[schlessera]

Refs #2457

Current correction — 2026-10-21

Hosted unit shard 3 found a real fixture regression: all three owned-prune tests refused the stale gated(execution, …) source anchor. Actual checkout was 9d70c461bc0a9ce22de12ed158c8f3cad67dae53, tree 3b639c2ddf92125d266dfb762c9c5147e41f14ea, with parents main e2deae1f3c4e18affacc0da45d6202b0ca4378fc and head 063f5a01f6cd477be853e570ddd604ff052d41dc. Worker 2 reported 1,269 pass / 3 fail / 7,304 assertions. This is not a CI flake.

Correction f8c97e1ba27025e6cbb6cdbb7d479c94ff5861f1, tree f273dd566237778051296b3ab9e6b3545daf45fe, is a one-line test-helper change on exact head 063f5a01f6cd477be853e570ddd604ff052d41dc: both the exact anchor and inserted callback prefix now use gated(admission, …). Missing/duplicate refusal and every existing assertion remain unchanged. There are no production, lock-policy, API, dependency or release-content changes in this increment; the original additive minor changeset remains applicable to the cancellation implementation.

The unchanged focused suite reproduces all three anchor failures before the fix, passes 3 tests / 131 assertions after the fix, reproduces all three failures when only the correction is reverted, and passes after byte-identical restoration. This is fixture-anchor failing-first evidence, not a new runtime-cancellation causal claim. The actual original/variant method extraction, signal/argument identity, execution order, success/error cleanup, nonpublication, real tick coalescing and receiver identity all remain exercised; no follow-on failure occurred. Related boot/DB/collector/native-wrapper tests pass 16 tests / 152 assertions. Generated boundary and composed prune/boot syntax also pass. Source audit found no other stale host-boundary transformation or extraction consumer.

Strict bun run typecheck passed. Required bun run check:pr --base origin/main passed on tree f273dd566237778051296b3ab9e6b3545daf45fe, base e2deae1f3c4e18affacc0da45d6202b0ca4378fc: 569 fast tests / 3,928 assertions; two separately invoked runtime tests / 13 assertions; 2,321 affected tests across 188 files / 20,625 assertions; zero failures. The corrected owned-prune suite and all nine metadata-cancellation tests ran. Preflight started with the corrected working tree, committed unchanged while fast gates ran; no tested source bytes changed during the command.

Preflight wall was 3,094.81 s, user CPU 1,557.67 s and system CPU 779.73 s; peak reported RSS 4,910,756 KiB. These are command/waited-process costs, not a whole-host total or a measured speedup. Dependencies were freshly installed frozen with copyfile backend, no external workspace symlinks, and an unchanged lockfile. System bubblewrap 0.9.0 first failed the unchanged setup guard at 432.4 ms against 250 ms. A private byte-identical copy of bubblewrap 0.13.1, with the original runtime/PATH remainder retained, passed setup and the full preflight; this profile does not qualify the earlier pressure arm. No guard was bypassed.

The earlier combined commit 113cd7f1d56a9c7b182b0b69a2bb9bb183d74003 / tree dea94afaaf2f6168fe47f2d6f650ceeb723412c8 does not contain this later helper fix. Git comparison confirms that only the dormant diagnostic transformer changed relative to the reviewed #2464 head. Production cancellation, speech/runtime source and #2458 remain untouched by this delta. This is file-level relevance, not relabelled pressure qualification. No new pressure or full diagnostic run was performed.

PR remains draft. The failed confirmation's reservation was released; this child acquired no reservation and requested no hosted proof. Parent owns the next confirmation and tracker custody. The original import-graph preflight missed this source-read consumer; complete hosted unit selection caught it. No import-graph completeness or performance gain is claimed.

Failed hosted confirmation on the previous head — 2026-10-21

2026-10-21 candidate confirmation failed; reservation released.

Unit shard 3 failed three owned-prune diagnostic tests on actual checkout 9d70c46, tree 3b639c2ddf92125d266dfb762c9c5147e41f14ea. Its parents are the recorded main e2deae1 and candidate 063f5a0.

The precise failure is Owned prune fixture anchor changed in scripts/native-proof/owned-prune-variant.ts:23. On that source the fixed source transformer required return gated(execution, async hold => {; the cancellation implementation used gated(admission, ...). All three tests refuse generation before their behavioral checks. Unit worker 2 reports 1,269 passes, three failures and 7,304 assertions; this is a real related fixture regression, not a flaky runtime or an infrastructure retry.

The coordinator released reservation 498c4bfada8ecb906ea2a8f8c377f1d2 immediately and verified no active reservation. The controller then exited 1 with No reservation to renew. PR #2464 is back in draft. No merge or retry occurred. Other selected jobs may finish, but this candidate remains unconfirmed.

The completed correction and source-transform audit are recorded above. Missing/duplicate-anchor refusal, original-versus-variant execution order, signal/argument identity, publication and cleanup/error assertions remain unchanged. Focused failing/restored mutation receipts and required preflight pass. The historical combined-tree pressure pass keeps its original identity; no additional pressure run was allocated.

What changed

Queued status/module-list metadata now cancels when its caller disconnects or the app closes. BrainClient.modules accepts an optional admission-only signal. An admitted worker still drains its output and cleanup; HTTP dispatch retains the database until the handler settles. Both module-list consumers use the same policy. The additive public API, minor changeset and moved documentation citations are included.

Why this shape

The real-app failing-first control reproduces the missing cancellation edge while holding the canonical output lock. The existing abortable admission path is sufficient. Search execution cancellation, settings/mutations, streaming sync and governed refresh retain their existing lifetimes. There is no timeout, cache or lock-policy change.

Proof on the original cancellation head

Base: e2deae1f3c4e18affacc0da45d6202b0ca4378fc. Candidate tree: 3b639c2ddf92125d266dfb762c9c5147e41f14ea, committed unchanged as 063f5a01f6cd477be853e570ddd604ff052d41dc. The exact source tree was checked before commit; committing changed no tested bytes. Main remained at the recorded base on final fetch.

• Real-app caller-abort and shutdown controls fail on QUEUED_STATUS_SETTLES_BEFORE_OUTPUT_LOCK_RELEASE before the correction; restoring propagation passes. Removing only the new propagation reproduces both failures, with holder release and cleanup joined.
• Both routes cover pre-aborted, queued, shutdown and real-loopback abort, observing the actual Bun server signal. A FIFO sentinel proves cancelled work cannot start after lock release.
• The ordinary native-worker control retains stdin/exit/both-EOF, publication, cleanup, lock and DB ownership. Deliberately forwarding shutdown into active execution fails ADMITTED_METADATA_REACHES_PUBLICATION_AFTER_CLOSE; byte-identical restoration passes.
• All nine existing HTTP-drain/native-browser/cleanup controls remain unchanged and pass. Four existing search cancellation/deadline/disconnect controls pass.
• Strict types, API surface, leakage, citation checks, pending changeset validation and required local preflight: passed. bun run check:pr --base origin/main completed once in 51m14.84s (562 fast invariants, 2 separately invoked runtime tests and 2,307 import-graph tests; zero failures). All nine final metadata tests ran in that preflight. The committed-range contribution changeset check also passes.

Causal controls used system bubblewrap 0.9.0, Bun 1.4.2 and the real app with its explicit native fixture. The setup prerequisite independently rejected 422.3 ms against its unchanged 250 ms limit. An owned byte-for-byte copy of bubblewrap 0.13.1 then passed that prerequisite and the real native guard before required preflight. This separate preflight profile establishes no historical binary identity or latency cause. Native storage fixtures here do not qualify a real Btrfs broker.

Checklist

• Complete selected hosted proof passed (previous confirmation failed; corrected draft awaits parent-owned confirmation).
• Remaining acceptance criteria are named below.
• Release milestone 0.44.0 is assigned to this PR and the issue it advances.
• Minor changeset and additive integration-contract/API report included.
• Leakage and documentation checks passed.
• Provider history is unchanged.

Anything left open

Complete original-pressure qualification passed on the separately identified local combined tree with #2458, as recorded below; this PR alone is not relabelled as that combined source. The independent #2456 causal obligations and the remaining original #2457/#2279 acceptance criteria remain open. This is a scoped cancellation correction, not a worker-latency diagnosis, common-cause finding, complete pressure pass or measured performance gain. The previous reserved confirmation failed; the parent owns any new confirmation for the corrected draft; #2319 activation remains deferred. The separate #2279 draft is unchanged.

Historical independent review and combined qualification (before fixture correction)

2026-10-21 independent review and original-load qualification passed.

The reviewer found no unresolved cancellation correctness gap and reran the exact #2464 metadata suite: 9 passed, 108 assertions. A separate local merge combines #2464 head 063f5a0, #2458 head b751f30 and main e2deae1. Combined commit 113cd7f1d56a9c7b182b0b69a2bb9bb183d74003 has tree dea94afaaf2f6168fe47f2d6f650ceeb723412c8. There were no merge conflicts; only the CI decision document combines content from both sides. Full source attribution retained all invocation, metadata, producer-audit and dormant-reuse guarantees.

Exactly one original-load invocation passed on that combined tree. Twenty owned busy loops remained on CPUs 0–3 throughout; all original assertions, timeouts and guards remained unchanged. The actual audio/final-drain/no-grant case passed in 14,774.05 ms, unmount in 13,464.65 ms; inner 2 pass / 0 fail / 13 assertions, outer 1 pass / 0 fail / 1 assertion. Teardown completed. Whole command exit 0, signal null and both output EOFs joined; no safety watchdog fired. Strict types and 48 focused combined-tree tests also passed.

This run used system bubblewrap 0.9.0, Bun 1.4.2, Node 24.21.0, Chrome 140.0.7339.127 and 3,689 mount entries, with actual native admission. No diagnostic overlay, private fast-native prefix, clean namespace, JIT change or retry was used. The unlabelled idle-request warning still appears and is not assigned a cause. Historical #2456 attribution remains open.

Fresh invocation build: 198.053 s wall / 61.326 s waited CPU. Checked hook admission: 7.621 ms. Controller start through command exit/EOF/anchor: 260.514 s; command waited CPU 66.682 s includes the build. Controller including cleanup: 262.551 s wall / 1.029 s CPU. Load loops: 964.484 s CPU, separately accounted. These are overlapping scopes with declared exclusions, not a matched speedup or comprehensive total.

Parent independently verified 177 indexed files / 44,245,801 bytes with no mismatch, manifest SHA256 b7031119f6c79c0906711c4bcd4f78dfb7881410adbdd998b05ce4ee18e515bd. All 153 recorded PID/start identities were absent, including zombies; one-second sampling cannot establish exhaustive descendant coverage. The unrelated sibling survived owned cleanup before its own owner stopped it.

The runtime allocation is terminal. This is exact local combined-tree qualification, not hosted proof or delivery of either source PR. At that historical handoff, head 063f5a0 and main e2deae1 matched the recorded preflight and inspected synthetic merge. The later confirmation failed as described above. Selected hosted proof and actual squash/main-push verification remain required for the corrected head. #2458 remains separate, historical #2456 attribution is retained, and #2319 activation remains deferred.

[schlessera]

2026-10-21 candidate confirmation failed; reservation released.

Unit shard 3 failed three owned-prune diagnostic tests on actual checkout 9d70c46, tree 3b639c2ddf92125d266dfb762c9c5147e41f14ea. Its parents are the recorded main e2deae1 and candidate 063f5a0.

The precise failure is Owned prune fixture anchor changed in scripts/native-proof/owned-prune-variant.ts:23. The fixed source transformer still requires return gated(execution, async hold => {; the cancellation implementation now uses gated(admission, ...). All three tests refuse generation before their behavioral checks. Unit worker 2 reports 1,269 passes, three failures and 7,304 assertions; this is a real related fixture regression, not a flaky runtime or an infrastructure retry.

The coordinator released reservation 498c4bfada8ecb906ea2a8f8c377f1d2 immediately and verified no active reservation. The controller then exited 1 with No reservation to renew. PR #2464 is back in draft. No merge or retry occurred. Other selected jobs may finish, but this candidate remains unconfirmed.

A fresh agent is correcting the exact diagnostic anchor and auditing analogous source transforms. Missing/duplicate-anchor refusal, original-versus-variant execution order, signal/argument identity, publication and cleanup/error assertions must all remain. It will retain focused failing/restored mutation receipts and required preflight before updating this same draft. The historical combined-tree pressure pass keeps its original identity; no additional pressure run is allocated.

[schlessera]

The cancelled unit (4) job contains an actual failure before cancellation: the production cross-workspace consumer test for packages/ui-server/src/brain/application.ts exceeded its unchanged 30-second limit (37,325.69 ms). Worker 2 completed with 1,351 passes / one failure before cancellation. JUnit and the unit-proof-4 artifact corroborate it. The aggregate job executed no steps.

Tracked independently in #2465, attached to #1849; #2457 is blocked on this qualification gap. The owned-prune anchor fix continues separately. No unchanged hosted retry or timeout increase is authorized by this observation. PR remains draft; the merge-window reservation is released.