[schlessera]

Closes #3488

What changed

When two concurrent resumes of one non-resident session both open a pi worker, the one that returns second still refuses with BackendBusyError. That refusal now settles only after the losing worker's teardown has finished: the worker has exited, its turn temp has been closed exactly once, and its stdio released() has been awaited exactly once. Until now the loser only got a synchronous dispose(), which requests SIGKILL and returns. The turn-temp close ran detached on exit, its refusal was dropped, and nothing waited for the stdio release. While the refusal settled, the ledger still charged both workers' reservations. Now it charges only the winner's. If the loser's cleanup is refused, the caller still gets BackendBusyError. The refusal is logged through backend.log as a warning, the reservation stays charged, and the worker's shared abort() can retry the close.

Why this shape

This follows the issue's scope and the #2863 lifecycle ruling ("Turn completion includes worker teardown"). The losing resumed acquisition decides busy or reuse, and claims a reused entry, synchronously, before any await. That way a third acquisition can never see an unclaimed idle entry while the loser waits. The pool then awaits the losing worker's shared inactive abort(), the same owner #2880's cancelAcquiredSession uses, disposes the worker and re-raises the original outcome. Cleanup refusal is reported rather than substituted, following the backend's other preserved-cleanup warnings. The pool gets the existing BackendLogFn seam as an optional third argument, and createPiBackend passes options.log. The unreachable new-session duplicate branch, public dispose(), worker protocols, the busy and result shapes, and the five-second release bound are unchanged, as the issue's out-of-scope list requires. The decision record now notes #3488 under the #2880 paragraph. The investigation report's citations were re-anchored to the moved lines, and it now says the repair landed.

Proof

Final head 2d80ed9409c5ee3d8f7ed3448cfbf6a60ed3b19f on base a9330064e56ffc82804e3025ce7c77d6127057a8 (origin/main). Linux host with bwrap, keyless, private TMPDIR.

bun install --frozen-lockfile          # no changes
NODE_OPTIONS=--max-old-space-size=8192 bun run typecheck   # exit 0
bun run build                          # exit 0
bun run lint                           # lint: all gates clean
bun scripts/proof-system.ts classify --base origin/main --head HEAD   # not a proof-system change
bun run test packages/ui-backend-pi/tests/duplicate-acquisition.test.ts packages/ui-backend-pi/tests/early-cancel-lifecycle.test.ts   # 11 pass, 0 fail
bun run check:pr --base origin/main    # exit 0, 831 pass, 0 fail

Failing first (new duplicate-acquisition.test.ts against unmodified main a272a790b; the source files this PR touches are the same on the current base):

error: PI_DUPLICATE_RESUME_LOSER_EXITED_BEFORE_REFUSAL
Expected: true
Received: false
(fail) … refuses only the loser after its confirmed teardown
error: PI_DUPLICATE_RESUME_LOSER_EXITED_BEFORE_REFUSAL
Expected: true
Received: false
(fail) … refuses only the loser after its refused teardown
 0 pass
 2 fail

The test now runs twice: once with a confirmed loser cleanup and once with a refused one. At the moment the loser's BackendBusyError settles, it asserts the loser has exited, with 1 turn-temp close, 1 released() call and 1 completed released(). With confirmed cleanup, the ledger charges only the winner's half and no warning is logged. With refused cleanup, both reservations stay charged and exactly one warning names the refusal; then a retry through session.abort() closes again (2 closes) and frees the loser's half. In both runs the winner is not signalled and is still running, it ends with success, and every reservation is back at baseline. All of the test's earlier assertions are unchanged.

Mutation receipts (on the final head; tree restored after each, git status clean):

Mutation	Result
Loser path synchronous again (disposeSession(opened.session) instead of the awaited release)	both runs fail PI_DUPLICATE_RESUME_LOSER_EXITED_BEFORE_REFUSAL (expected true, received false)
Busy re-raise dropped	fails PI_DUPLICATE_RESUME_LOSER_REFUSES_BUSY (received undefined). The non-throwing loser then prompts, and the run's teardown waits until the timeout.
Cleanup refusal not logged	refused run fails PI_DUPLICATE_RESUME_REFUSED_LOSER_CLEANUP_REPORTED (expected length 1, received 0)
Cleanup refusal replaces the busy outcome	refused run fails PI_DUPLICATE_RESUME_LOSER_REFUSES_BUSY (received the cleanup refusal)

Workspace tests that cannot run on this host. bun run test packages/ui-backend-pi gives 478 pass and 24 fail. The same 24 tests fail on unmodified main, checked by diffing the (fail) lists from a throwaway origin/main worktree. They need unprivileged user namespaces, which this host refuses (unshare: write failed /proc/self/uid_map: Operation not permitted). They are in host-relay, native-host-auth-qualification, provider-history, provider-history-apify, session-prompt, stable-roster-runtime, startup-runtime and transcript-prefix, and are left to hosted CI. That covers the provider-history guard. This change adds nothing provider-facing: it only changes when a losing worker's refusal settles.

{"version":1,"kind":"brain-check-pr-receipt","head":"2d80ed9409c5ee3d8f7ed3448cfbf6a60ed3b19f","base":"origin/main","mode":"focused","startedAt":"2026-11-03T15:17:01.811Z","finishedAt":"2026-11-03T15:18:40.963Z","checks":[{"name":"all lint and leakage gates","categories":["changeset"],"outcome":"passed","elapsedMs":8791.614308},{"name":"environment documentation","categories":["changeset"],"outcome":"passed","elapsedMs":94.48743199999808},{"name":"pending changeset package names","categories":["changeset"],"outcome":"passed","elapsedMs":1037.872212000002},{"name":"contribution changeset","categories":["changeset"],"outcome":"passed","elapsedMs":16.933732000001328},{"name":"affected fast invariants","categories":["verify","unit"],"outcome":"passed","elapsedMs":89192.416864}]}

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof. (Local done; hosted proof not yet requested.)
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved. (Nothing moved.)
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only (docs/decisions/provider-history.md): the provider-history guard passes, or nothing on a turn's path changed. (No provider-facing content changed. The guard tests need user namespaces and are left to hosted CI.)

Anything left open

• Hosted candidate proof, including the 24 namespace-dependent ui-backend-pi tests, has not been requested. This PR stays a draft.
• experiments/decision-citations.test.ts (release-time drift check from ci: check code-citation drift at release, not on every merge #3499) reports two drifts in docs/decisions/claude-code-runtime.md citing AGENTS.md:137-138. ci: check code-citation drift at release, not on every merge #3499's AGENTS.md edit caused them, not this PR, and they are left for the release check.

🤖 Generated with Claude Code

[schlessera]

Collisions at head 2d80ed9409c5ee3d8f7ed3448cfbf6a60ed3b19f (bun scripts/collisions.ts --json --pr 3501):

• textual: CONTRACT: feat: external compute through interchangeable sandbox providers (epic #3103) #3404 (session-pool.ts, governed-writable-workers.md); CONTRACT: feat(ui-server): admit generic chat files as durable server-owned originals #3342, CONTRACT: feat(ui-server): fetch allow-listed repositories for module cron jobs on the host #3393, refactor(ui-server): split makeBridge into capability factories behind one options object (#2516) #3449, CONTRACT: feat(ui-server): bind typed chats to their creating owner so the owner can delete them #3456, CONTRACT: feat(core): automate diff-assisted propagation freshness review #3458, fix(ui-sdk): keep a separate-identity payload out when its coordinator dies before release #3464 (docs/decisions/governed-writable-workers.md only).
• closure (shared affected tests or workspaces, no shared edits): CONTRACT: feat(ui-react): EVALUATION ONLY bounded recovery / DO NOT MERGE #3056, CONTRACT: chore(ui-react): EVALUATION ONLY voice-tail diagnostics — DO NOT MERGE #3059, test(voice): Gemini finality research — TEST ONLY / DO NOT MERGE #3069, fix(ui-react): preserve newer principal outcome after cancellation #3116, refactor(core): move raw SQL out of CLI commands and keep one silent-edit query #3293, chore(ci): run the complete local unit tier through the existing unit workers #3336, test(ui-react): pair the remaining Cartesian theme cells in answer and journal runtime #3345, chore(ui-sdk): drop 66 internal re-exports no other package uses #3413, fix(ui-react): a read that could not answer is not a change, so a failure is announced once #3437, fix(ui-sdk): keep relay responses open through long idle gaps #3442, CONTRACT: fix(ui-server): land epic #1645 batch 1 — provider-relay taint exemption, managed-storage turn refusal and mount-point socket walk #3443, CONTRACT: feat: brain config media and Persist here by a broader rule, with matches previewed and approval bound (#2781) #3491, fix(ui-server): inbox snapshot restore stages through no-follow descriptors (#3476) #3500.

Reporting only. None of these is a lock.