ci: frozen theme fixture retains the caller before its reviewed Storage binding #2409

Out of scope

Do not refresh or weaken production qualification hashes, read the current producer as a positive fixture, accept unaudited configuration drift, change test selection or rerun failed qualification unchanged. Do not pin an unmerged feature commit that a future main checkout cannot fetch.

Context

Storage PR #2172 integrates #2388 into candidate 065d408b90ee48e733aa38d00faf67bfac913f1b, tree d54fba77cbd94fedffa16e2dfa2eb9607f048099, base main ea4c76c15eee2e23701910b7c2395bdd479b99c6. Its focused 10-file integration run reports 91 pass / one fail / 718 assertions. The sole failure is temporary theme output binds the audited command, copied theme and installed compiler: expected the two owned CSS inputs, received undefined (test, tests/generated-theme-inputs.test.ts:12-17). Native import-order, SDK relay, placement, Storage authority and cancellation controls pass.

The positive factory reads every producer and caller from the common main revision 498270fbdc4ef2788fdd3babb259b647d77f6c77 (frozenGeneratedSource, tests/frozen-generated-source.ts:8-14; fixture, tests/generated-theme-inputs.test.ts:11). That revision owns the old kit browser configuration. Storage already has a separately reviewed configuration adding its real browser command; its existing production binding pin is 89ea7a414a191a5624fce2dff8e0434aac5474c4c5b74d13499848cd17e2b257 (sources, scripts/generated-theme-inputs.ts:8-12). The shared frozen revision instead supplies the preceding e724696a55955e9f32d396b2031214600086533c3f9b8baabcc1c6bb7311f1db caller. Strict rejection is correct; the new positive fixture has the wrong owner for this already-audited caller.

Scope

Give this positive theme fixture an independently owned, committed copy of the reviewed Storage caller. Keep shared producer bytes on the existing frozen main owner and keep all production pins and rejection guards unchanged. Audit the other frozen-helper consumers for this mismatch class; their original focused controls already pass. Record the original failed integration and corrected proof separately.

Acceptance criteria

• The positive fixture binds the reviewed command, two CSS sources, locked compiler and checked completion using independent fixture bytes.
• Current producer changes do not redefine the positive. Existing caller, producer, input, execution-order and extra-importer drift controls still refuse binding.
• Restoring the old frozen caller fails the same named positive assertion; restoring the corrected fixture passes. The real offline compiler control remains exercised.
• Focused integration, required local preflight and selected hosted proof pass on the corrected candidate before any completion claim.

Verification

Run the existing three generated-input files and the focused Storage integration batch, retain the old-caller failing/restored receipt, then run bun run check:pr --base origin/main and complete selected hosted verification. The original draft hold preceded complete current-candidate qualification; that local and hosted proof now passes. The separate #2334/#2380 investigations retain their own requirements. This supports #1779 qualification without adding a Storage product requirement.

Contract impact

None. Only unshipped test fixture ownership changes; the already-reviewed production binding and package behavior remain unchanged.

Correction and local evidence

The diagnosed #2409 caller-fixture correction is committed as 9c4419b2df85c9ef69fd91c768369d713954e743. The original integrated run remains 91 pass / one fail. Corrected generated-input proof passes 20 tests / 88 assertions; an old-caller mutation fails the same named positive (19 pass / one fail), and restored proof passes 20 / 88. Production hashes and rejection guards are unchanged. All frozen-helper consumers were inspected; the other positives retain their existing independent producer owner. Lint passes.

Complete local and hosted qualification now passes for the delivered candidate, as recorded below. #2334 and #2380 remain open with their current reproduction/decision requirements.

Verified delivery — 2026-10-19

Delivered through #2172 as squash caae12da2e678dd4720bf112e93ef21812cfdc18, tree 0d0965b8c72bbe14644da018558ffc90ae2950fa, parent 0b46b9db7925ce2e52c85a56c6200a4e2f330bd7. The actual squash matches the inspected combined candidate exactly and is present on remote main. Release milestone: 0.44.0.

The positive generated-theme fixture owns an independent committed copy of the reviewed Storage caller. Production pins and negative drift guards are unchanged. The old-caller mutation fails the named positive and restoration passes; current hosted generated-theme proof also passes.

Ready-PR confirmation 39299288116, attempt 1 passed all 17 selected jobs on actual checkout ad44bb6228c13770b54797039233319fd58f6e44. All checkout logs and 13 resource receipts agree on the verified head/base/tree; no domains were retained. Local preflight passed 959 fast and 7,198 affected tests with four expected inverse empty vector placeholders, zero failures, across all 548 selected files. All 77 Storage browser/story cases passed. Prior failing-first and restored mutation receipts retain their original identities.

The original #2172 automatic main run 39302987919, attempt 1 remains failed: 15 jobs passed, unit (1) encountered the #2405 vanishing maintenance.lock fixture-copy failure, and aggregate proof failed. All 77 Storage browser/story cases passed there. Its actual checkout was caae12da2e678dd4720bf112e93ef21812cfdc18; no failed receipt was rerun or relabelled.

The separate test-fixture correction #2448 merged as cea53611ddea4916ac323060bfef42ec18118fea, parent caae12da2e678dd4720bf112e93ef21812cfdc18, tree 4a826e90467b5874be85ff71d04e9ede01577486. Its automatic main-push run 39312029459, attempt 1 passed all 17 selected jobs. Every actual checkout log and all 13 resource receipts agree on that squash identity; integrated-cadence aggregate passed with an empty retention ledger. All 77 Storage browser/story cases and all eight Git-policy regressions passed freshly on corrected main. The correction changes only the test preload, its regression tests and testing documentation; Storage product source is unchanged. Both squash commits are present on remote main.

Separate follow-ups remain open: #2334 needs reproduction; #2380 and #2279 await maintainer decisions following their newer contention reproductions. This delivery does not change their scope or claim to explain the exact historical failures.

2026-10-19 correction: replaced superseded candidate/verification status with the verified delivery and resolved implementation dependencies. Historical failed receipts and their stated limits remain preserved in the issue/PR discussion.