tests: policy-write-boundary claude governed native Write intermittently refused as not governed #2899

Context

tests/policy-write-boundary.test.ts "claude governed: native, shell and CLI writes succeed while policy and ancestors hold" fails intermittently at its first native-write assertion:

expect(native[0]!.result.isError, native[0]!.result.output).toBe(false);   // tests/policy-write-boundary.test.ts:285
error: PreToolUse:Write hook error: Native writes require a governed typed turn.

The refusal text comes from toolAvailabilityRefusal (packages/ui-backend-claude/src/tool-availability.ts:17-22). It refuses Write/Edit when req.workerSandbox?.profile !== "governed". So in a failing run, the governed probe's Write call reached a turn that had no governed worker sandbox.

Observed on 2026-10-25 on a shared, loaded host:

• On clean origin/main d9f4405, run alone with bun run test ./tests/policy-write-boundary.test.ts: it failed in 1 of 2 runs, with 18 pass and 1 fail on the first run.
• On a branch that does not touch this path (fix(ui-server): record a Claude memory save in the journal's observation order #2888), it failed once in a full bun run test ./tests run. It then passed 19/19 in 2 isolated runs.

The cause has not been investigated. This issue records the observation only and still needs scoping.

Scope

Reproduce the failure, find why the governed probe's turn sometimes lacks a governed workerSandbox, and make the test deterministic. Possible causes include governed availability racing worker-host qualification under load, or a probe timing assumption.

Out of scope

• Weakening the assertion or the refusal in toolAvailabilityRefusal.
• The pi adapter cell, unless it shows the same failure.

Acceptance criteria

• Capture the exact governed cell’s turn/profile and workerSandbox at admission, worker-host qualification and the rejecting hook, with source/runtime/load and the first native-write outcome correlated to that turn. A passing isolated rerun is not attribution.
• Establish whether the governed sandbox was absent, replaced, or attached to another request; report finite failed attempts and the missing boundary if unreproduced.
• Any correction keeps the native-write success assertion and the ungoverned refusal guard. A causal control/mutation fails on the repaired boundary; restored isolated and full ordering retain every policy/ancestor protection assertion.
• Retain historical failed and passing receipts separately. No product fix is selected without the authority/qualification timeline.

Verification

Repeated isolated and full-suite runs on a loaded host, and a failing-first receipt for the cause.

Contract impact

None expected.

2026-10-25 triage at main ab746a434c4ada11734ffea4e208d1d6211f1aca: Completed the concrete guarded-profile reproduction/attribution brief and sorted wanted unscheduled work as p2. Retain needs: repro: the reported rejection does not establish why that turn lacked a governed sandbox. Keep standalone at #736’s direct-child limit.

Later full-ordering recurrence — reported 2026-10-26

The additional #2900 receipt, head 16dc0c7533b8c3bb4242bfe7f20f6b484cbb3b9a over base c670449d3bf1b0639e50ce554d728961f4313add, reports a complete root run with frozen dependencies and shared heavy-command slots: 1963 pass / 3 fail, 74310 assertions, 179 files, 790.49 s. The Claude governed native-write case failed the original isError === false assertion at line 285 with “Native writes require a governed typed turn” (2523.93 ms). A separate complete base policy-boundary file passed 19/19, 587 assertions, 45.40 s; this is not a full base root comparison. The separately filed Pi scratch and shell-visibility failures are #2987/#2988 and remain distinct.

These are the reporter’s failed/passing receipts, not a new local reproduction or sandbox-profile attribution. The follow-up issue bodies record one full-base comparison interrupted before execution; that is an incomplete historical attempt, not a status claim about any later queued run. Subsequent complete base/head controls are recorded below; the earlier interruption remains a separate incomplete attempt. The missing admission/qualification/hook timeline remains needs: repro.

2026-10-26 triage at main 2577504d2a75f01d8286896a44b3f5a848e8bdb6: folded the new attributed recurrence into the active body without changing original failures, scope, priority or unresolved causal evidence. No readiness or product correction is inferred.

Completed follow-up controls — reported 2026-10-26

The later #2900 receipt supplies the previously missing complete comparisons: unchanged base c670449d3bf1b0639e50ce554d728961f4313add passed 1966/1966, 74408 assertions, 179 files, 657.81 s; unchanged head 16dc0c7533b8c3bb4242bfe7f20f6b484cbb3b9a, in the same checkout as its earlier failed run, passed 1966/1966, 74408 assertions, 179 files, 667.16 s. Every policy-boundary cell passed in both controls. Isolated complete policy files also passed 19/19 on each source.

Retain the original 1963-pass/3-fail head receipt and exact governed native-Write refusal. No code, assertion or timeout changed between the reporter’s failed and passing head runs. These completed controls establish variability, not the missing profile/qualification/hook timeline or a repair. The different Pi failures remain #2987/#2988. Earlier “queued/interrupted/no complete result” statements describe their historical attempts and do not supersede these completed controls.

2026-10-26 triage at main 2d4671ac187dd2b7a08069e2571ef0a75ee1f44f: folded the completed attributed base/head comparisons into the active specification. Keep p2 and needs: repro; no new local reproduction, profile attribution, readiness or correction is claimed.