[adrianwebb]

Outcome

Confirm actual process disappearance after the final procfs status lookup so an exited ordinary build child does not become a false unreadable-VM inventory failure. Live unreadable identities, authorization denials, namespace mismatches and changing VM inventories remain fail-closed.

Work authority

• Work item / Issue: Current deployment backlog: retained requirements after issue consolidation #834; current bounded plan and full failure evidence Complete accounting transition observations for strict Agent acceptance api#553
• Proposal / decision: integration recovery supporting accepted API Decision2839f4c7-16bb-4aa4-b6c2-20280108537c; not that proposal's simulated implementation output.
• Assignment / checkpoint: Deployment885 merged-head recheck39387419190 failed its native present-inventory completeness assertion.
• Actor: Codex integrator
• Human authority: adrianwebb, continuing repair/verification/adoption authorization
• Agent / capacity provider: integrator boundary repair; governed independent review requested separately, no fabricated result.
• Exact base ref: staging 5d0b509
• Exact head ref: codex/vm-inventory-exit-recovery885 ef8b351

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Reproduce narrow boundary first; add final independent proc-directory absence check; retain strict negatives; strengthen existing native public CLI/supervisor inspection and scene bindings; run fresh complete prerequisites/scenes before merge/publication. Existing Actions already runs original native VM custody early; reuse that step.

Changes and commits

• d78fedb RED: two focused ENOENT/ESRCH regressions failed at complete=false, ten prior checks passed.
• ef8b351 adds a final lstat absence confirmation only after executable ENOENT/ESRCH and both existing status observations. No broad error suppression or observation rewriting.
• Existing native pinned-QEMU public CLI→manager→supervisor case now keeps both owned/unrelated VMs live while ordinary build children exit; every observed complete VM identity must remain equal. New unit cases are bound into the existing component scene. No new runner, storage, schema or deadline.

Verification

CI prerequisite correction: initial run39390967852 stopped before the changed native cases: held Reviewer108f installed-custody case spent22.93s in INSTALL, exhausted its original25s work budget during PLAN, and reported subprocess residue/closure unproven. Full suites/scenes did not run. Commitef8b3514 adopts checked protected Reviewer001329f305c79beb6c1c8dfb9b85a36c6360e3eb (same tree as checked d42b257; protected38999382684 passed). Its existing owning fix e60ad25 keeps unused UI presentation dependencies out of the production runtime closure; installed-package/cache regression coverage is retained and strengthened. No copied Reviewer code or raised deadlines. Fresh complete run39391832003 is required; prior failed observations remain.

Local:14/14 focused assertions (sandbox-host-inspection and sandbox-vm-custody), strict npm run build and npm run check:source-shape pass. New native integration and complete owner/verifier prerequisites/registered scene evidence remain pending Actions. Local installed runtime differs from candidate bytes, so no local same-candidate native replay is claimed.

Historical protected39387419190 failure is retained: full prerequisites passed, native execution VM custody failed at warm-sandbox-pool.test.ts137:336, later scene steps blocked. Its sanitized receipt does not retain the exact inventory reason. The reproduced race is a real boundary defect; attribution of that historical scene failure remains unproven until fresh native evidence. No blind retry of the failed campaign and no pass credited from the earlier PR receipt.

Risk and rollback

Low scope, strict negative behavior retained. A process directory still present after failed executable/status reads remains an incomplete inventory; permission errors propagate. Existing original process-group and test deadlines are unchanged. Revert8ef0838d via PR if incorrect; do not publish/adopt a failing candidate, alter issued work or remove retained work disks.

Completion summary

Regression and minimum repair committed; full CI/native verification and real readiness acting continuation remain pending. No managed-workday or simulated-release completion claimed.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.