 and intended/restored mutation receipts keep their actual historical attribution. No consumer-visible change or changeset.

Fresh ready confirmation 39111042672, attempt 1, is requested and pending at the initial handoff read. Draft/push feedback 39111013813 is separate; contract run 39111013789 passed. No current hosted green or delivery is claimed. Parent owns watching, actual requested BASE_SHA/selected job checkout and inventory/aggregate validation, fresh review/head/live-base/milestone readbacks, matching-head merge and delivered-main/closure reconciliation. Both issue and PR retain milestone 0.44.0. #2228 / #2369 and all other issue branches remain untouched and need their own qualification after this prerequisite lands.

Implementation custody returns to the parent. Claim p1-2365-native-fixture-20261018-r2 is released under serialized cleanup after fresh uncontested ownership reconciliation; preserved branch and receipts remain available. The implementation sub-agent does not watch or merge. PR linkage is registered and verified.

Campaign candidate, 2026-10-18

Claim 044-native-20261018: refreshed head 2da0ef1d309d86bfb0725eaa6a6821b0a0b34bf6, base 685d83e22cc452e97a2c92ef7ae683f34ceb2371, tree b1d10ffddd898b01c04574a48611696004a2450a. The non-rewriting integration preserves prior head a67c4196699d0c7b73f28f712de0ea13f6d2f5db; main advances #2381, #2415 and #2398 are included. Only the native self-test differs from main. Its SHA-256 remains df368d2c560c1c2ebc8b94a333742258e0b272d2112a035795c6bf1dfc46addd; production binder, complete inventory, qualification pins/hashes and independent frozen source remain unchanged. No shipped package or contract change and no changeset.

Historical ready confirmation 39111042672 attempt 1 passed all selected jobs at the prior head and base 7f22bb6ac2892360f3a5c4d3a1f93d9997af43e8, checkout 5819700fb710620090258ab9902e1494462af62e, tree c6cb485a8816a2945dd36bad23ce0f4b51128ea9. This continuation verified metadata/verify/unit checkouts, all four resource receipts, the final candidate receipt and immutable API parents/tree. The aggregate confirms planner-intended skips with no retained domains. That proof is historical, not proof of the refreshed base.

Fresh local receipts:

• Initial preflight and offline attempts failed before assertions with ENOSPC. Capacity subsequently became available; those setup failures remain recorded.
• The first frozen copyfile install from the existing shared cache produced installation identity 0f4614b41729d5f1c974a88f0497b77c088c045de6b71a3012ff91d543c2df51, matching the affected identity already documented in ci: isolate diagnostic dependency edits from the shared install cache #1980. Offline controls failed 23 pass / 5 fail, including the frozen positive. These failures remain separate from source drift and passing recovery evidence.
• Replacing only this owned installation using a fresh private cache and bun install --force --frozen-lockfile --backend=copyfile restores qualified installation 0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245: 843 packages, 59,516 files, 1,833,832,361 bytes. The recovered Vitest chunk hash is a236001d048380e2c67d05423fc9ea3f26b07ee019ba8d6e622082f29d49102e. The shared cache and other installations were not modified. ci: isolate diagnostic dependency edits from the shared install cache #1980 preventive work remains separate.
• Ordinary-UID route-free offline namespace controls with loopback only, dropped capabilities and unchanged preload/deadlines pass 28 tests / 51,871 assertions before mutation and again after restoration (10.59 seconds restored).
• Removing the production source-mismatch refusal makes added package source requires native requalification fail at NATIVE_SOURCE_ADDITION_REQUIRES_REQUALIFICATION because binding is unexpectedly returned. Production binder is restored byte-identically, SHA-256 42defd431b016ab527652188a2dd0bad4f249eb49e52e69097b015f5bdabe4f5. Original positive-ownership/importer/pin/origin and missing-diagnostic mutations retain their historical attribution.
• Full strict bun run typecheck passes with the recovered dependencies. Committed bun run check:pr --base origin/main passes all contribution gates, 456 affected tests / 53,933 assertions and 10 import-graph feedback tests / 51,807 assertions. git diff --check origin/main passes.

PR #2374 stays draft. No fresh ready-candidate confirmation, auto-merge or merge was requested. Parent retains the serialized assignment and owns the first proof/merge window, actual final requested base/head/selected-job checkout reconciliation, review and milestone readbacks, matching-head merge and delivered-main verification. Both issue and PR retain milestone 0.44.0. #2409 remains independently owned and untouched. This candidate is locally ready for that window; complete fresh selected hosted proof remains required.

Checklist

• Complete selected hosted proof passed; actual head/base/job checkout evidence is recorded.
• All acceptance criteria and required proof are satisfied before matching-head merge.
• Issue release milestone is 0.44.0; PR receives the same milestone on creation.
• No consumer-visible change; no changeset.
• Public text and repository leakage gate pass.
• No machine contract, documented behavior or provider-facing history changes.

Anything left open

Selected hosted candidate confirmation, review and matching-head delivery remain required. Parent owns hosted-check watching and final merge/current-proof/milestone/ancestry/closure reconciliation. The original failed workflows remain failed; subsequent sibling browser closures in #2369 are not claimed as independent runtime defects. No frozen native fingerprint refresh or unqualified retention is authorized.

Historical identity readback (superseded by the current confirmation section): remote head is 2da0ef1d309d86bfb0725eaa6a6821b0a0b34bf6; live main remains 685d83e22cc452e97a2c92ef7ae683f34ceb2371. Immutable synthetic merge 8b2af25d86150e31b547e056fc7a8c251d206f6b has exactly those base/head parents and tree b1d10ffddd898b01c04574a48611696004a2450a, matching the local tested head. However, REST PR metadata still reports base.sha as 7f22bb6ac2892360f3a5c4d3a1f93d9997af43e8. Resolve/re-read this cached requested-base discrepancy before requesting expensive candidate confirmation; a correct synthetic merge alone does not establish a correct requested BASE_SHA. Draft feedback run 39133700370 is separate cheap feedback, not candidate proof. Parent retains proof/merge custody and the sole issue assignment; no cleanup removes that parent-owned claim.

[schlessera]

Automatic main proof reconciled — 2026-10-19

Automatic main-push run 39175300737, attempt 1, concludes failure on the actual verified squash 90a95123cfceb169bd2ecf7c213544db742eaed7. Fifteen execution jobs pass; browser shard 2 fails the unchanged module-settings dark/320 whole-test 15-second deadline, and the aggregate fails. The same existing failure class is tracked in #1229; its new actual checkout, timings, totals and artifact limitations are recorded there. The responsible phase remains unattributed. No unchanged retry, timeout increase or production patch was selected.

The delivered native self-test correction retains complete selected PR confirmation and an exact matching squash parent/tree; no browser source changed in its diff. Issue #2365 remains closed for that scoped correction, and both PR and issue retain 0.44.0. This does not make automatic main CI green or establish a cause for the separate browser failure. Downstream candidates still require their own complete selected proof.