Execution browser: diagnose intermittent completed-source admission failure

The execution browser job for candidate 673d81462b300605ca65e1ec4e576d1324ad92a8 failed the existing Explicit admission must refresh actual source catalog oracle in run 39477673307.

The genuine Worker completed nominal100. The browser found and clicked the enabled admission button, but the source-exists DOM did not appear within the unchanged 15-second guard. At the later diagnostic snapshot the server still reported completed/finished/unsubmitted, the workspace was current, and no browser error was recorded. The root cause is unknown. Retained job logs, compiled HTML and screenshots preserve this first failure.

At the failing source, the fixture's bounded route classifier excluded the admission POST. Its missing entry therefore cannot establish whether that request was sent, pending or refused. Do not infer a lost click from that log.

Separate local diagnostics on macOS with pinned Bun1.4.2 passed: the exact CI compiled page with controlled immediate HTTP completion; the same compiled page with streamed progress, cancellation, discard and a second completion; and the real native Auth/SQLite/Worker browser fixture with observational route/client-stage instrumentation and unchanged assertions/timeouts (1 test, 0 failures, 2 assertions, 24.08 seconds). These non-reproductions do not explain or erase the Linux Bun1.4.3 failure. No product fix has been applied.

• Add bounded, credential-free admission boundary diagnostics: request entered/settled/status and current client stage/button state. Keep bodies, tokens, account identifiers, recording data and arbitrary error strings out of diagnostics.
• Reproduce the actual native failure at a suitable seam, with an explicit causal prediction and retained original evidence.
• Fix the demonstrated cause and add a regression that exercises it. Preserve authority checks, explicit admission, the 15-second guard and the original source-catalog oracle.
• Qualify the original real native browser scenario on the affected CI platform. Record any retry separately from the first failure.

Related to #23. This is an unresolved browser admission investigation, not a physical-flight or source-authentication qualification.

Published admission diagnostics, October 20

Commit ee6ded2 is now on main, authored and committed as Chris without coauthors. The fixture records bounded admission request counts and the latest request's ordinal, settled state, status and elapsed time. Browser failure reports add the admission button state, source-exists DOM state and client POST count. Request bodies, credentials, account identifiers and arbitrary exception text are not collected. Settlement does not prove a durable commit or client receipt, and the bounded snapshot is not a complete request history.

All five jobs passed in the exact feature CI run. Its actual native Auth/SQLite/Worker browser scenario passed 2 tests with 6 assertions in 63.04 seconds; its full suite passed 1,111 tests, skipped 39 and failed none, with 408,445 assertions across 1,150 tests in 163 files. Original browser assertions, the 15-second guard, explicit admission and authority checks are unchanged. The separate automatic post-main run has started and is still running at this update.

This completes the diagnostic item only. The original intermittent admission failure remains unreproduced and its cause unknown; this change is not a causal fix. Reproduction, a demonstrated fix/regression and final qualification of that fix remain open. The earlier failed attempt and its separately recorded browser-only retry remain preserved.

Draft #85 adds a controlled native authorization-renewal scenario on 8477de907fc6f67b2682dc7d3ae2647486266962. An ordinary public refresh is deliberately held before the admission click. The real client then starts the explicit decision; only after its pending state is observed does the fixture end the genuine workspace stream. Private content is concealed, the earlier decision sends zero admission POSTs and leaves the original durable source count unchanged. After fresh authorization restores the same completed result, a NEW explicit click must send exactly one POST and produce the native catalog/audit result. No automatic mutation retry or authority change is introduced.

The controlled original one-click assumption has a retained native RED with zero POSTs. The corrected actual macOS/Bun1.4.2 Auth/SQLite/genuine-Worker browser case passes 2 tests/6 assertions in 31.73 seconds, with unchanged guards and Chrome exiting only after owned cleanup. A client-seam regression also protects cancellation and the fresh explicit decision. Independent Spec and Standards reviews are clean. The incident production inputs and four test files remain unchanged when integrated onto the reviewed VTOL workspace parent; combined lint and both type checks pass.

Exact combined Linux CI is pending before main publication. This establishes the controlled authorization-cancellation behavior and removes an invalid unconditional test guarantee. It does not establish the exact transport trigger of the historical Linux admission failures. All original failures, separate local Chrome/startup failures, and this issue's remaining causal-investigation criteria stay open. The separate completion-read correction in the same draft does not explain Worker completion timeouts in #44.

Published #85 by normal fast-forward as Chris, without coauthors, to main 8477de9. The exact combined-source workflow 40009033129 passed all five jobs and required steps. Its original single-download archive verifies 1,797 passes, 41 skips, zero failures and 500,372 assertions across 1,838 tests / 212 files, plus all 11 standalone VTOL reports with neutral inhibited outputs.

The native browser regression covers an authorized completed-result renewal, an ordinary refresh that cancels a pending admission before any POST, and a fresh explicit decision that emits exactly one admitted POST. The test driver now reads matching completed digest/execution from one authorized DOM frame. Application cancellation and private-view clearing remain intact; there is no automatic resubmission.

This qualifies the revised controlled regression. It does not establish the exact transport timing behind the original intermittent failure, and this issue stays open. The older failure evidence remains retained. Automatic main workflow 40018802681 is a separate observation.