[roodboi]

Update at 3e85b9b (second next merge, at c019124): this brings in #557, #564, #562 and #563. The only conflict was at the end of tests/native-compose-adoption-routing-generation.test.ts. This PR adds live caller budget cases there, and #563 adds the HACK-1359 mutation deadline refusal; both are kept. Typecheck and Biome pass on Bun 1.4.4. The five adoption generation test files and the compose-env-at-rest tests pass (235/0). The file-owner tests need a built config compiler; once it was built with Rust 1.97.1, they passed on their own (29/0).

Update at 04abddb: merged next at 1df527b (#545, #419, #337). The one conflict was in tests/native-authored-project-start.test.ts: #419 renamed the stand-in owner cap to STAND_IN_CAP_MS, sized from the case ceiling. Both sides are kept, and the failed-case test's Bun timeout now uses the named fixture margin, which is the same 5000 ms. Typecheck and Biome pass on Bun 1.4.4.

• tests/native-compose-adoption-generation.test.ts run on its own passes: 123 pass, 0 fail.
• In one earlier 4-file run at a host load average of about 7–9, two of its cases failed. Both pass when rerun on their own. One of them refused with E_CONFIG_INVALID for a cancellation, tracked as HACK-1810 and noted on HACK-1458.
• HACK-1458's 10 loaded runs have not been done.

Current state (bd55b86, merges next at e5d907d). This head adds the local Oct 27 to 31 recovery work that was never pushed: live adoption transaction deadlines, retained routing fixture budgets, retiring proven pre-ready host processes after cancellation, a faster startup compiler stand-in, and a per-case failure cleanup for stand-in host groups.

Checked at this head: tsc passes, and 233 tests pass with 0 failures across the adoption generation and routing files, authored project start, and the fixture helper tests. These ran on a host at load 8 to 10, once, with no added load generator.

Not done: the ticket's 10 consecutive loaded runs of the affected files have not been run at this head, and the failed Oct 26 verification has not been re-run. An independent read-only review by claude-hd (the Codex route is limited until Nov 4) read the code at c520acc and did not run it. It recommended merging, with four low findings. The mux cleanup finding is fixed at bd55b86, proven by two mutations, and the delta after that review has not been reviewed. The others are in HACK-1801. It raised two decisions for the owner: pre-Ready teardown stops host processes without running the authored down hooks, and teardown runs the compiler again before checking for Removed, which can slow cancellation. The Evidence and Gaps sections below describe earlier heads.

Refs HACK-1458 (unit G106). Product fix for the four product clocks that kept HACK-1367's loaded runs from passing. Test-side budgets stay with #419 (G52/G105); this PR adds new cases at the end of the two shared test files and edits none of #419's hunks.

Root cause

1. Public adoption dispatch. tryLegacyComposeAdoptedCommand opened its adoption store without a deadline, so every store inspection phase (one probe owner) got the default 15 s aggregate clock, whatever HACK_COMPOSE_STARTUP_TIMEOUT_MS allowed. A slow engine expired it as E_NATIVE_COMPOSE_PROBE_TIMEOUT; translate() turned that into E_LEGACY_ADOPTION_STATE, and the command reported E_CONFIG_INVALID ("state is invalid, unsafe or changed"). The command's own deadline only started after loadActive, so inspection before it was never bound by the caller.

2. Authored compiler calls. acquireNativeExecutionInputs never passed a compiler timeout, so each compiler invocation (and the later assertFresh/value checks) kept the transport's fixed 10 s default, even with minutes of startup budget left.

3. Source5 cancellation after readiness hang. Reproduced: after onReady aborts, the cancel's down.before re-acquires inputs with the hard signal. That acquisition also kept the fixed 10 s compiler clock. When one compiler call took longer, down.before failed at acquire (no hook ran), onStopFailure fired, and the start retained the live owner and host processes, waiting for a hard cancel that the case never sends. With a scratch copy whose compiler sleeps 11 s after readiness, the case hung for its whole 420 s budget, with hook events down.before:acquire then down.before:stop-operation and no down hook, the same symptoms as the loaded report.

4. Failed authored cases leave host process groups running. This is a product path, two of them:

   • (i) Startup inputs check freshness under the startup signal. Once a cancel or the startup deadline (its timer aborts the same signal) ends startup after the host processes started and before reservation, stopUnstartedHostProcesses could never pass hostProcesses.stop()'s freshness check (it re-reads inputs with the aborted signal), so the groups stayed up. A loaded local run of a new case showed it directly: startup expired after host-process-ready.json was written, the start failed, and the mux window group was still alive afterwards.
   • (ii) createNativeAuthoredHostProcesses().start() had no failure path. A failure after the launch intent (cancel, deadline or refused check during the launch) left the mux session running behind an intent that recovery never converts into authority.

   Failures after reservation still retain host processes on purpose, with complete owner/ready/state records that hack down recovery stops (retireNativeAuthoredHostProcesses). Ending those in a test is test cleanup (test: derive load-sensitive harness budgets from named constants #419).

Fix

• Adoption (native-compose-adoption-generation.ts, native-compose-adoption-command.ts):
  • The store takes an optional caller deadline. With one, each inspection phase gets legacyAdoptionProbePhaseMs: the remaining time, capped at LEGACY_ADOPTION_PROBE_PHASE_MAX_MS (60 s). An expired deadline refuses as E_LEGACY_ADOPTION_DEADLINE, and an unclassified failure after a probe timeout or past the deadline becomes E_LEGACY_ADOPTION_DEADLINE, not E_LEGACY_ADOPTION_STATE. A store without a deadline is unchanged.
  • The command starts one deadline (HACK_COMPOSE_STARTUP_TIMEOUT_MS) before it opens the store and uses it for inspection, the retained operation, the plain container runner and ps inspection. E_LEGACY_ADOPTION_DEADLINE maps to E_STARTUP_TIMEOUT. The message stays the store's fixed text, so the closed legacy-deadline diagnostic token is unchanged.
• Compiler (native-config-compiler.ts, native-project-validation.ts, native-execution-inputs.ts): named NATIVE_CONFIG_COMPILER_MIN_TIMEOUT_MS (1) and NATIVE_CONFIG_COMPILER_MAX_TIMEOUT_MS (60 000), nativeConfigCompilerTimeoutWithin(remainingMs), and an optional compilerTimeoutMs getter that every compiler invocation of a selection reads, including later freshness checks.
• Authored start (native-authored-project-start.ts):
  • Startup compiler calls use the remaining startup deadline (floor 1 ms, ceiling 60 s). Calls outside startup (down-hook acquisition, checks after ready) have no startup deadline and take the 60 s ceiling, so a slow host no longer fails a graceful stop.
  • Before stopping unstarted host processes, teardown re-acquires inputs under the hard signal and refuses a changed selection, like the down hooks do.
• Host processes (native-authored-host-processes.ts): a start that fails after its launch intent calls the controller's abort(), which ends the session through the ownership token it created. Owner bookkeeping is cleared only when every launched group was recorded and is proven absent within 5 s. Otherwise it stays retained.
• Docs: docs/reference/native-compose-adoption.md, docs/reference/native-authored-commands.md.

Tests

New cases, each proven by mutation (product change reverted in a scratch copy):

Case	File	Clock	Mutation result
HACK-1458: public dispatch inspection outlives the former fixed 15 s phase clock while the caller deadline remains	adoption generation	injected Date.now jump of 16 s after the first engine probe, 120 s deadline	base: E_CONFIG_INVALID "state is invalid, unsafe or changed"
HACK-1458: an expired public dispatch deadline ends inspection as a startup timeout, not invalid config	adoption generation	injected 6 s jump, 5 s deadline	base: returns 0 (inspection ignored the expired deadline and started the container)
HACK-1458: a startup compiler call may outlast the compiler's 10 s default while the startup deadline remains	authored start	real: one compile sleeps 10.5 s	wiring reverted: stage inputs (E_COMPILER_TIMEOUT) after 11.4 s
HACK-1458: Source5 cancellation after readiness settles when its down acquisition compiler is slow	authored start	real: first compiler call after readiness sleeps 10.5 s	pending (running)
HACK-1458: cancellation after host processes start and before reservation stops them	authored start	real: second frontend-plan held until cancelled	teardown refresh removed: process-order is started only and the host group stays alive
HACK-1458: cancellation during the host process launch ends the launched group	authored start	real: first list-panes delayed 1 s	abandonLaunch made a no-op: the owned mux session (mux.json) stays

Evidence

In progress: 10-consecutive loaded runs of both whole files are running locally (M5, Bun 1.4.2, private HOME/HACK_HOME/DOCKER_CONFIG, keychain fallback disabled, unreachable DOCKER_HOST, added CPU load stopped in a trap), on this branch plus #419's test-side budgets. Hosted CI at the exact head is the full-suite evidence. This section will be updated with results.

Gates

• gitleaks 8.30.1 dir over a git log -p origin/next..HEAD export: no leaks.
• Root bun run check (includes privacy:check): passed. bun run --cwd packages/cli typecheck: 0 errors. Biome on the changed files: no new warnings (the 8 existing complexity warnings in native-compose-adoption-generation.ts remain).
• The CLI surface and consumer agent guidance did not change, so docs:cli-reference and plugin regeneration do not apply.
• origin/next merged at 246f1b4.

Gaps

To be completed with the evidence.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[linear-code]

HACK-1458