[schlessera]

Closes #2436

What changed

The real-worker scope-cap test now waits for journal observation completion before submitting its first continuation. A controlled Pi capture-commit gate preserves the published finite offer while observation remains held, asserts the intended refusal without consuming the grant or resuming the worker, then releases the gate and awaits journal idle. The test checks acceptance of the first grant and its duplicate before waiting for the second pause.

Why this shape

The original failed confirmation 39225826747, attempt 1, unit shard 2 job 117972100537 retained two first-grant refusals while the finite four-call offer remained published. No accepted grant or second pause followed. This establishes a missing acceptance transition; which historical observation/checking hold was active remains unknown. The existing journal idle boundary synchronizes the fixture without changing production guards or adding a production seam. Passing main run 39224911471 did not select this case and is not a matching-case control.

Proof

Current candidate head 9d1ef15a9c7ae96affa1d4374da23561506f5f35, tree a678cbdec549c35130a47a9147de2982ae25e9ad, targets live main e16b8407f81da4071a3a1bf1cc04299acb1a2522. The normal refresh merge has parents 617fbe01017646ed31fe3e775c7eba1f20659e63 and e16b8407f81da4071a3a1bf1cc04299acb1a2522. Only the two already merged ui-kit test corrections arrived from main. The scope-cap contribution remains byte-identical to its independently reviewed implementation: SHA-256 7c84a561daa3e184d91affd6bb153072ac439253e7cc228d49b86492859087e3.

Local Bun is 1.4.3 with a frozen private copyfile installation; hosted CI pins 1.4.2. Ordinary offline namespaces preserve the real worker, original temporary filesystem, private output/ledger ownership, route guards and zero capabilities. This is not native storage or complete hosted qualification.

The following focused behavioral receipts retain their actual original source identity, head 617fbe01017646ed31fe3e775c7eba1f20659e63 / tree e15a051379c05d1eba022309d7f35ccef2963333 / base 09eb1f78e99555110f4ef1c8b78e23d188ec77e5. They were not replayed or relabeled as new combined-tree mutation evidence. Independent source review found no findings.

• Controlled failing-first: the real commit remains held; SCOPE_ADAPTER_FIRST_GRANT_AND_DUPLICATE_ACCEPTED receives two refused states after the held-window security assertions pass.
• Mutation removes only observation release/idle synchronization and its completion assertion. The same named first-grant assertion fails with two refusals (one failed selected test, nine assertions); exact bytes restored afterward.
• Restored complete scope-cap file: four tests pass, 41 assertions, no failures or skips. Finite first grant 2 -> 4, refusal of a second grant, worker heartbeat pause, ordinary Stop and retained budget/roadblock facts remain asserted. Existing eight-second waits and 30-second case deadlines are unchanged.
• Strict typecheck and lint/leakage/environment/changeset gates pass. No production code or provider-facing history changed.
• Historical original-head default preflight exited 0 in 43.217 seconds: 53 fast tests / 1,371 assertions across three files, then four scope-cap feedback tests / 41 assertions. No failures or skips. The executed plan matches the independently reviewed plan exactly.

bun run test packages/ui-server/tests/ws-scope-caps.test.ts -t 'pi: dictation pauses'
bun run test packages/ui-server/tests/ws-scope-caps.test.ts
bun run typecheck
bun run check:pr --base origin/main

Fresh actual preflight after the refresh ran once and exited 0 in 65.99 seconds: 53 fast tests / 1,371 assertions across three files, then four scope-cap feedback tests / 41 assertions. Strict root types ran once and passed in 84.74 seconds. No install, build, browser, storage prover or repeated focused mutation was run. Source, installed dependencies and lock inputs remained unchanged. Memory and temp-space admission were measured separately; both retained their original guards, and all owned processes drained with empty ledgers and an available output lease.

The actual default plan selects three ui-server fast invariant files (auth, HTTP principal boundaries and session cookies), followed by import-graph feedback. Complete selected hosted unit, browser, layout, captures, endurance and runtime proof remains required; packaging is unselected.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only: nothing on a production turn path changed.

Anything left open

Current confirmation 39281051408, attempt 1, passed every selected job and the independently validating aggregate. All 16 executed job checkout logs resolve to 79f251659e84f02f2247543aeb7e5e579bd270b6, tree a678cbdec549c35130a47a9147de2982ae25e9ad, parents e16b8407f81da4071a3a1bf1cc04299acb1a2522 and 9d1ef15a9c7ae96affa1d4374da23561506f5f35. All 13 final resource receipts agree. Metadata requested the same head/base with confirmation cadence and no retained domains. Aggregate job 118160340561 passed; packaging was intentionally unselected. Historical fixture receipts retain their original identities. This controlled boundary regression does not identify the particular historical hold or qualify PR #2435. No production guard was relaxed. Merge verification remains the coordinator's next action.

Previous hosted confirmation

Run 39229782185 tested the original scope-only candidate 617fbe01 against 09eb1f78 and failed browser shard 2 on the separate #1229 combined module-settings timeout; the aggregate rejected that failure. Other selected jobs passed. That failed run is preserved without retry. Main now contains the reviewed module-settings and overlay corrections from PR #2442; the refreshed scope candidate requires a new confirmation on the exact current head/base. Intermittent #2413 and #2446 remain separately tracked and any selected recurrence still blocks merge.

Main assessment and next confirmation

Automatic main push run 39277088142 completed with failure: unit shard 3 job 118144658940 failed mounted jobs settings reject invalid boards before writes and save an intentional empty selection at jobs-board-selection-http.test.ts:33, receiving HTTP 500 with startup directory membership changed while copying. This is the separately tracked #2413 symptom; its cause remains unknown. Runtime-host and aggregate jobs were cancelled, so that main run is not green. The current candidate's complete selected proof passed, including the same test in unit shard 2 job 118155691191. This passing control does not establish a repair for #2413. No failed main job was rerun or waived.