[schlessera]

Refs #2403

What changed

The hosted adapter fixture now retains its application result, indexError, fixture-memory receipt and maintenance request/result or explicit error metadata when an existing curated add/update/archive success or indexed assertion fails. Successful cases stay quiet. The real request is forwarded unchanged; all six success/indexed expected values, inner deadlines and worker/publication guards remain.

The capture omits execution environment and credential fields and arbitrary error-property bags. Worker output and error text are retained intact without a new size limit or general secret-redaction layer. This diagnostic is suitable only for this fixed offline fictional fixture. Fixture receipts are in memory; no durable production recording is claimed.

Why this shape

The original combined #2403 failure returned ok=true/indexed=false without retaining its indexing error. A failure-only assertion message keeps that missing evidence available for a future occurrence. This is diagnostic coverage, with no production repair or natural historical cause attribution.

Proof

Current head d3f5bc503de28af63d88de315656c34d10888d5f, tree c1b12f692c377f1d994867898f7771e92585652b, base 7c5c978825b348bd2bf192c544b1d58163226311. History-preserving refreshes introduced relevant maintenance/stdin/publication, offline Git guard and preflight/build-producer changes. The current evidence below requalifies this identity; earlier receipts retain their earlier identities. The diagnostic contribution remains one file, mode 100644, blob 8b7b9e22e37ac01b96f4ddc8b812c601a3673e2f, SHA-256 9f7ac107465e3f85dacf430fc20a08e78639f906a93b750ca88d5d5f87c20290, stable patch ID 553004cd99cc6feec3554e90ef4b40a1056267a0.

Independent R2 source review reported no findings across the complete scoped file and actual current call paths. The diagnostic adds no resource owner. That review is separate from runtime evidence and does not establish the missing historical cause.

Fresh Bun 1.4.3 controlled validation on this head/base ran exactly three arms:

• Original adapter from current base plus a controlled index-only worker error: exit 1 after successful load/planning at the original indexed=true assertion, without the retained diagnostic; 1.185 seconds. Log SHA-256 0c2a0e07b821f2e6ec4c2b4f04a134b53d1d75fad32034dd06540174233a015d.
• Candidate adapter plus byte-identical worker control: exit 1 at the same indexed assertion; complete parsed application result/indexError, successful plan, maintenance response and matching fixture-memory receipt verified; 1.158 seconds. The worker returned JSON ok=false with exit 0 and empty stderr. Credential/environment request fields are absent. Log SHA-256 3f9ea44efd8c914a8c82830df60282a5620c8aeb7248cd353275d8ae3267e714.
• Restore the fresh current maintenance entry and candidate adapter byte-identically, retaining the storage-facts branch; run the full adapter file once: 14 pass / zero fail / 101 assertions, quiet success; 6.364 seconds. Log SHA-256 e5e82615fc90f8fa542dade8810e2f54e60c7c0978c3f625ddb7096c98a73083.

Each arm used the repository test wrapper under the existing five-minute outer cap and ten-second termination grace, with original test/worker guards and deadlines unchanged. No cap was reached. Current maintenance-entry SHA-256 restored to 4068bc974259b6e1e19729cf9c3be8532058db5ed37c1d7c1be54a4179502bd8. Source remained clean; fixture roots, owned processes and reservations drained, and the repository output lease released.

One strict root bun run typecheck passed (50.360 seconds); bun run lint, environment documentation, pending changeset package names and contribution changeset checks passed. No build/install or native/browser/provider/Docker prover ran. No repository citation points into the changed adapter test.

One actual default bun run check:pr --base origin/main on the current head/base exited 0 in 43.406 seconds. Lint/leakage, environment docs, pending changeset names and contribution changeset gates passed. Fast feedback observed exactly auth, HTTP-principal-boundaries and session-cookie: 53 pass / zero fail / 1,371 assertions in three files (4.60s). Actual import-graph feedback observed only the adapter file: 14 pass / zero fail / 101 assertions (8.68s). No selected case was skipped or filtered. Log SHA-256 8d95b73b0b0381008cd8741017e72336e442573a4fc75df90f9795f4a99fcae5.

The accepted raw-plan artifact and handoff were separately hash-verified, and their parsed plans matched exactly; no new plan ran. An earlier admission paired the raw-plan hash with the handoff path and stopped before product execution; that coordinator transcription error and refusal remain preserved separately. This was the first and only actual default invocation at this head, with no retry, new source mutation, additional focused/type/build command or broader category execution. The source remained clean, tracked owned descendants drained, private ledger reservations reached zero, output lease released and owned temporary cache/audio remnants archived. Current local preflight is focused evidence; complete selected hosted proof remains pending.

All runs use owned offline namespaces with ordinary UID/GID 1000, unchanged normal HOME, zero capability masks, original /tmp visibility, private TMP/cache/ledger and both unfiltered IPv4/IPv6 empty-main-route guards. Fresh RAM and filesystem floors were admitted; Btrfs inode 0/0 remains unknown, with bounded own write/read/unlink probes. The private frozen installation retains its unchanged lock, singly linked dependency files and local workspace links; this is not blanket cache or producer qualification. The dormant isolated build operation remains unqualified and was not enabled.

Earlier original/candidate/restored 14-test/101-assertion controls belong to d425d6651cea558b51c73e4afe8da6400d855206 / base 685d83e22cc452e97a2c92ef7ae683f34ceb2371. Earlier 53-fast plus 14-feedback preflight belongs to 5e78322958e1234ad7324da7ac15ac42ded2b839 / base 90a95123cfceb169bd2ecf7c213544db742eaed7. Neither is relabeled as proof on this head. The original failed combined run on d54b10667a91d799289f16560731d669fdf943b0 / 775eb17aab740fa759c2182f306c38fc17acbcbe and subsequent recovery/incomplete receipts remain preserved separately.

Checklist

• Complete selected hosted proof passed with actual candidate/base/job checkout identities. Current local evidence is supplied; hosted confirmation remains pending.
• All issue acceptance criteria are complete. The historical cause and required failure evidence remain missing.
• Existing PR and issue target 0.44.0; read back again before integration.
• No changeset: test diagnostics only, no consumer-visible behavior change.
• Public body and source leakage screening passed; fictional fixture data only.
• No machine contract, documented production behavior or provider-history path changed.

Anything left open

Keep the PR draft and #2403 open with needs: repro. The actual natural post-write indexing error and associated refusal/ownership evidence remain unknown. #1364/#2377 require their own causal-evidence resolution and complete candidate qualification. Complete selected hosted confirmation, readiness, reservation and integration merge remain centrally coordinated by the root. Main's automatic proof is a separate pending assessment; no blanket current-main green claim is made. This partial Refs diagnostic neither closes the issue nor supplies a production repair.