ui-sdk: attribute a native strict SDK bootstrap mount-inspection refusal

Start with the strict SDK test at packages/ui-backend-claude/tests/sdk-host-relay-identity.native.ts and the fixed helper inspector at packages/ui-sdk/tests/fixtures/identity-helper.py:398-439; trace the named launcher and probe stack, then use the prepared offline native image/helper and loopback-only fixture with finite attempts and unchanged deadlines. Done means recording bounded phase, identity, and exit/signal observations, attributing the failure, and meeting the acceptance criteria without treating either existing attempt as a passing qualification.

Out of scope

No mount-guard relaxation, same-UID fallback, deadline increase, extra filesystem authority, or host-writer descendant investigation. The cause is unknown; this issue does not select a production fix.

Context

At local candidate 4ba93ac7c0551a2224dd90b8dea7ebe6c9105f81 (tree 85567ec3a7e406ba972da06208a144ff6b24c5de), an offline complete identity qualification exits1 before the native-brain phase. The governed SDK profile passes. The strict SDK child in packages/ui-backend-claude/tests/sdk-host-relay-identity.native.ts:10-15 exits1 after launchAgentWorker refuses mount inspection: inspector: [Errno 2] No such file or directory: '/proc/2054/root/tmp/brain-worker-state'. The stack reaches packages/ui-sdk/src/server/worker-launcher.ts:1364, packages/ui-backend-claude/src/worker-spawn.ts:149, and packages/ui-backend-claude/tests/fixtures/sdk-host-relay-probe.ts:228.

The fixed helper inspector at packages/ui-sdk/tests/fixtures/identity-helper.py:398-439 verifies identity/namespace and opens the exact worker state root; refusal is preserved. The fixture oracle at packages/ui-backend-claude/tests/fixtures/sdk-host-relay-probe.ts:62-76 records identity then execs the installed native CLI. The failed receipt does not establish why that root was absent, whether the child exited, or a causal source defect.

The same frozen candidate's immediately preceding whole attempt passes both governed and strict SDK profiles, all27 broker cases,13 egress cases and20 checkpoint-reader controls, then independently fails on a stale reserved loop prerequisite. Neither whole attempt passes. The later attempt's owned records, source directories and workers reach zero and its container is removed; it never creates a native loop. Retained receipts: run-WJnpWu (bootstrap failure), run-szIOc0 (SDK category positives and separate loop failure).

Duplicate review found #2315, which attributes exit143 to a four-turn profile deadline. This observation is exit1 with an explicit mount-inspector ENOENT; no equivalence to that timeout is established. Related identity delivery context is #1677 and #1645. Found while qualifying #2300/#2343/#2347.

Scope

Obtain bounded offline phase/exit/provenance observations for this exact strict SDK bootstrap failure, reproduce its causal condition, and select a guard-preserving correction in the responsible fixture or production path only after attribution.

Acceptance criteria

• Retain the original failed source/tree and successful same-source category controls without calling either a complete passing qualification.
• A bounded offline reproduction identifies the relevant worker identity and bootstrap phase plus actual exit/signal observations, without exposing credentials or adding host authority.
• A named failing-first or causal mutation fails on the measured condition, and the restored correction passes both SDK profiles with the existing identity, mount, credential and cleanup assertions intact.
• Complete affected native qualification and zero owned-resource residue are recorded with exact source identity; no missing or censored result is green.

Verification

Use the existing prepared offline native image/helper and loopback-only SDK fixture, finite attempts, unchanged current deadlines and actual owned cleanup. Needs reproduction/attribution before implementation; no agent-ready label yet.

Contract impact

None selected. Any later API or shipped behavior change must assess its own release/contract metadata.

Additional hosted observation (2026-10-19)

2026-10-19 — hosted mount-inspector ENOENT observation from #2417 / PR #2434.

Run 39217736277 attempt 1, runtime_host job 117945823758 fails the first separate-UID broker case, nested server-owned 0700 parent masks launch and conceal private files and sockets, at NESTED_PRIVATE_PARENT_LAUNCH_governed (packages/ui-sdk/tests/identity-broker-qualification.native.ts:55-98, assertion at line 84). The launch throws WorkerHostError: the mount inspector cannot open /proc/96/root/tmp/brain-worker-state (ENOENT). The existing mounts inspector opens and validates the worker root in packages/ui-sdk/tests/fixtures/identity-helper.py:397-439. This is a governed broker launch, distinct from this issue's original strict SDK bootstrap observation; it shares the mount-inspector refusal signature, but common causality is not established. No worker-exit cause can be inferred from the missing path alone.

Actual checkout: synthetic 4e2448ea8ab6402f64413e1080738eb09fd27b8e, tree 07874b2132e08cde15e0e0b8d743f483a1f59fba, parents base 90a95123cfceb169bd2ecf7c213544db742eaed7 and head 17766e9a065e1e8dfb58c33c36af7f27991ed77e. The PR only splits navigation browser tests and changes their Vitest include; native helper, launcher, fixture, identity test and driver are unchanged from base. This is an external blocker for the browser-test redistribution, not evidence of a navigation regression.

Artifact runtime-host-proof, 12170891852 is 495431 bytes; downloaded ZIP SHA256 verified as 0b579c67f8a7c9d68db6eba0413ab5737b37ba7dd55788ee045e29acf98a43a0. run-38IeBv/stderr.log preserves the assertion/refusal; stdout records zero owned records, source directories and workers. cleanup.json confirms container removal. Later identity cases did not execute; no complete identity proof is claimed.

The preceding native managed hosted phase passed (426.780 s), including its expected automatic-index-failure negative control. That control's logged test failure is not the job's unexpected failure. The separate-UID phase failed after 2.258 s. Resource receipt: 429.039 s total proof elapsed, 678.62 VM-active CPU seconds, sampled peak used memory 1996492800 bytes on a 4-CPU / 16765378560-byte VM. Job wall time was 516 s including setup. These are failed-run costs, not improvements or process-specific memory measurements.

Retain needs: repro on #2350. A bounded phase/identity/exit reproduction and guard-preserving failing-first correction remain required. No unchanged rerun, deadline increase, fallback or inspection relaxation was applied. The original CI run remains intact while other selected jobs finish.