[schlessera]

Closes #2651
Closes #2655
Closes #2656

What changed

In-memory sync and app fixtures execute the original tests in fresh processes with unique private default maintenance ledgers. A separate acknowledged process holds the entire foreign 256 MiB ledger throughout each regression. Pi fixture calls three/four wait for completed observation and accepted Continue, with deliberate buffered delivery and a separate four-call Stop-only control.

Why this shape

Reuse the existing test-owned user/mount namespace launcher: literal dbPath: ":memory:", private temporary mirror, real workers, exact commit comparisons and production admission remain intact. The fixture checks distinct ledger inodes, unchanged same-domain refusal, live owner/reservation state, stream/process settlement and empty ledgers before deletion. Pi uses fixture-only checkpoint/Continue acknowledgements through its test pipe; the real adapter, journal and native freezer still execute.

Proof

Final tested head: fdd37e926e73332806c496ea4ada851224fc0c34.
Merged/tested base: aeaaf7794b6be41fde4e01bef78ce3f1a5828ac6 (#2397); initial base: 4d3c58db11eb7c9507d7e81bdd55cb56adc64b1b.

bun run check:pr --base origin/main
bunx tsc --noEmit
bun run lint

All exit 0. Final-head import-graph feedback executes the complete three-file combination: 54 pass / 0 fail, including all four original scope cases plus the overshoot control. Existing maintenance-budget controls pass 10/10 in an owned ledger namespace, including same-domain cross-process refusal, simultaneous admission, live-child retention and unknown-namespace ownership. An acknowledged holder's SIGTERM control exits 0 with its reservation released and joined. No exclusive Btrfs/loop fixture is used; no native lock wraps ordinary tests, mutations or preflight.

Final-head contention batch: 10/10 runs passed, each executing all four named cases (40/40 case passes) on two CPUs plus two bounded busy loops. Every run retained live foreign maintenance reservations and the exact Pi two-call grant assertions. Both pressure groups were terminated and joined; a final /proc check found no live members.

#2651 — in-memory sync isolation

• Failing-first: unchanged case on the initial base, with an acknowledged sibling holding the full default allowance in an owned outer namespace, exits 1 with worker_state_busy from real sync transport admission.
• Mutation on the final merged source: remove the private inner bind and its matching inode assertion. The original named sync again fails with the same busy diagnostic, exit 1. Owned holder release/stream draining and empty-ledger cleanup still complete.
• Restored: original TEMP_MIRROR_FILE_TRANSPORT_WORKS and exact local/remote commit assertions pass while the foreign holder remains live and reserved. Full 14-case sync file passes in final preflight.

#2655 — version-pin and ambient-wrapper isolation

• Failing-first: the same controlled default reservation makes the original old-version rejection assertion resolve. For the exact sync failure, first complete search and join the boot prune pass, then acknowledge the sibling holder before sync: the original synced assertion receives maintenance-busy SSE and exits 1.
• Mutation on the final merged source: remove the inner namespace and inode check. The version-pin assertion resolves and the wrapper case refuses maintenance, exit 1; restoration passes both in the final combined feedback run.
• All six in-memory app cases use the same private-process fixture; ambient wrapper restoration also runs when an outer case delegates. The receipts capture owned ledger uid/gid/mode/groups and reservation owner PID/start/namespace before release. This proves the busy-admission mechanism; the historical fchown EPERM warning's original owner/order remains unattributed.

#2656 — Pi progress gate and overshoot control

• Failing-first: hold tool-event delivery until the old four-call checkpoint, then deliver the backlog. The original SCOPE_ADAPTER_PAUSES_WITH_EXACT_FINITE_CEILING assertion sees count 4, overshoot 2, no newCap, and the exact exhausted-ceiling Stop-only reason; exit 1.
• Mutation on the final merged source: move the checkpoint from two calls back to four. The same original assertion fails for the same count/ceiling reason, exit 1. Restored gate passes.
• Preserve nonzero actual tmpfs heartbeat growth and the unchanged 150 ms freeze window, held-observation refusal, wrong-session refusal, completed observation, duplicate accepted grant, second-hit Stop-only and native Stop. A separate deliberate four-call backlog confirms exhausted headroom stays Stop-only.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issues are met locally; remaining hosted confirmation is named below.
• The PR and completed/advanced issues have verified release milestone 0.44.0.
• No changeset: tests and citation repairs change nothing a consumer can see.
• Leakage gate passes.
• No machine surface changed; no new CONTRACT commit.
• Moved documentation citations are repaired; citation checker passes.
• Provider-facing history is untouched.

Anything left open

The coordinator owns ready-candidate hosted confirmation and merge. This PR remains draft. Historical fchown warning provenance is not claimed as diagnosed; the controlled admission failure and fixture isolation are the demonstrated repair.

[schlessera]

Final draft handoff for head fdd37e926e73332806c496ea4ada851224fc0c34, merged base aeaaf7794b6be41fde4e01bef78ce3f1a5828ac6:

• Local check:pr --base origin/main, strict tsc --noEmit and lint exit 0. Final import-graph feedback runs all three affected files: 54 pass / 0 fail.
• Final-head contention batch passes 10/10 invocations, each covering the in-memory sync, old-version refusal, ambient-wrapper case and Pi two-call grant path: 40/40 case executions. Both bounded pressure groups are terminated/joined, with no live members remaining.
• Current-head draft gates and changeset pass; the latest contract check passes after the final receipt edit. Heavy categories are intentionally unselected while draft.
• PR and all three closing issues have milestone 0.44.0 read back. The branch is clean and pushed. Separate per-issue failing-first/mutation/restored receipts are in the body.

The coordinator owns ready-candidate confirmation and merge. The historical fchown diagnostic remains explicitly unattributed; no production unknown-version or admission policy is changed.