Observed failure
The first local full suite on commit 8157713fec136f7d0ca463ba0ba56081268d6e39 completed with 1,145 passes, 24 skips and two failures. One failed test was accepted purge removes more than one hundred review leaves and audits in bounded native batches in tests/unit/public-safety-purge.test.ts.
The real SQLite child exited 1 after reporting PublicSafetyAccessError 404, Incident is unavailable, at access/policy.ts:54 through access/mutations.ts:42. The parent test took 62,330.52 ms. The ordinary access check rejects a missing incident, invalid retention timestamp or elapsed retention. This caller first checks a locked row exists. The original failure did not retain the actual row retention, guard clock, fixture phase or committed review count, so the exact rejecting condition and cause remain unknown. Total test duration does not establish expiry.
The fixture seeds a 60,000 ms retention epoch before creating an observation, 137 linked reviews and a managed dataset, then deliberately waits for expiry before testing accepted purge. Preserve these semantics and the fail-closed access policy while diagnosing. The original parent test and relevant application/fixture sources match published f860f360289c41f1cb49977a64cc496160006202 byte-for-byte.
The same candidate passed GitHub Actions run 39503133989, including its full Linux suite. This does not explain or erase the local failure. The unchanged narrow parent-test run subsequently passed once (72,805.88 ms, child exit 0). This is a non-reproduction, not a fix or an explanation of the failed full run. Its original assertions and real child/SQLite behavior were retained.
Acceptance criteria
- Reproduce the actual failure through a bounded, unattended feedback loop at the real public parent/child seam.
- Retain bounded synthetic phase, committed-review count and exact failing retention/clock observations sufficient to distinguish the rejecting branch without logging incident content or credentials.
- Apply a minimal correction only after establishing its cause, preserving production access/retention authority and the 137-review batching assertions.
- Qualify the original scenario and relevant regressions, retaining the first failed receipt and distinguishing local, CI and physical evidence.
The separate camera IPC failure is tracked in #35. No relationship between the failures or causality from the counted encoder changes is established.
Bounded diagnostic checkpoint
The unchanged isolated parent test passed once (72,805.88 ms). A temporary two-file diagnostic then preserved the original access guard's two Date.parse calls, final Date.now call, short-circuit ordering, comparison and 404. It added bounded failure-only records for the actual evaluated retention operands and fixture phase/review index, with no incident content or credentials. The original 137 reviews, 60,000 ms fixture lifetime, timers and batching assertions stayed unchanged.
The first instrumented run passed (64,084.00 ms). A separately bounded campaign of at most three attempts, stopping on any failure, completed all three successfully in about 65 seconds each. No rejecting-guard observation was captured. All original failures, source snapshots and complete attempt results are retained. Both temporary source files were then restored byte-for-byte to commit 8157713. No probes will be published.
The cause remains unknown and no retention, authority, timeout or fixture correction is claimed. These passes do not explain the original failed full run. A new full run on 56363b5 includes a separately reviewed IPC tests-only correction; the purge source/test/fixture remain unchanged. Even a passing result will not establish a causal fix for this issue.
Integrated regression observation, 2026-10-20
The first full local run on 56363b5 finished with exit 0: 1,150 passed, 24 skipped, zero failed and 413,558 assertions across 1,174 tests in 165 files. The unchanged 137-review case passed in 65,477.32 ms. The complete 313,752-byte log is retained with SHA256 005815df8f4f779c62bdb8c4fccf50da4fdb31640b5b650f5187ad0a9fb403df.
This candidate contains a separately reviewed IPC tests-only correction and the counted-gimbal primitive. The purge implementation, fixture, retention lifetime, authority rules and test remain unchanged. No rejecting-guard values from the original failed full run have been recovered, and no causal purge fix is claimed. The original failed run and all bounded diagnostic attempts remain preserved. This issue stays open. Exact-commit CI is still running at this checkpoint; the candidate has not been published to main.
Recurrence during host-slot qualification, 2026-10-22
The original full local Buddy run on published HEAD 222ffb83c8a3ae934eea339d7451b37b69bbc1b7 plus the separate host-slot prototype reproduced the 137-review case failure. Its child returned 1 with PublicSafetyAccessError 404, Incident is unavailable, at access/policy.ts:54 through access/mutations.ts:42; the parent failed at public-safety-purge.test.ts:73 after 64,622.80 ms. This is the same observed guard and scenario, not proof of the same underlying cause. The actual failing retention/clock operands and fixture phase were not retained by the unchanged original test.
The original suite is still live, now with this failure and a separate inspection timeout tracked in #52. Do not treat partial counts as the terminal result. The retained recurrence prefix has 362546 bytes and SHA-256 bc8ea1d731fc43e680c16b45b381a6f234e77f99e499cfea40305f766ba9e010. Relevant policy, mutation, parent and fixture snapshots match published main. Source identity and total duration do not establish expiry or causality. No lifetime, timeout, policy, batching assertion or production source has been changed. A bounded rejection/phase diagnostic will follow the original terminal result; no new diagnostic retry has occurred at this checkpoint.
Original terminal result
The original full local Buddy run completed with exit 1: 1,502 passed, 25 skipped and three failed, 489,058 assertions, 1,530 tests across 187 files, 3,683.77 seconds. The failures are the inspection timeout (#52), 137-review 404 (#36), and purge-seal child exit 137 (#53). The host-slot/runtime cases passed. These failures remain separate observations with unproven causes.
The retained full terminal log has 427362 bytes and SHA-256 6d884c7966f217c823a20cc439b8636035c99b160b648ea6e92ced5e5e29ab7c. No original deadline, assertion or production policy was weakened, and this result is not a passing full suite.
Reproduced fixture precondition failure
A single bounded failure-only probe of the original public parent/child case reproduced exit 1. It retained the original 137 appends, 60,000 ms lifetime, timers, assertions, two Date.parse calls, final Date.now call and short-circuit ordering. The actual guard saw an existing incident, finite first and second retention parses of 1792642424244, then clock 1792642424247: three milliseconds past expiry. Fixture phase was review, with 85 committed reviews and zero-based review index 85. This establishes retention expiry during setup for this concrete reproduction. It does not retroactively supply the missing operands in the first failed full runs or identify a scheduling component.
The retained probe log has 42886 bytes, SHA-256 06a9fa9be478152ade17ab38d60d2efc44386a3d16857365f81dd7da4e7d0f7e. Both temporarily instrumented files were restored byte-for-byte to committed source. No probe will be published.
The test assumed all setup operations would finish inside the retention window. A tests-only correction is in progress: prepare with an explicitly controlled clock, retain the 60,000 ms declaration, restore the real clock before the existing expiry wait and purge acceptance, and prove an extra review at exact expiry is refused without review/audit writes. All 137 actual native appends and the100/37row batching assertions remain. Production access/retention code and the original process guards remain unchanged. The initial corrected run passes; a strengthened run now forces real expiry before the last controlled setup review. It remains unqualified and uncommitted pending that result and checks.
Qualified resolution
412dd1623856f42dd5e734906633af5d960e8233 is now on origin/main by normal fast-forward as Chris without coauthors. CI 39722509606 passed all five jobs. Both reviewed test-file pins match committed blobs; the terminal log was retained once (3009946 bytes, SHA-256 53e3ebdbce205357fa004e969a27f140cc7f5c016db7d9ca5ca48cbbb55664ce). Production access, retention, auth and database code are unchanged.
The concrete reproduction established expiry at review 86 after 85 committed rows. The corrected test retains the 60,000 ms declaration and all 137 real native appends/FK/audit/100-and-37 batching assertions. It deliberately crosses actual expiry before its last controlled setup review, rejects an extra review at exact logical expiry without review/audit writes, restores the real clock, and requires genuinely due purge acceptance under the original 165/180-second guards. The strengthened case passes on Bun 1.4.3 and minimum Bun 1.4.2, plus exact-head full CI.
This closes the reproduced unsafe fixture-preparation assumption. The first historical failed runs still lack their original clock operands and the scheduling component is not reconstructed. No production-policy fix, arbitrary-host timing guarantee or physical erasure qualification is claimed. #52 and #53 remain separate open investigations.