[schlessera]

Refs #2370

What changed

The local preflight guard regression test now runs all three real CLI modes in a tiny owned Git fixture. It copies the actual CLI byte-for-byte, forwards its static imports to the real helpers, and supplies an immutable fixture base with one controlled manifest change. Real Git planning, refusal before downstream proof, plan-only inspection, stream draining and child-exit assertions remain exercised. Production guards and all deadlines are unchanged.

Why this shape

Automatic main run 39369165918, unit (4), job 118453057783 failed this whole test after 30,000.49 ms on 9203e85966b409bfb4d645d48cc37344186d68e3. Both refusal modes completed six assertions; timeout cleanup killed one dangling child, followed by the late plan assertion expecting 0 and receiving 143. The original test launched its children against the whole worker checkout, so Git refs and unrelated planning inputs preceded the guard being tested.

The passing candidate run 39367301854 used the same source tree and worker partition; this case took 8.156 seconds. The internal slow phase of the failed execution was not recorded. This fixture removes the test's dependence on unrelated owner-checkout planning inputs in every mode; its passing duration is not proof of the historical cause.

A second occurrence in paused PR #2056's run 39370921892, unit (3), job 118458753640 hit the same 30-second whole-case limit (30,000.76 ms), killed one dangling child, and later failed the executing-mode setup-error assertion with empty stderr. Which executing mode and internal phase were slow were not recorded. This does not establish a plan-only failure. Root found no additional diagnostic assertion failure in that log; its integration lease is released, with no merge pending.

Proof

Reviewed head: 076cb020b80261f4ee82b3fd9cfb28f834cf41b8; tree: c37eb2051b2bfb873c3ee7c7271286f823d02523; sole parent and tested base: 9203e85966b409bfb4d645d48cc37344186d68e3. Only tests/local-checks.test.ts changed. Independent R1 review reported no findings at these exact identities.

• Historical failing-first evidence is the actual failed main job above; the unchanged scenario was not replayed for green.
• Routing the actual child entry back to the owner checkout failed the named EXPECTED_FIXTURE_ROOT_BEFORE_SCAN assertion before entry imports or discovery (calls=[]), rather than a module-load error. Exact byte restoration then passed the full focused file: 20 tests, 134 assertions.
• Strict root bun run typecheck passed once after the clean commit in 48.0 seconds. No build was needed.
• Actual bun run check:pr --base origin/main --plan passed. Its plan selects all 19 workspaces and every hosted proof category; inspection does not execute those categories.
• One actual bun run check:pr --base origin/main passed in 99.29 seconds, including lint/leakage, metadata and contribution gates: 969 fast tests / 6,435 assertions across 48 files, then 20 import-graph feedback tests / 134 assertions in the repaired file. The log confirms all 20 cases in both batches, including all three CLI children; the CLI case took 706.43 ms and 601.61 ms respectively. No separate focused, types or plan repeat was added to that allocation.

Local proof used the unchanged frozen lock and privately audited install, actual Bun 1.4.3 / Node 26.7.0, ordinary UID with normal HOME and zero capabilities, loopback-only namespaces, private temporary/cache/ledger paths, resource guards and the repository output lease. Hosted Bun 1.4.2 remains unchanged. No standalone runtime or browser campaign ran; no pinned-container test was selected by this default preflight. Owned children, fixtures, ledger entries, output and capacity locks were released.

The failed verification run 39363255089 at the historical timeout-diagnostic revision remains failed. PR #2372 delivered the type-corrected 832ce522c6ac330c57b3d35649a5983344489689 candidate as squash 9203; its passing confirmation does not replace failed main proof. Earlier native, mutation, failed/cancelled and qualification-identity receipts retain their original scope on #2370.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof. Local receipts passed; hosted repair proof remains pending.
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones. Issue ci: refuse local preflight when measured sandbox setup is too slow for its deadlines #2370 retains 0.44.0; assign and read back 0.44.0 on the new PR before merge.
• This test-only change has no consumer-visible behavior and needs no package changeset.
• No personal data in the diff; the default leakage gate passed.
• No machine-surface contract changed.
• No documented production behavior changed.
• No provider-facing turn path or history changed.

Anything left open

Keep #2370 open under its existing campaign claim and milestone 0.44.0. Complete current-candidate hosted confirmation for the actual selected categories, exact-candidate integration, and actual squash/main-push verification remain required. Main remains failed in hosted evidence until the repair is delivered and actual main proof passes. PR #2056 remains paused.

The historical internal slow phase remains unknown. The fixture deliberately bounds inputs; it does not simulate the historical host. Cleanup covers rejected stream/exit waits; independent test-deadline cancellation coverage was not added. No production guard, three-probe/250-ms threshold, 5-second probe budget, 30-second test deadline, network mask, image or qualification pin changed.