fix(ci): refuse slow Linux sandbox setup before local preflight

[schlessera]

Refs #2370

Candidate and correction

Candidate head 832ce522c6ac330c57b3d35649a5983344489689, tree 8792710ff4caeb48ee2afebc54d1602f3270c64d, parent b8bfed6ef0ea0134892f10b2a41fd4e893548c87, integrated and tested base 9a726820d52beb2e65c7c0c3da30312b7f676941. The whole contribution is four files, 194 insertions and 6 deletions. The latest correction is two files, 12 insertions and 7 deletions; no dependency, image, deadline or contract changes.

The genuine hosted verify failure is retained: confirmation run 39363255089, attempt 1, verify job 118434388152, head b8bfed6ef0ea0134892f10b2a41fd4e893548c87, base 9a726820d52beb2e65c7c0c3da30312b7f676941, actual checkout c86d8377d0cb2b3e7ddb8210696eb41dc13e9a62. Strict TypeScript reported TS2454 twice for fastest at scripts/check-pr.ts:91 and TS7053 three times for indexing overloaded spawn arguments at tests/local-checks.test.ts:49-51. That candidate failed verification; this is a source regression, with no waiver, rerun or replacement of its actual failed receipt.

The timeout catch now explicitly returns the already-throwing refuse function, making termination definite before the normal fastest read. It does not initialize a fake measurement or assert away control flow. Both spawn interception sites normalize Array.isArray(argv) ? argv : argv.cmd before indexing, including the embedded CLI preload. The whole file and contribution were searched for the same control-flow and overloaded-argument bug classes. No other instance remains. Independent R4 review reports no findings on the exact four-file contribution at this head/tree/base; this is source review, separate from command proof.

The original guard remains local CLI only: three real normal bwrap setups, refusal at 250 ms, finite 5,000 ms probe and version budgets. The R2 timeout correction still uses the explicit timeout flag and dedicated class; its refusal reports an elapsed lower bound, bubblewrap version, mount count, dominant prefix and both remedies. It does not claim a completed fastest-of-three sample. Ordinary nonzero exits, signals and permission/spawn errors remain distinct. Hosted shared prerequisites retain their boundary.

Current local proof on the corrected candidate

• ONE actual normal bun run check:pr --base origin/main exits 0 on its first execution in 118.41 seconds at the exact clean candidate head/tree/base above. Fast invariants: 969 tests / 6,401 assertions / 48 files, zero failures, 87.65 seconds. Import-graph feedback: 46 tests / 300 assertions / three files, zero failures, 18.03 seconds. Lint/leakage, environment documentation, pending package names and contribution changeset gates pass. No short outer cap, guard waiver or retry for green.
• Actual feedback files are tests/proof-reuse.test.ts, tests/local-checks.test.ts, and tests/hosted-proof.test.ts. They cover proof reuse/aggregate obligations, local timeout and ordinary-error distinctions, early refusal, inspection-only planning and hosted boundaries. Neither tests/workspace-lease.test.ts nor tests/native-diagram-inputs.test.ts was selected. No real lease-container, frozen-positive, padded-native, browser or provider campaign ran. Pinned local image availability was checked read-only without pulling; no container was started.
• The previously accepted ONE clean postfix planner at this exact head passes in 3.053 seconds. The full parsed plan emitted by the actual default equals it: 48 fast files, 19 affected workspaces, global selection, all hosted categories required. Parsed plan SHA-256: 471294bbd60ab273739fed9f7ac0664f0dff7fbc078d182762ad9ec08f1081ed. Selection itself does not establish those hosted results. Actual ordered expanded default argv, complete selection, raw log and source hashes are retained.
• The earlier corrected-byte focused run passes the whole tests/local-checks.test.ts: 20 tests / 100 assertions, exit 0 in 10.0108 seconds. ONE actual strict root bun run typecheck (tsc --noEmit) exits 0 in 53.3327 seconds. Both ran the corrected working bytes on pre-commit Git head b8bfed6ef0ea0134892f10b2a41fd4e893548c87 / tree 64c789178f9292ab114729727f2387733166ab11; their recorded source hashes equal the subsequently committed 832ce522 bytes. They are not relabeled as commands whose Git HEAD was already 832ce522. Root strict checking resolves source with the existing install; absent core/SDK/server dist outputs did not require a build. Neither command was repeated in this allocation.
• Before this default, a fresh full read-only installation audit matches 843 locked package manifests, 59,516 private owned regular files / 1,833,832,361 bytes, each link count 1, and 19 internal workspace links. Installed-byte identity: 0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245. Lock SHA-256: 5bbd5f6651f111db3fcfabeda512d44a21163cba54c58993f8878012d548cc14. Existing Bun 1.4.3 and Node executable hashes/resolution are verified. No install, build or extra type/focused command ran in this allocation.
• The actual default uses ordinary UID 1000, normal HOME, zero capabilities, only loopback/no default route, original temporary storage, private TMP/cache/maintenance ledger and the unmodified repository output coordinator. Python holds no outer output flock. Nonstealing native-capacity launcher lock is closed to children. RAM/free-space guards pass before and after; filesystem inode 0/0 is recorded UNKNOWN, and bounded exclusive owned write/read/fsync/delete probes pass. Load/resource observations carry no causal performance claim.
• Cleanup verifies lease/helper PIDs gone, output/native-capacity locks released, own private fixtures removed, private ledger empty, namespace ended, no host-ledger bind, unrelated containers unchanged, source hashes unchanged and worktree clean. Live main remains the tested base. All allocated capacity is released.

Default raw-log SHA-256: 036f7691108c2d0266bfd03062bf975dcb1b0e4a1312c60ae59e4ed10a8d61a3.

Timeout finding and mutation attribution

R2's P2 was the generic failure before slow-host diagnostics when the 5,000 ms setup budget expired. Its dedicated explicit-timeout/lower-bound correction remains intact and was accepted by R3 review; R4 reviewed the subsequent TypeScript correction with no findings. No timing threshold, probe count, finite budget, namespace/security guard or version rule was weakened.

The retained R3 named mutation removes only the explicit timeout-result branch; the regression fails TIMED_OUT_SANDBOX_MUST_REPORT_ACTIONABLE_LOWER_BOUND on the expected lower-bound message versus the generic setup failure (one test / one assertion, exit 1 in 0.48 seconds), followed by exact restore and its original 20/100 focused pass. The original request/log/restore/source identities remain retained, not rewritten as executions on 832ce522. Mutation raw-log SHA-256: 6816df7f36444150f343915eba59d0b75d8d71b630a7cc4b80d503ba0ccdd1b7. This regression doubles the lowest shared spawn method; it is not real five-second child-kill or padded-host measurement proof. The latest explicit terminating return and command normalization preserve runtime guard semantics, so no duplicate mutation campaign was run.

Remaining acceptance and custody

This advances #2370 partially under Refs, without closing it. Complete hosted qualification for the final candidate remains pending: selected jobs, actual immutable checkouts, all required categories and aggregate must pass. Current local default, corrected-byte strict types and source review do not establish current hosted packaging, browser or native results. The failed old hosted verification is not waived. The separate main-base green audit does not qualify this combined candidate.

Release milestone remains 0.44.0 on the issue and PR, sole assignment and parent claim release044-2370-r2-20261019 are retained. The existing root-owned confirmation and PR state were untouched. This body is an unposted artifact for root review; no push, body/state edit, reservation, confirmation request, watch or merge was performed by this allocation.

Historical published body and receipts (not current candidate proof)

The following quoted body is the previously published b8bfed6ef body, preserved with its original receipt identities and limits. Its headings saying “current”, draft-state instructions and pending-type statements describe that historical candidate only. Its default 969/6,401 + 46/300 in 128.35 seconds is historical, separate from the new 118.41-second execution. The older 7322a0f / 90a9 default, all original native padded/unpadded receipts, mutation source identities, failed/cancelled run identities and missing-raw-log limitations remain as recorded below.

Refs #2370

Current candidate and behavior — 2026-10-20

Linux executing local preflight measures three actual sandbox setups and refuses when the fastest takes 250 ms or more. The refusal reports bubblewrap version, mount count, dominant mount-point parent prefix and both remedies. A probe that exhausts its unchanged 5,000 ms budget now reports an elapsed lower bound with those same diagnostics. Ordinary nonzero exits, signals and spawn errors remain separate setup failures. The guard runs only at the local CLI entry after the inspection-only plan exit; hosted shared prerequisites retain their original boundary.

Head b8bfed6ef0ea0134892f10b2a41fd4e893548c87, tree 64c789178f9292ab114729727f2387733166ab11, integrated and tested base 9a726820d52beb2e65c7c0c3da30312b7f676941. The fix commit's parent is 1f9889ee5fa6c88b8d318e4c107f3aab54266afb. The whole contribution remains four files, now 189 insertions and 6 deletions. Product/test deadlines, normal three-probe behavior, namespace argv, pinned images, qualification guards, machine contracts and provider-facing history remain unchanged.

Current local proof

• One actual normal default bun run check:pr --base origin/main exits 0 on its first execution in 128.35 seconds, using Bun 1.4.3. All lint/leakage, environment and changeset gates pass. Fast invariants: 969 tests / 6,401 assertions across 48 files, zero failures. Import-graph feedback: 46 tests / 300 assertions across three files, zero failures. Head, base, lock and source hashes remain unchanged throughout this command and final readback.
• Actual feedback files are tests/proof-reuse.test.ts, tests/local-checks.test.ts and tests/hosted-proof.test.ts. They include the timeout/ordinary-error distinction, CLI early refusal/plan behavior, hosted boundary, immutable proof-reuse and aggregate obligation controls. tests/native-diagram-inputs.test.ts and tests/workspace-lease.test.ts were not selected. No native frozen-positive or real lease-container execution is claimed for this default run.
• The already accepted clean postfix planner passes once in 3.04 seconds at this head. Its 48-fast-file/global/all-hosted-category selection equals the initial plan emitted by the actual default command. The earlier R2 plan remains separately attributed to 1f9889ee5fa6c88b8d318e4c107f3aab54266afb, tree a49a5c8d12746736be8b0d7dfc794172e53eba16, with its own 3.24-second receipt.
• Full read-only install audit verifies 843 locked package manifests, 59,516 owned regular files / 1,833,832,361 bytes with link count 1, and 19 workspace links inside the owned checkout. Complete installed-byte identity remains 0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245; lockfile SHA-256 remains 5bbd5f6651f111db3fcfabeda512d44a21163cba54c58993f8878012d548cc14. No install/build was needed or run for this continuation.
• Execution uses ordinary UID 1000, normal HOME, zero capability sets, private network/mount namespaces with only loopback and no default route, original temporary storage visible, private TMP/cache/maintenance ledger, and the repository's exclusive output coordinator. RAM/free-space gates pass before/after; filesystem inode 0/0 is recorded as unknown and bounded owned write/read/fsync/delete probes pass. The native-capacity launcher lock is acquired nonstealing and closed to children. Exact pinned lease-image availability was checked without pulling; the run did not need it. No Docker proof or other native/browser campaign ran.
• Cleanup confirms no owned checks/lease owners remain, workspace and native-capacity locks are released, private fixtures are removed, the private ledger is empty, the namespace ended, and preexisting unrelated containers are unchanged. The worktree is clean. This is one complete default preflight, with no shortened outer cap, guard waiver or retry for green.

Independent review and timeout correction

Independent R2 source review found one P2: the finite setup timeout returned through the generic failure branch before actionable slow-host diagnostics. The scoped correction uses Bun's explicit exitedDueToTimeout result, catches only the dedicated timeout class, and reports setup elapsed at least 5000 ms; it does not claim a completed fastest-of-three sample. Exit 124, a signal or a permission error alone is not classified as slowness. Both existing 5,000 ms spawn budgets and the 250 ms threshold are retained. Docs describe the lower-bound behavior. Independent R3 source review reports no findings for the exact current head/tree/base; that is source review, not hosted or real kill qualification.

• Named mutation removes only the explicit timeout-result branch. The single selected regression fails TIMED_OUT_SANDBOX_MUST_REPORT_ACTIONABLE_LOWER_BOUND at its intended assertion: expected the elapsed lower-bound diagnostic, received the original generic sandbox setup probe failed. It fails one test / one assertion, exit 1 in 0.48 seconds; this is not a module-load failure.
• Corrected source is restored byte-for-byte. One complete focused tests/local-checks.test.ts run passes 20 tests / 100 assertions, exit 0 in 10.09 seconds. It ran corrected working bytes on pre-commit 1f9889ee5fa6c88b8d318e4c107f3aab54266afb; their exact recorded hashes equal the subsequently committed current fix. The timeout regression doubles the lowest shared spawn method. It does not establish a real five-second child-kill or padded-host runtime measurement. No such new measurement is claimed.
• All timeout/error spawn sites in the file and diff were reviewed; no other instance of the identified timed-setup/generic-refusal class remains. Version failure retains its unavailable fallback, and untimed shared namespace/Git failures retain their existing categories. No repository citation points at moved check-pr.ts ranges.

Remaining acceptance and custody

Keep draft under Refs. Complete selected hosted candidate confirmation remains required for the final head/base, with actual requested metadata, selected jobs/checkouts and aggregate evidence; local success and category selection do not supply current strict types, packaging, browser or native qualification. Core/SDK/server dist outputs are absent locally. All issue acceptance and delivery checks remain open until their required evidence is reconciled; this partial draft does not waive them.

The parent campaign retains claim release044-2370-r2-20261019, sole assignment and release milestone 0.44.0, and owns future publication, exact-candidate reservation, confirmation and shared merge/main reconciliation. No hosted confirmation, ready transition or merge is requested in this local proof round. Current main automatic proof is tracked separately; no complete main-push green is claimed here. Older verified main evidence describes its own commit. No changeset is required for repository-local tooling/docs.

Historical receipts — original execution identities

The original records below are preserved as historical evidence. Their current/blocked wording describes those checkpoints and is superseded by the current candidate and remaining work above. In particular, 7322a0f9c3a561ad087f88f9c606b00dab2168f5 on 90a95123cfceb169bd2ecf7c213544db742eaed7 retains its actual 966 fast / 6,379 assertions and 44 feedback / 284 assertions, 113.73-second preflight. Original padded/unpadded/newer-bwrap controls, source identities, mutations and every failed/cancelled hosted attempt retain their actual attribution. Raw native logs were not recovered during the bounded historical search; the published narratives are retained without inventing replacement logs or executions on this head.

Refs #2370

Current candidate and behavior — 2026-10-19

Linux executing local preflight measures three actual sandbox setups and refuses when the fastest takes 250 ms or more, reporting elapsed time, bubblewrap version, mount count, dominant mount-point parent prefix and both remedies. The guard runs only at the local CLI entry, after the inspection-only plan exit. Hosted shared prerequisites retain their original boundary. Product/test deadlines, pinned images, assertions and qualification guards are unchanged.

Head 7322a0f9c3a561ad087f88f9c606b00dab2168f5, integrated base and preflight merge base 90a95123cfceb169bd2ecf7c213544db742eaed7, tree 58935b5b1a2cca7d7f5ba4658e9aef45b1908ef8. This nonrewriting integration preserves the four-file diff: 137 insertions, 6 deletions. Guard source, focused tests and testing documentation are byte-identical to the previous draft head 4d0ea7739effaccda9bb3025b32e341afdc5f7a4. Main's draft-proof correction and independently frozen native-positive fixture repair are integrated. #2373, #2375 and #2365 are delivered prerequisites; #2376 is independent.

Current local proof

• Actual bun run check:pr --base origin/main --plan exits 0. It selects all hosted proof categories; default local execution schedules lint/leakage, environment documentation, changeset gates, fast invariants and import-graph feedback.
• Actual normal default bun run check:pr --base origin/main exits 0 on its first execution in 113.73 seconds, using Bun 1.4.3. All lint/leakage, metadata and contribution gates pass; 966 fast tests / 6,379 assertions and 44 import-graph feedback tests / 284 assertions pass, with zero failures. This includes the actual CLI refusal/plan and hosted-boundary regressions. No full/all mode or arbitrary outer cap was used.
• Frozen dependencies were installed with a fresh private cache and --backend=copyfile. All 59,516 regular installed files have link count 1 and the current user's ownership; all 19 workspace links resolve within this checkout, with no escaping dependency symlinks. Lockfile SHA-256 remains 5bbd5f6651f111db3fcfabeda512d44a21163cba54c58993f8878012d548cc14.
• The local sandbox prerequisite passed without retry. The pinned offline container image was confirmed installed at its declared digest; no pull occurred. Feedback selected only three files and did not run the lease-container regression. No Docker proof, loop/Btrfs/identity container, browser campaign or repeated native timing measurement ran in this continuation.
• Load samples were 1.62/1.87/1.77 before and 1.97/1.97/1.82 after. Concurrent campaign work was permitted; these observations establish no causal timing comparison.
• Historical 18-test/88-assertion, timing/native and mutation receipts below retain their original execution identities. They are not relabelled as measurements on this integrated head. Prior failed/cancelled hosted runs remain failed/incomplete evidence.

Remaining proof and custody

Keep draft under Refs. Complete selected hosted candidate confirmation is still required for the final head/base, including actual selected-job checkout identities and the proof aggregate. This local success is not hosted confirmation. The parent campaign retains claim release044-2370-r2-20261019, the confirmation/merge windows, final base assessment, milestone/review readback and matching-head squash/main reconciliation. No confirmation, ready transition or merge is requested here. PR and issue retain release milestone 0.44.0. No changeset is required for repository-local tooling/docs; no machine contract or provider-facing history changes.

Historical record through 2026-10-18

The following original record is preserved for attribution. Its blocked/current wording describes those historical checkpoints; delivered dependencies and current remaining work are stated above.

Refs #2370

What changed

Executing local preflight on Linux measures three real sandbox setups and refuses when the fastest takes 250 ms or more. The refusal reports elapsed time, bubblewrap version, mount count, dominant mount-point parent prefix and both remedies: newer bubblewrap or clearing leaked Docker Desktop mounts. Testing and CI policy documentation explain the prerequisite.

Why this shape

This implements #2370's revised 2026-10-18 scope. A fixed mount-count cutoff incorrectly rejects healthy hosts using newer bubblewrap. The guard measures the existing namespace probe shape instead. --plan remains inspection only; focused Linux preflight now needs bwrap and permitted namespaces. Product and test deadlines stay unchanged.

Proof

Local timing-guard receipts use Bun 1.4.2 and the source committed in the latest revision. The original fixed-count candidate is historical evidence only.

• Focused file: 16 tests / 76 assertions pass, covering 249/250 ms, fastest of exactly three samples, high mount counts with fast setup, version/prefix/remedy reporting, escaped mount points, actual namespace command shape and failed setup.
• Failing first: restoring the original fixed-count guard makes sandbox prerequisite refuses 250 ms before downstream checks fail its toThrow assertion with Received function did not throw.
• Mutation: raising the timing cutoff to 250,000 makes the same assertion fail for the same reason. Restored byte-for-byte; the focused file passes.
• Native Linux: setup uses an unprivileged user/mount namespace with namespace-local root to create 8,000 empty-directory bind mounts, then remaps to an unprivileged namespace UID and drops inherited, ambient and bounding capabilities before running the real guard. No host mounts are changed. System bubblewrap 0.9.0 passes unpadded at 104 mounts; with 8,104 mounts it refuses at fastest-of-three 975.6 ms and reports version/count/dominant directory/both remedies. Bubblewrap 0.13.1 first on PATH passes with the same 8,104 mounts. The tested 0.13.1 binary SHA-256 is 32167ed4e46c6e722c84c349864345e6b54a296594676d47b52b7f8370138692. This qualifies this guard's comparison, not the complete native compatibility matrix in ci: supply or require bubblewrap 0.13+ where sandboxes start, so leaked host mounts stop costing seconds #2375. All temporary namespaces and directories are removed.
• Native harness preparation failures remain separate: 8,000 bind options exceed bwrap's 9,000-argument limit; direct mount setup needed namespace-local root; capabilities needed dropping after the UID remap. Final controls above all completed with their expected exits.
• Local preflight and lint receipts are recorded in the final handoff comment below.

Historical hosted attempt: ready run 39074969929, attempt 1, tested original fixed-count head d9917869c4fca11b8040ac903b8dace6b5c20cd6 on merge checkout e420f4155d10a93405b3505666c67333e3dcff22, parents main 498270fbdc4ef2788fdd3babb259b647d77f6c77 and that head, tree 8f0f4f12f6bd12e985bdb088a58434e146544ce4. All jobs drained: 12 succeeded, unit (1)/(2)/(3) and proof failed. The three failing unit-job checkout logs match that immutable merge; proof's candidate receipt independently reports the same identities. No hosted pass is claimed for the new timing revision.

The five failing self-test assertions across generated-theme-inputs, generated-build-inputs and inclusion-inputs copy current producer bytes but expect a frozen audit. The binder correctly refuses the changed check-pr.ts. Replacing only that caller with actual base bytes makes all 19 tests / 77 assertions pass; candidate restored. #2373 owns the independently bound frozen positive/current-drift negative fixture correction. The aggregate correctly fails unit: selected proof did not pass (failure). No frozen hash, guard or assertion is weakened here.

Checklist

• Complete selected hosted proof passed for the final candidate.
• Implementation/native controls meet the revised scope; remaining proof is named below.
• PR and issue retain milestone 0.44.0.
• No changeset: repository-local tooling/docs only.
• Leakage and lint gates pass.
• No integration contract changes.
• Testing and CI policy documentation reflect the prerequisite.
• No provider-facing history changes.

Anything left open

The generated fixture correction #2373 is delivered and integrated. Ready run 39087361437 at head 488e86f fails six container-backed categories before their containers: the local timing probe was placed in the shared requireRuntimeTools helper and these host runners do not supply bwrap. Both browser, both layout, capture and endurance logs name actual merge b370614 on base fcb7d5c. The final draft transition cancels the remaining unit/native-host/aggregate jobs; verify, pack and native runtime pass. This remains failed/incomplete proof, not a tool waiver.

The scoped correction moves requireLocalSandbox to the executing local CLI entry point, preserving the original hosted category prerequisites. Container-backed proof does not acquire a host bwrap dependency; native proof still probes its namespace. A new regression fails on the original shared boundary and after a reintroduced shared timer. A native child CLI regression checks focused/full refusal before downstream proof and plan-only success; removing the entry guard fails its intended parent assertion. Mutations restored exactly. Actual unpadded local namespace setup passes. Refreshed preflight passes all contribution gates, 961 fast tests and 44 affected tests / 283 assertions; strict types pass. Original padded/newer-bwrap timing receipts above retain their historical implementation identities; the timing algorithm is unchanged.

Blocked by #2365. A separate unchanged native qualification control still fails its exact COMPLETE_NATIVE_QUALIFICATION_WITHOUT_DOCKER_OR_IMAGE_LOOKUP assertion (expected 859, received undefined), owned by that existing issue. No frozen pin or refusal guard is refreshed here. Preserve this corrected draft, integrate the independently delivered prerequisite, rerun affected preflight and request complete hosted confirmation for the actual current head/base, then reconcile selected checkouts, aggregate, milestones and matching-head squash/main. #2365 stays with its current owner under the maintainer's instruction. Earlier timing/native/failed CI identities are not relabelled as current green.

2026-10-18 dependency refresh: #2375 is delivered by #2381 and its complete ordinary/padded/native-container compatibility receipts are recorded there. This preserved local branch integrates actual fetched main c4d31c6 (including separately delivered browser CI headroom #2415); refreshed local head 4d0ea77 has tree 2f07e7740ab969e1dcf56994fabc2a5983c42c53. The four-file timing prerequisite diff is preserved, with the timer confined to the executing local CLI. All 18 local-check tests pass / 88 assertions, including real CLI early refusal, plan-only behavior and hosted-container boundary. Strict types pass. #2365 remains open with its existing owner; no takeover, qualification pin refresh or new passing preflight/hosted claim is made.

Current draft head 4d0ea77 integrates main c4d31c6. All 18 prerequisite tests / 88 assertions and strict types pass. Complete current preflight and selected hosted qualification await #2365 under its current owner. The draft remains Refs #2370; no previous proof is relabeled to the newer combined tree.

[schlessera]

Ready run 39074969929 unit (1), job 117520549643, fails temporary theme output binds the audited command, copied theme and installed compiler with expected CSS inputs / received undefined. Actual checkout e420f4155d10a93405b3505666c67333e3dcff22, parents main 498270fbdc4ef2788fdd3babb259b647d77f6c77 and head d9917869c4fca11b8040ac903b8dace6b5c20cd6, tree 8f0f4f12f6bd12e985bdb088a58434e146544ce4; job log, Git and immutable API agree.

The changed local preflight caller no longer equals the binder's exact frozen producer hash. Correct refusal exposes the self-test's current-source fixture assumption. Scoped audit reproduces five failures across generated-theme-inputs, generated-build-inputs and inclusion-inputs. A control replacing only check-pr.ts with actual base bytes passes all 19 tests / 77 assertions; candidate restored byte-for-byte. #2373 owns frozen positive/current-drift negative fixture repair. No binder/hash/guard is weakened here. Remaining jobs are allowed to finish for diagnostics before final draft/handoff reconciliation; no blind retry or whole-candidate pass is claimed.

[schlessera]

Blocked handoff, updated scope: latest timing implementation replaces the original fixed-count candidate. Local bun run check:pr --base origin/main passes 961 fast tests / 6,341 assertions and 42 affected tests / 271 assertions; a separate lint pass is clean. Focused file: 16 tests / 76 assertions. Failing-first and disabled-timing controls fail the named 250 ms refusal assertion; restored. Native 0.9.0 unpadded passes, padded 8,104-mount setup refuses at 975.6 ms, and 0.13.1 passes the same padding. These receipts describe the timing revision, not the older hosted candidate.

Run 39074969929 is complete: 12 successful jobs, unit (1)/(2)/(3) plus proof fail. Unit (3) adds the already reproduced inclusion-fixture assertion; aggregate fails only because selected unit proof failed. #2373 records all five fixture assertions, actual immutable checkout identities and the 19-pass original-caller control. No new failure class, blind retry, hash refresh or waiver is selected.

This PR stays draft with Refs #2370. Resume after #2373 with integrated fixture correction, affected preflight and complete fresh candidate confirmation, actual job checkout/review inspection, verified 0.44.0 milestones and matching-head squash/main reconciliation. Claim mount2370-20261018 is released; implementation is preserved on this PR's branch.