ui-server: maintenance release reports missing fixture state after refresh timeout

Start with the cited maintenance state and worker finalizer in packages/ui-sdk/src/server/maintenance-temp-budget.ts and maintenance-worker.ts, then inspect the native fixture cleanup helpers and the hygiene test at line 499. Use an isolated owned state domain to correlate operation exit, finalizer completion, and directory removal at teardown. Done means the historical fixture lifecycle is attributed with retained evidence; the issue explicitly says no repair or readiness change is selected yet.

Context

A second sequential reproduction pass for #2396, on source 775eb17aab740fa759c2182f306c38fc17acbcbe with Bun 1.4.2 on Linux, uses native process/signal tracing around the two complete failing files. The unchanged same-identity refresh supersedes the old Action with current evidence without advancing or writing Markdown case (test, packages/ui-server/tests/hygiene-review.test.ts:499) reaches its original 30000 ms deadline at 30094.36 ms. The runner reports four dangling processes killed. It then reports an unhandled error between tests:

ENOENT: no such file or directory, lstat '<owned TMPDIR>/odysseus-native-app-<fixture>'
sharedState -> open -> reservation.release -> maintenance worker exited.finally

The complete run exits 1 after 491.55 seconds: 37 pass / 1 fail / 1 unhandled error / 406 assertions across 38 tests and two files. The 600-second external cap does not fire. The following refresh cases pass; that does not cancel the unhandled error or qualify the run. This is a changed-observation current-source failure, not reproduction of #2396's historical CLI exit 137. Ptrace adds scheduling overhead; no historical resource or production incident is inferred.

Verified source: sharedState retries a missing state file by canonicalizing its parent (packages/ui-sdk/src/server/maintenance-temp-budget.ts:60-67). release reopens this shared state (packages/ui-sdk/src/server/maintenance-temp-budget.ts:157-160), called from the worker's exit finalizer (packages/ui-sdk/src/server/maintenance-worker.ts:293). The fixture client registers its native close in afterEach (packages/ui-server/tests/helpers/native-brain-client-fixture.ts:10-14), while native close removes its owned state directory (packages/ui-server/tests/helpers/native-app-fixture.ts:16). The exact cleanup/deletion versus unfinished operation ordering has not yet been joined to native identities.

Exact command:

TMPDIR=<owned disk TMPDIR> strace -f -qq -e trace=process,signal -o <owned trace> \
  bun run test packages/ui-server/tests/hygiene-review.test.ts \
  packages/ui-server/tests/module-settings-http.test.ts

The ordinary repository wrapper, original test deadlines, boundary guards and keyless fictional fixtures remain. No source instrumentation writes to subprocess stdout/stderr. Logs, native trace, command/runtime/exit receipts are retained in task-owned scratch. Exact-error/shared-state tracker searches found no existing owner; closed #1890/#1885 cover independent admission-domain contention, not this missing-state release event. Related #2396 remains independently open. Supports #736 by reference; its 100-child limit is preserved.

Out of scope

No claim that ptrace reproduces the old exit-137 cause, timeout increase, hidden unhandled rejection, swallowed reservation error, foreign state deletion, larger maintenance budget, production lifecycle patch selected without ownership evidence, or unchanged retry for green.

Scope

Attribute the unfinished maintenance operation, fixture close/removal and release completion at the timeout boundary. Establish whether the fixture must join outstanding work, whether its close completion is premature, or another owned lifecycle defect is involved, before selecting a correction.

Acceptance criteria

• Preserve this timeout and unhandled-error receipt separately from the historical #2396 failures and later controls.
• Obtain a bounded causal control with real owned operation/worker and state identities; retain the cleanup order and release outcome. If unreproduced, state exactly which evidence remains missing.
• Any supported correction preserves admission ownership, budgets, deadlines, cancellation/cleanup validation and offline guards; prove its intended failure and restored pass.
• Qualify the unchanged downstream hygiene scenarios and complete affected proof for the chosen correction. Failed or incomplete receipts remain failed or incomplete.

Verification

Use an isolated fixture with explicit owned operational state. Observe operation exit, finalizer completion and fixture directory removal before they disappear. A controlled held operation at teardown is a possible reduction, not an established explanation. Run the ordinary guarded relevant files after a justified correction; do not infer completion from the following case passing.

Contract impact

None selected. This is a found native fixture/cleanup attribution gap, not a public API or release commitment. Keep needs: repro without agent-ready.

Controlled lifecycle reduction — 2026-10-18

At 775eb17aab740fa759c2182f306c38fc17acbcbe, a two-arm diagnostic uses real native maintenance workers, an explicit fixture-owned state domain and a stdin READY/GO barrier. Joining exit before removing the state parent resolves with code 0. Removing only that owned parent after READY, then supplying GO, produces READY/DONE stdout and empty stderr; the monitor exits 0 (native wait4 confirms WIFEXITED/WEXITSTATUS=0), while the completion promise rejects with ENOENT at the removed state parent. Both diagnostic expectations pass, eight assertions. No product guard or original suite deadline changes.

This supplies a concrete premature-state-removal trigger for the release failure boundary. It does not reproduce the earlier slow hygiene timeout or identify which historical fixture operation removed that state before release. The earlier SIGSTOP observer failed its own stopped-state precondition under ptrace and never removed state; it is excluded from this result. Keep needs: repro for historical lifecycle attribution; no repair or readiness change.

2026-10-20 triage at main af0547c2d4d197ed3766f2817cf56eb5f0486ab4: priority p2 sorts this wanted, unscheduled attribution work. Preserve needs: repro, the bounded observations/non-reproductions and their original source identities; no causal repair, current release urgency or new runtime result is inferred. No milestone or readiness is added.