[schlessera]

Refs #2279; part of #1849.

What changed

The test wrapper freshly builds the selected runtime package closure after write-lease admission and before launching Bun tests. All 17 runtime hooks verify the same live invocation, checkout, exclusive lease and exact successful builder/closure receipt before omitting duplicate compilation. Four unchecked bypasses using three legacy flags are removed. Missing or invalid authority leaves hooks rebuilding; failed or interrupted preparation prevents tests.

Build and test children now have a private process-group anchor that stays alive after the actual command leader exits. Cancellation stops that owned group even when a surviving descendant holds stdout/stderr open. The anchor also handles wrapper death and children forked during signal handling. Cleanup retains both output EOF joins, preserves the unrelated outer lease/siblings, and never signals a numeric group after its anchor dies. Cancellation after a successful builder exit still prevents attestation. This fixes the exited-leader review finding through the actual nested wrapper, not just a helper predicate.

Each private unit worker prepares its full build inside its continuous lease/build/test lifetime. Defaults remain two workers and serial compilers with private dependencies. Ordinary nested wrappers create new invocations; only explicitly checked isolated speech delegation borrows the parent's build. Direct/unattested, alternate-cwd and watch paths rebuild; explicit builders always compile. Client bundling, default exports, assertions, deadlines, offline guards and pins remain intact.

Why this shape

Implements selected option B: one fresh build per invocation, with mid-run source edits taking effect next invocation. This coordinates cooperating first-party commands; it does not contain processes deliberately escaping their owned process group. No persistent freshness eligibility, cross-run reuse, generic producer interface or builder cache is introduced. #2319 activation remains deferred. The binding CI decision records the invocation rule and lifecycle; worker scheduling placement remains distinct from compilation avoided.

Proof

Candidate b751f30becd03af1b506e34f4f62f0cb155b83d3, tree be4fa4fce2d942fb8a9f939375fd853cfc3bed30, tested merge base 468618cf106c3e793cbb030f8fc90bf8d018913f. The preflight base ref resolved to af0547c2d4d197ed3766f2817cf56eb5f0486ab4; its separate diagram scene-bounds change is assessed but not incorporated. No combined-tree/current-main proof is claimed.

bun run check:pr --base origin/main passes on this exact committed source: 970 fast tests plus 433 selected tests across 30 files, zero failures. Wall 1389.69s; command CPU 451.93s user + 269.24s system. Strict bun run typecheck passes: 34.61s wall. All 17 actual runtime hooks attest the same fresh 11-package preparation (35.97454s wall, real builder CPU 60.360574s user + 4.517563s system). Full hook admission totals 25.88081ms. Private-worker fixture builds have separate identities; their costs are not counted as this primary preparation.

• Actual nested build and test wrappers fail EXITED_BUILD_DESCENDANT_MUST_STOP / EXITED_TESTS_DESCENDANT_MUST_STOP before the correction. A final-source leader-only signaling mutation fails the same assertions; restoration passes. Independent cleanup receipts retain the PID/start observations.
• Six real wrapper controls cover build/tests cancellation by TERM, abrupt wrapper SIGKILL, and a descendant forked by a TERM handler. They assert descendant shutdown, complete exit/EOF joining, preservation of the outer lease and unrelated sibling, and no cancelled-build attestation. Startup cancellation and normal command status/output/usage/cleanup have additional actual-process controls.
• Exact-source preflight also exercises existing receipt/invocation/lease controls, direct/watch fallback, nested speech, both actual private workers and runtime consumers. Copied-wrapper inventories include the new internal helper.
• Prior candidate 18cf3261f583c4ea9e6c3bfa43979e2e9606b6bc retains the real cross-checkout and browser default-export mutation/restoration receipts, filesystem EACCES/retention controls, and all bounded pressure evidence. All 849 original receipt files rehash against their unchanged manifest. These historical results retain their original source attribution.

The unchanged native setup gate uses the previously privately built bubblewrap 0.13.1, with fresh binary/path/library hash checks and fresh 15.341/12.967/12.826ms setup probes. Only its executable directory is added to the existing PATH; Bun 1.4.2, Node 24.21.0 and Chrome 140 identities remain verified. No prerequisite rebuild or historical probe is claimed as new work, and no guard threshold changes.

Raw logs, source snapshots, exact builder receipt, cost records and cleanup checks are indexed in the parent handoff. Builder CPU excludes the new anchor itself; whole-command accounting includes wrapper work but can omit interrupted un-reaped descendants. Concurrent command elapsed sums are not makespan. No whole-run or hosted speedup is claimed.

Checklist

• Complete selected hosted proof passed; parent owns independent review and hosted/current-main qualification.
• Acceptance gaps are retained below.
• No release-shipped code, package version or public contract change; no changeset required.
• Documentation describes the selected behavior; copied-wrapper inventories and citations are checked.
• Assertions, deadlines, worker/compiler defaults, offline guards and pins are preserved.
• Provider history and product/browser behavior are unchanged.

Anything left open

All four prior pressure arms remain whole failed. Baseline and unconditional mutation hit the actual 180s setup deadline. Initial fixed execution fails typed-turn idle before audio assertions (#2456). Paired restored execution passes both behavior cases and then fails an unnamed teardown hook (#2457). Neither a particular teardown await nor a common cause has been established. This normal-load preflight does not resolve either blocker. No further pressure attempt, product/browser repair, waiver or new ruling was made in this correction round.

This remains a draft with Refs #2279, milestone 0.44.0. Parent independent review of this candidate and its cancellation correction is complete; the original descendant diagnostic passes and all correction receipts/source hashes match. Both blockers, complete pressure qualification and selected hosted/current-main proof remain outstanding. The coordinator claim is released in the blocked handoff; the draft and evidence are preserved. No readiness transition, hosted dispatch, merge reservation or merge is requested.

[schlessera]

2026-10-20 parent review of draft #2458 at 18cf3261f583c4ea9e6c3bfa43979e2e9606b6bc: independently rehashed all 849 indexed evidence files (20,741,183 bytes), with zero mismatches. Local preflight records 970 fast plus 425 selected tests and strict types passing against the retained base 468618cf; this does not qualify the later main tree or complete pressure/hosted proof.

A bounded real-subprocess diagnostic against the exact production invocationChild helper found an additional cancellation defect: after its immediate child exits successfully, stop(SIGTERM) resolves while a surviving descendant still holds inherited output pipes. The named assertion EXITED_BUILDER_DESCENDANT_MUST_STOP fails; the controller then stops its exact owned descendant and verifies absence. This is direct helper evidence, not yet a full-wrapper reproduction or a compiler-specific diagnosis. Existing delayed-EOF and live-parent nested-cancellation controls do not combine these conditions.

A fresh dedicated correction round now owns reproduction through the nested wrapper, scoped lifecycle repair and regression/mutation proof. It must preserve EOF joining, the live outer invocation, unrelated processes, assertions and deadlines. The existing coordinator claim remains active; no concurrent writer or additional pressure run is allocated.

PR #2458 remains draft, Refs #2279, milestone 0.44.0. All four pressure arms remain whole failed. #2456 and #2457 remain canonical full-pressure prerequisites with no inferred common cause. No readiness, hosted dispatch, reservation or merge is requested; #2319 activation remains deferred.

[schlessera]

2026-10-20 blocked handoff of #2279 / draft #2458: corrected head b751f30becd03af1b506e34f4f62f0cb155b83d3, tree be4fa4fce2d942fb8a9f939375fd853cfc3bed30, milestone 0.44.0. Exact-source preflight passes 970 fast + 433 selected tests, strict types pass. The tested merge base remains 468618cf; separately assessed af0547c2 is not incorporated or qualified as a combined tree.

The exited-command cancellation finding is addressed. Actual nested build/test failing-first and final-source mutation controls fail on the named surviving-descendant assertions, then pass after restoration. Parent inspection and an independent real-process control confirm descendant shutdown after leader exit, both EOF joins, unrelated sibling preservation and zero owned survivors. All 107 correction receipt files (2,350,460 bytes) and all 5,238 candidate source hashes independently match. Existing original evidence retains its own source identity.

All 17 hooks attest one fresh 35.97454-second preparation; full admission totals 25.88081 ms. Full preflight costs 1,389.69 seconds wall and 721.17 seconds command CPU. No matched whole-run or hosted saving is claimed.

All four pressure arms remain whole failed, and #2456/#2457 remain open attribution prerequisites. This correction does not establish either pressure failure's cause or repair. No further pressure, hosted dispatch, readiness transition or merge is requested. The original complete-pressure and selected hosted/current-main acceptance criteria remain open; #2319 remains deferred.

Both implementation rounds are terminal. Releasing coordinator claim e1849-2279-20261020-r1-invocation and its assignment; preserving the draft, correction branch and indexed receipts. Resume from the two blocker-specific investigations, then reassess relevant main changes and obtain remaining proof. There is no active merge reservation.