Fixed on branch test-suite-debt (8fef823e), CI green, not merged.
Cause. holdOpen started sleep 60 and scanned /proc as soon as Start returned, while the child was still loading. A probe saw four different files in turn on fd 4 (ld.so.cache, libc.so.6, locale-archive, locale.alias). FDHolders stats through the descriptor and, on ENOENT, lstats the entry; a descriptor closed and reopened between the two gives ErrIncomplete. A scratch test with a child churning descriptors got ErrIncomplete in 19 of 2000 scans. The original CI message was not recorded, so this is the mechanism, not a replay of that run.
Fix. The holder is sh -c 'echo ready && read wait' and the test waits for ready before scanning. No sleep, no retry. The mount-namespace test had the same race and uses the same handshake.
Left alone on purpose: FDHolders still returns ErrIncomplete for a live process that reopens a descriptor number mid-scan. That is the fail-closed rule from 9cf9f18f.