Record the #780 and #781 flake fixes in BUILD-LOG and SESSIONS (Vikunja #780, #781)

BUILD-LOG.md

@@ -5879,3 +5879,43 @@ Q284 / #470 source-only security fix 2026-10-29T03:33:00.640624+00:00: pin worke
 2026-11-02 | Lead sub-agent (Claude Opus 5.5, under T3 c5c1e8ba) | Row 227 R2 (#1728): test-case2.sh now runs standalone. Removed every tie to the R1 slot controller (ROW227_CONTROL_ROOT, nonce and permits, priority.mjs, owned bwrap wrapper, controller cleanup marker); leak check reads fixture-credentials.mjs; driver under env -i with TMPDIR in the sandbox; cleanup bounded to 3 s then SIGKILL. R1 red 0.294 s confirmed; all 17 steps passed with no step fix; two green runs 4.96 s and 5.74 s; mutants m1-m5 red at S2b, S3c, S4, S5b, S6, m6 (requireCitation) survived and is a follow-up; tip check on fddae79ef green 5.05 s, no conflicts. Code 04e1ce24c; record in agents/steelbeak/work/queue-227/BUILD.md "R2".
 
 2026-11-02 | Lead sub-agent (Claude Opus 5.5, under T3 c5c1e8ba) | Row 227 R3 (#1728): test-case2.sh sandbox guard. A failed mktemp, mkdir or output redirect now exits 2 before any path, trap or process; the root must be a new empty directory of this user, kept as its physical path with its device:inode, and sweep_sandbox and remove_sandbox in scripts/case2/sandbox.sh refuse on their own unless it still matches. The kill sweep compares cwd targets as strings (root or root plus "/"), so *, ? and [ are literal, with one find over 1031 links in 56 ms. A TMPDIR whose tools.sock path would pass 107 bytes is refused at entry (TMPDIR plus 64, so at most 43 bytes). R2 red shown on dummy links only; failure controls green inside a fresh PID namespace; bracket control killed 3 sandbox sentinels and spared 4 lookalikes; plain runs 5.64 s and 5.20 s; TERM and INT closed in 130 to 1247 ms, a held driver in 3.07 to 3.10 s; tip check on 5df0e9d6f green 5.18 s, no conflicts. Code abc66a598; record in agents/steelbeak/work/queue-227/BUILD.md "R3: the sandbox guard".
+
+## 2026-11-02, Vikunja #780 and #781: two gate flakes made deterministic
+
+Before: project read.test.mjs "path history is bounded at 100" failed with a raw ENOENT on .git/objects/pack/tmp_idx_*,
+and webui preview.test.mjs:209 got 200 where it expects 502. Code 7e0d3c93f (#780), 1009bbfaf (#781), not pushed.
+
+Causes, each confirmed
+- #780: the fixture git helpers ran a bare git commit. Git 2.55 then starts a detached "git maintenance run --auto"
+  that repacks the fixture repository and creates and removes tmp_idx_* and pack temp files while inspectGit walks
+  .git (trace2 capture shows the spawn). inspectGit lists a name, the file is gone at lstat, raw ENOENT escapes.
+  SAFE already carried maintenance.auto=false and gc.auto=0 for product git calls, so only the test helpers and
+  inspectGit's own walk were exposed.
+- #781: leasePort ignored {closed:true}. Without a lane it probed an ephemeral port and closed it, so nothing held it
+  and a parallel test file could bind it and answer. With a lane the per-port lock was held but no socket was.
+
+Design
+- #780: the project, bus spec-fixtures and webui tester-fixture git helpers pass -c maintenance.auto=false
+  -c gc.auto=0. inspectGit maps ENOENT from a listed entry's lstat or a directory readdir to ProjectError
+  project-repository "git metadata changed during inspection": it refuses, never skips or retries, because the
+  metadata did not hold still. A missing .git keeps its own error. The pin test replaces fs.readdirSync
+  (syncBuiltinESMExports) and removes the named entry inside the call, file and directory. No production hook.
+- #781: leaseClosedPort holds a bound, non-listening socket in a perl child until the test's after hook. Connects get
+  ECONNREFUSED, other binds get EADDRINUSE, the kernel's bind(0) skips it (checked over 200 allocations). Lane mode keeps
+  its band and per-port flock and releases the socket before the lock. The child exits on stdin EOF, so an abrupt death
+  releases it. leasePort now refuses a closed option, so a stale call cannot get the unheld port again.
+
+Choices and tradeoffs
+- Rejected a listener that resets on accept: the client sees ECONNRESET or UND_ERR_SOCKET depending on timing, and
+  service.test.mjs:473 asserts "unreachable (ECONNREFUSED)". The bound socket keeps every assertion unchanged.
+- preview, webui serve and service (4 sites) take leaseClosedPort(t), which needs perl and fails closed naming it without.
+  stack-release freePort, control-board getFreePort and tester-cli freePort listen on the port themselves, keep leasePort
+  and drop the ignored option. Those keep a probe-then-bind window; closing it needs the caller to bind, out of scope.
+- The first mutant run hung: my new tests did not release holders on a failed assertion. They now drain in t.after.
+
+After (pass/fail/skip): project 42/0/0 1.2 s; webui 496/0/0 69.5 s; control-board 130/0/0 0.8 s; stack-release.test
+225/0/0 628 s; gate-lane-fixtures 13/0/0; gate-lane 13/0/0; bus and harness spec-fixtures importers 100/0/0 15 s; library
+sync, mirror, case2-install 69/0/0; read.test.mjs 10 of 10 green. No hash or size pins on any changed file. Mutants, each
+restored by git checkout with a clean status: closed lease probes and closes again, and holder released immediately, each
+killed by three gate-lane-fixtures tests; leasePort accepts closed again, killed by its refusal test; inspectGit mapping
+removed, killed by the read.test.mjs vanished-entry test.

docs/SESSIONS.md

@@ -1957,3 +1957,5 @@ are never rewritten or removed; corrections are new entries.
 2026-11-02 | Lead sub-agent (Claude Opus 5.5, under T3 c5c1e8ba) | Row 227 R3 (#1728): sandbox guard, literal cwd sweep and TMPDIR limit for test-case2.sh | Code abc66a598 on t3/row227-r3-fix: P1 to P3 fixed, 40 no-signal checks pass, namespace failure controls exit 2 with nothing started, suite green twice (5.64 s, 5.20 s), tip check green. Not pushed; record in queue-227 BUILD.md "R3: the sandbox guard".
 
 2026-11-02 | Lead (Claude Opus 5.5, T3 c5c1e8ba) | PR 1838 (#725) landing: disk-space governance PRD as version 1.19 | Merge 31222d81d of the Haiku rebase 3d00efe39 onto ea02c061e; GPT review APPROVE, P3s fixed here: approved wording in the tasks requirements test header, location correction in REBASE-1.19.md. Full gate before push.
+
+2026-11-02 | Lead sub-agent (Claude Sonnet 5.5, under T3 c5c1e8ba) | Vikunja #780 and #781: project inspectGit race with git maintenance, closed fixture ports | Code 7e0d3c93f (#780) and 1009bbfaf (#781) on t3/fix-flakes-780-781: both flakes made deterministic, pin tests added, three mutants plus one extra each killed and restored, project, webui, control-board, stack-release and lane fixture suites green, read.test.mjs 10 of 10. Not pushed; record in BUILD-LOG.md.