[schlessera]

Closes #2552

What changed

Cancellation fixtures restore their Git lookup and maintenance-worker spies from synchronous afterEach cleanup before deleting fixture directories, as well as from an idempotent finally. The unnecessary process-wide PATH override is gone. Child-process controls exercise both during and after cases with an induced timeout, then verify real Git resolution, original PATH/function identities, and a late callback unwind while the next case owns its own spies.

Why this shape

Bun can time out an async callback and run afterEach while its finally is still suspended. Registering restoration on the existing cleanup stack makes it independent of that callback settling and preserves cleanup ordering. The controls suspend a disposable copy of the actual cancellation callback before native work, retaining its setup, spies and teardown. They keep the normal maintenance execution and cancellation assertions unchanged.

Audited process.env.PATH writes and Bun.which spies throughout ui-server/ui-sdk tests. The four other lookup-spy sites (worker-output-budget, worker-filesystem-filter, worker-launcher, worker-host-refusal) restore synchronously without awaited work. No other matching instance needed changes.

Proof

Head: 4b1e74cdc62bf8e7911729d2e6e319bfeb163d44.
Base: 55108a63255d82d98822093db3cc3b90a858e03a.

• Failing first: a copy of the original main test, suspended at its first try statement with a 250 ms test timeout, logged real Git for during, then the deleted odysseus-maintenance-*/git shim for after. The following original case failed with ENOENT at its Git initialization, matching the reported CI sequence.
• Mutation: omitting cleanup.push(restore) makes both regression controls fail. The child assertions are FOLLOWING_CASE_REAL_GIT for during and FOLLOWING_CASE_ORIGINAL_MAINTENANCE_WORKER for after; late-finally checks also detect the still-active prior spies. Restoring registration passes both controls (2 tests, 18 parent assertions).
• bun run test packages/ui-server/tests/maintenance-startup-view.test.ts: five consecutive standalone runs, each 27 pass / 0 fail, in addition to combined/preflight runs.
• bun run test packages/ui-server/tests/maintenance-startup-view.test.ts packages/ui-server/tests/maintenance-cancellation-cleanup.test.ts: 29 pass / 0 fail.
• bun run lint and bun run typecheck (tsc --noEmit): passed.
• Final-head bun run check:pr --base origin/main: passed, including 29 pass / 0 fail affected tests.
• Final-head two-worker verification: 31 pass / 0 fail / 238 assertions. Both private checkouts ran head 4b1e74cdc62bf8e7911729d2e6e319bfeb163d44, tree c9e43d7d54dd88503d9c5e508c92cb0ae9e9a35d, parent 55108a63255d82d98822093db3cc3b90a858e03a. JUnit/timing reports matched the complete three-file inventory. Command:

bun scripts/unit-workers.ts \
  packages/ui-server/tests/maintenance-startup-view.test.ts \
  packages/ui-server/tests/maintenance-cancellation-cleanup.test.ts \
  packages/ui-server/tests/module-settings-http.test.ts

The worker split uses the ordinary copied-storage unit fixtures; native Btrfs qualification is separate.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only (docs/decisions/provider-history.md): the provider-history guard passes, or nothing on a turn's path changed.

No changeset: this changes tests only; no packed source, contract, documentation or provider-facing history changes.

Anything left open

Coordinator-owned ready-candidate confirmation and merge. This PR remains a draft under the worker brief; no ready transition, confirmation or merge is requested here. Local preflight and two-worker receipts are recorded above. Main advanced during verification (including app-state isolation in #2377); these receipts establish the recorded parent/head, and do not claim proof for a later combined tree. The coordinator owns refresh/confirmation for the integration candidate.