ui-server: diagnose startup input copy conflict in jobs settings HTTP proof

Start with the failed CI run and the unchanged command bun run test packages/ui-server/tests/jobs-board-selection-http.test.ts in the documented offline Linux environment. Trace the initial jobs settings GET through packages/ui-server/tests/jobs-board-selection-http.test.ts and the copied-input stability check in packages/ui-sdk/tests/helpers/worker-startup-view-fixture.ts; identify which input changes and its execution context. Done means reproducing the conflict and recording the changed input identity, or retaining the issue as needs: repro with the evidence gap documented.

Context

Automatic main-push run 39109406806, unit shard 1, fails on delivered source cf4098cb9bfe7a22c476fba727f52ff6fb0db6d2 (tree 053fa3ce8d80f1b9a1284cac3f1739039b01ca9d). Other selected categories pass; the final aggregate correctly fails.

The assertion in packages/ui-server/tests/jobs-board-selection-http.test.ts:33 expects HTTP 200 from the initial mounted jobs settings GET, but receives 500 with startup input changed while copying. The test reports 1,803 pass / 1 fail across 131 files in its worker, 10,171 assertions. The diagnostic originates from the copied-input fixture stability check (createFixtureWorkerStartupView, packages/ui-sdk/tests/helpers/worker-startup-view-fixture.ts:195), rather than the sandbox-note cleanup assertion delivered by #2411. This establishes the observed failure, not its cause or a production race.

Scope

Diagnose which fixture input changes between the copied startup view's initial and final stamps, retain the actual path class and changing file metadata with fictional fixtures, and select a correction only after reproducing the specific conflict. Preserve the complete failed main receipt. No unchanged CI retry has been requested.

Out of scope

Weakening copied-input stability checks, retrying conflicts automatically, ledger resets, HTTP status changes, sandbox timing/flags, or changing bubblewrap supply policy in #2375.

Acceptance criteria

• Reproduce the exact initial jobs settings GET conflict with the unchanged fixture; record actual source, execution order and changed input identity. If it does not reproduce, retain needs: repro and the evidence gap.
• If a fixture lifecycle defect is established, fix its ownership or synchronization and show the original assertion failing before and passing after; audit the same helper path for equivalent mistakes.
• Run the affected mounted HTTP/settings suites, meaningful mutation, local preflight and selected hosted proof before delivering a fix.

Verification

Start with unchanged bun run test packages/ui-server/tests/jobs-board-selection-http.test.ts in the documented offline Linux environment with qualified temporary capacity. An isolated pass does not explain the failed combined main run. Preserve the CI job's preceding execution context and identify the actual mutator before claiming resolution.

Contract impact

None selected. This is a reproduction/diagnosis issue; any proposed product behavior change needs its own scope assessment.

2026-10-19 recurrence

PR #2442 confirmation run 39257264455 attempt 1 is completed failure. Unit shard 3, job 118076217501, tested actual checkout 0e50fdf6194f50acebbc9e807da22c3d4ef1763e (base 09eb1f78e99555110f4ef1c8b78e23d188ec77e5, head f66593b808eba9caf004acaeb61e30a27b3c97fe, tree 1cbedefd9bbd828decbe818355d3aebd989c74fd). The sole unit test failure is the same initial jobs settings GET at jobs-board-selection-http.test.ts:33: expected 200, received 500 with startup input changed while copying. It occurred in unit worker 2/2; the changing input path/metadata remain unknown. Aggregate job 118084351982 correctly rejected selected unit failure. Browser shard 2 separately failed #2443; all other selected execution jobs passed, and packaging was intentionally unselected. No retry or bypass; existing #2413 owns this recurrence. Historical isolated passing receipts remain separate.

Claim: release044-2413-startup-r1-20261019 — the user-authorized 0.44.0 coordinator resumes read-only source/evidence diagnosis. No implementation or runtime allocation yet; prior no-reproduction result remains intact.

2026-10-19 bounded diagnostic result

Temporary mismatch-only diagnostic head d97612332f0995a4651ec06ef2f10865873a3905 (tree 5698aad9d9fef0648b359fe258b336257472aec6, parent 09eb1f78e99555110f4ef1c8b78e23d188ec77e5) preserves the original guard/refusal and records the first non-root mismatch only. Corrected outside instrumentation validates both copy roles with a real supplied writer: 3 tests / 68 assertions pass, including original refusal, metadata and cleanup. This validates logging, not a historical mutator. The first harness counter failure and conservative admission rejection remain separate receipts.

Exactly one natural five-file invocation then passed 45 tests / 378 assertions, exit 0 in 199.97 seconds, with no mismatch record. Actual traversal matched the requested suffix: http-cli-errors, http-websocket-admission, hygiene-review, inbox-bin, jobs-board-selection-http. Runtime was the hosted Bun 1.4.2+744846f84 with locked inputs, offline guards, normal HOME and a finite private tmpfs at the original /tmp path. This omits earlier full-worker state and changes local filesystem/resource conditions; it is not historical equivalence. An independently verified Storage preflight coexisted without modification. Resources and capacity leases were released.

Result: nonreproduction only. Keep needs: repro, retain both failed hosted receipts, and select no fix or unchanged retry. The changing input and writer remain unknown.

2026-10-19 additional main recurrence and diagnostic correction

Automatic main-push run 39277088142, attempt 1, completed with failure. Unit shard 3 job 118144658940 failed the initial jobs settings GET at packages/ui-server/tests/jobs-board-selection-http.test.ts:33: expected HTTP 200, received 500 with startup directory membership changed while copying. Actual checkout: e16b8407f81da4071a3a1bf1cc04299acb1a2522, tree aaaa963bf79552ecfad0bab7706e2b04f91cd11a, parent 09eb1f78e99555110f4ef1c8b78e23d188ec77e5. The failing worker reported 1074 pass, 1 fail across 107 files.

The exact message identifies the directory same-descriptor guard (copy, packages/ui-sdk/tests/helpers/worker-startup-view-fixture.ts:109-176, on that failed checkout), rather than the final path-stamp guard at line 195 reported previously. The comparison includes dev, ino, size, mtimeMs and ctimeMs. A directory metadata mismatch does not establish membership change. Directory identity, changed field, copy role and writer remain unknown; no production race is established.

PR #2437 confirmation run 39281051408 passed complete selected proof on synthetic checkout 79f251659e84f02f2247543aeb7e5e579bd270b6, tree a678cbdec549c35130a47a9147de2982ae25e9ad, parents e16b8407f81da4071a3a1bf1cc04299acb1a2522 and 9d1ef15a9c7ae96affa1d4374da23561506f5f35. This same case passed in unit shard 2 job 118155691191, taking 6732.45 ms for the complete case. Its worker selected 52 files, with the target at position 14; the failed main worker selected 107 files, with the target at position 70. Different selections and execution contexts do not establish a repair.

The source-only diagnostic correction starts from existing diagnostic commit d97612332f0995a4651ec06ef2f10865873a3905, tree 5698aad9d9fef0648b359fe258b336257472aec6, parent 09eb1f78e99555110f4ef1c8b78e23d188ec77e5; it is not relabelled as current main. It covers both guard sites and preserves live-acquisition/private-recopy role labels. Each original final stat is retained once. On mismatch only, a bounded record includes guard, role, relative fixture path, kind, capture provenance, before/final comparison fields and differing fields. Original comparisons, errors, refusal and cleanup remain intact. No extra stat probes, content reads, recursive inventories or retries are added.

Earlier NONREPRO45/378 and other isolated passing evidence remain non-reproduction evidence. Historical mechanism remains UNKNOWN. Retain needs: repro; no readiness or closure claim. No new test/runtime execution or unchanged replay has occurred. Independent review and a new allocation are required before any diagnostic run; no capacity is reserved.

Subsequent diagnostic selection and automatic main proof

The single six-file diagnostic attempt passed 54 tests / 446 assertions, with no mismatch record. It retained diagnostic commit d97612332f0995a4651ec06ef2f10865873a3905 plus its pinned both-guard instrumentation, Bun 1.4.2 and unchanged input manifests. Actual traversal matched the requested order. The failed worker's first 64 files and sibling worker were omitted; this remains non-reproduction evidence, not a repair. No retry was performed.

Automatic main run 39288072485, attempt 1, push, passed complete selected proof on 0b46b9db7925ce2e52c85a56c6200a4e2f330bd7, tree a678cbdec549c35130a47a9147de2982ae25e9ad, parent e16b8407f81da4071a3a1bf1cc04299acb1a2522. All 16 executed job checkout logs and 13 resource receipts match; aggregate job 118188679835 passed with no retained proof. Packaging was intentionally unselected. The jobs-settings case passed in unit shard 2, worker 2, job 118181730610: 40 assertions, 6.465 seconds. Its helper and test are unchanged from the failed parent. No startup-copy mismatch appeared in these logs.

This verifies that exact main SHA as green. It does not identify the historical changed field, directory or writer, or prove the intermittent failure repaired. Keep this issue open with needs: repro; preserve the prior failed main run and all non-reproduction limits.