18 Commits

Include renames

Author	SHA1	Message	Date
3 people	d8a9673fc4	fix(process): name the Swift compile deadline (#6071) ... Name REA_SWIFTC_COMPILE_TIMEOUT_MS, its effective milliseconds, the 1..2147483647 range, and the omitted 120000 ms default when a Darwin ownership-helper compile times out. A change applies after REA restarts, on the next ownership-helper compile. Producer SIGXCPU and SIGXFSZ recovery says REA retains the tighter inherited limit. Agent-visible fixed caps in this theme say this release has no runtime override. Numbers are unchanged. Refs #5910 Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com>	2026-10-21 23:46:29 +08:00
morluto	08f4ba99ce	test(process): share lineage fixtures to restore the duplication gate ... Extract repeated process rows, environment transitions and exact lineage expectations while retaining all identity, replacement-read and cancellation cases. Clean main exceeded the configured 3.5% duplication limit at 3.521867%; this refactor passes at 3.499188% without changing the limit. Validation: 72 focused process-ownership tests and the full check:ci gate passed. Independent source review found no assertion or coverage loss. No runtime behavior changes.	2026-10-21 11:56:36 +08:00
3 people	df8b4d8a5a	fix(process): token-check identityless exit-refresh replacements (#5675) ... * fix(process): token-check identityless exit-refresh replacements A launcher-exit refresh could drop a reparented grandchild that was absent from the prior snapshot and report cleanup complete, or publish a verified empty lineage, without reading its run token. Fixes #5206 Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): re-read identityless refresh rows when relations change Lineage refresh classified every pre-existing process as a newcomer, and it skipped a row after caching its first parent and group. Seed the exclusion set from the initial snapshot and read a row again when that relation changes. Co-authored-by: morluto <morluto@users.noreply.github.com> * style: format files oxfmt rejects on main Repo-wide format:check fails on these two files at current main. Align them so the process-ownership fix can pass the required static check. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): keep owned groups found while confirming exit An unreadable exit-refresh row used to hide the confirmation table, and revalidation dropped groups discovered after the plan was built. Both now stay in the same cleanup, and confirmation reads are bounded. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): reclassify lineage rows when tree membership changes Initial outsiders and cached refresh rows are read again when a parent, group, or ancestor move changes launcher-tree membership. Unchanged initial rows stay unread. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): re-read cached identityless lineage tokens Parent and group do not identify a process generation. A row whose token was read is read again on the next refresh, so a reused PID cannot keep a verified descendant. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): revalidate an owned group that reappears A group discovered after it was already processed is queued once more. Another appearance stays unresolved instead of reporting cleanup complete. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): recheck a helper that changes groups during confirmation The confirmation table can move a token-matched member into a new group. That row is read again, and cleanup signals the group it belongs to now. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): publish one lineage row when a descendant returns A refreshed descendant replaces the initial row for the same PID, including when its group moves away and then returns to the original relation. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): re-read foreign PIDs on the exit confirmation table A readable foreign token does not identify a process that later reuses that PID. The confirmation table reads those newcomers again. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): recheck a pre-exit PID whose relation changes An unchanged pre-existing row stays unread. A prior PID whose parent or group changed is token-checked, so a reused owned process is not skipped. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): recheck an initial descendant after its token matches A successful read in the first lineage pass marks that PID token-checked. A later refresh reads it again, so a reused PID cannot stay verified. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): recheck the launcher on each lineage refresh A later refresh reads the launcher PID again. A missing or unowned launcher is unavailable instead of rooting a verified lineage. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): publish lineage from the latest refresh table A descendant missing from the latest refresh is omitted. A refreshed launcher whose group or command no longer matches stays unavailable. Co-authored-by: morluto <morluto@users.noreply.github.com> * test(process): cover a refreshed launcher parent mismatch A same-token launcher whose parent no longer matches the committed expected parent is unavailable, same as a group or command change. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(process): recheck a token-read helper that returns to its group A confirmation table dropped a previously matched PID once its parent and group matched the pre-exit row, so cleanup could signal only the group it had joined and report success while that helper survived. Co-authored-by: morluto <morluto@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com>	2026-10-21 11:43:17 +08:00
morluto	49e67aa1d9	fix(process): retain native ownership evidence through cleanup ... Keep a run-scoped evidence owner from acquisition through settlement and cleanup retry. Bind token observations to native generations and retain related generations and unresolved identity lookups across table omissions, reparenting and process-group changes without treating PID hints as authority. Use native effective UID facts for withholding decisions, corroborate Linux procfs absence, and share the Linux stat parser with sampling and debugger identity checks. Signal only after current token and group revalidation. Complete swept cleanup across all groups with one bounded final family check; retain unresolved owners and successful-peer completion across retries. Validation: npm run check, docs:check and test discovery passed. Focused ownership/consumer coverage totals 513 passed and 1 skipped across 35 files, including the corrected Electron cancellation test rerun independently. Darwin helper compilation, real owned Node child cleanup, CLI/MCP capture and retained cleanup retries ran. Real Electron applications, native Linux races/PID reuse and Windows cleanup were not qualified. The original Linux reports remain open for that work. Fixes #5238 Refs #4322, #5206	2026-10-19 20:04:00 +08:00
morluto	599a8ee11d	fix(process): preserve cleanup ownership and normalize captures once ... Retain unresolved process identity and launch evidence through retryable cleanup. Share capture path normalization and preserve failed filesystem observations. Bound child output and drain Windows pipes without one-chunk throttling. Reviewed fixes include #1628, #2632, #2644, #2784, #2928, #2931, #2965, #2992, and #3011. Validation: 92 focused source tests passed; four platform-specific skips. Real Windows and Hopper lifecycle coverage was not rerun.	2026-10-14 08:19:07 +08:00
3 people	38539a2f4a	fix(process): retain owned command cleanup diagnostics (#1907) ... Preserve per-member verification failures and sweep uncertainty across supervisor stop and owned-command failures. Report the observed token mismatch with its PID coordinates instead of implying PID reuse. Keep unresolved ownership unsignaled and retain the supervisor for a later verified stop. Exercise cancellation, timeout and cleanup revalidation with source-owned process fixtures and cooperative settlement. Closes #1856 Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>	2026-10-12 01:00:08 +08:00
morlutoandYou Wish	80896a1d64	fix(process): settle launcher exit without dropping descendant lineage ... Refresh a mismatched launcher snapshot only when a new live process table proves its PID absent. Preserve uncertainty for detached descendants and continue checking ownership of surviving group members before signaling. Index retained lineage membership instead of rescanning it for each refreshed process. Adapted from #1357. Validation: 71 source tests passed, one Linux-only identity case skipped; 32 real process-boundary tests passed on macOS. Co-authored-by: You Wish <29498139+Y0UW1SH@users.noreply.github.com>	2026-10-11 11:06:10 +08:00
morluto	e6d0b3993d	perf(process): batch liveness rechecks within ownership phases ... Recheck unreadable token and identity observations against one fresh live process snapshot per phase. Preserve token mismatches, fail closed on inspection errors, and retain liveness failure diagnostics. Validated with focused process ownership, native capture, CLI and MCP boundaries. An eight-member injected-unreadable workload using native ps reduced snapshots from nine to two with equivalent failures; real permission-denied provider behavior was not exercised.	2026-10-11 02:31:07 +08:00
morluto	92a901e0db	perf(process): share settlement probes across captured groups	2026-10-11 02:21:50 +08:00
morluto	b22d817073	perf(process): batch ownership tokens during rooted cleanup ... Use the host bulk token reader for each cleanup validation while preserving identity checks before and after token reads. Fall back for unsupported readers or omitted rows, retain explicit unavailable observations, and preserve batch and individual failures. Source ownership regressions and real owned-process boundary tests pass; a warm Darwin validation probe reduced median time from 90 ms to 52 ms.	2026-10-11 01:59:30 +08:00
morluto	2a7746998d	fix(process)!: require current captures and preserve cleanup failures ... Remove v3 capture conversion and require explicit executable identity and event journals. Preserve cancellation, execution diagnostics, snapshots, and cleanup outcomes from preparation through CLI delivery.	2026-10-09 20:12:07 +08:00
Ysopwnable	f6fe575094	fix(process): await cleanup on CLI and MCP cancellation ... Propagate CLI interrupts to capture and interrupt post-exit settlement without cancelling owned-resource cleanup or discarding prior observations. Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)	2026-10-09 11:26:41 +00:00
morluto	5945915f91	test: prune redundant cases and promote configuration lifecycle coverage	2026-10-09 02:58:03 +08:00
morluto	3c84080aab	refactor(app): split Setup and ProcessOwnership modules (#628) ... * refactor(domain): consolidate canonical ordering and digest helpers (#624) * refactor(domain): consolidate canonical ordering and digest helpers Single owner for code-point ordering (domain/canonicalOrdering.ts) and canonical JSON digests (domain/comparisonSemantics.ts). Delete all local compareCodePoints/compareText/digestCanonical duplicates and migrate every importer. No re-export shims. * fix(ci): allow slower real browser startup * chore(config): remove dead eslint, dedupe scripts, cacheable turbo tasks Delete eslint.config.js (oxlint is the linter), drop lint:dead alias, pin smol-toml, fold jscpd/scan:todos into check:pr, make test:run cacheable, align oxlint ignores. * fix(config): hash all test inputs for cached runs * docs: fix architecture diagram and pretty-print tool catalog Drop dangling REPLAY edges, add dotnet/reference/error/evaluation nodes. Emit 2-space JSON from the catalog generator and regenerate. * test: extract shared fixtures, drop knip carve-outs Dedupe android/apple session tests, bundler adapter headers, and reconstruction helpers into tests/support fixtures. Delete unused type aliases and the knip ignoreIssues block. Lower jscpd threshold 2.7 to 2.5. * refactor(app): split Setup and ProcessOwnership modules Extract SetupTypes/SetupHost from Setup.ts and move observation helpers into ProcessOwnershipObservation/ProcessTree. Migrate all importers including CLI commands. No re-export shims.	2026-10-06 05:00:32 +08:00
morluto	9c25dc4ed2	fix!: repair boundary contracts across CLI and MCP (#597) ... * fix(comparisons)!: preserve unknowns across partial observations Share absence and digest semantics, keep unobserved managed bodies unknown, and match unique managed type/name/signatures before structural fallback. BREAKING CHANGE: Managed comparison metadata adds exact-signature matching and its count, and name_matching now reports exact-signature-fallback. * fix(javascript): preserve projected result binding semantics Share syntax-aware property reads and assigned-result resolution. Retain destructuring paths and downgrade downstream whole-result relationships instead of resolving nested or wrapped calls as aliases. * fix(native)!: admit complete parser values and preserve typed failures Decode Mach headers by named columns, validate complete slice keys and lipo alignment, and preserve codesign runtime flags and tagged parser errors. Rename the Ghidra test dossier fixture and connect fake-backed suites to real verification lanes. BREAKING CHANGE: Native load-command results no longer contain the unused, always-null file_offset field. * fix(process): preserve host identity and actionable boundary failures Thread selected platform and environment through process and Doctor seams, stamp observed producer identity in Evidence, and retain PTY, filesystem, lease and lazy-provider failure causes. Drain cancelled lazy loads and omit exited descendants from verified lineage. * fix(browser): preserve cleanup and document-transition evidence Make V8 and Playwright teardown cancellation-aware, expose primary failures alongside incomplete cleanup, share frame-tree and navigation rules, and clear stale WebMCP registrations without pruning unrelated child frames. * fix(adapters): align managed targets and typed CLI outcomes Inspect managed PE/CLI targets independently of native provider selection, reuse successful managed selections, and keep evidence bound to the actual inspected target. Classify canonical CLI error envelopes and exhaustive setup/update/uninstall outcomes, audit registered CLI coverage, and assert platform-specific runtime results. * docs: refresh boundary contracts and shipped roadmap behavior	2026-10-06 00:50:38 +08:00
morluto	4fbc501121	feat(native): add inspection primitives, dispatch traces and approved UI observation (#500) ... * fix(hopper): normalize string-backed addresses and update verification * feat(native): add inspection primitives, dispatch traces and approved UI observation * test: prioritize real artifact E2E and captured golden regressions * fix(process): queue observed output before reactive rendering actions * test: prune redundant cases and strengthen boundary assertions * fix(cli): route native value tracing through shared workflows * test: replace synthetic success with real workflows and captured data * fix(catalog): separate portable metadata from native host availability	2026-10-04 16:02:36 +08:00
morluto	7ee3f236a9	test: replace implementation lock-in with behavioural assertions (#498) ... * fix(process): normalize reactive rendered-frame timestamps A reactive `resize` action stamped `rendered_frames[].at_ms` with the raw elapsed time while every other rendered frame used `normalizeProcessElapsedTime`. Under the default 10ms time bucket the next frame buckets down and appears to move backwards, so `parseProcessCapture` rejected the entire capture with "rendered_frames: timestamps must be ordered". No test combined a reactive resize with time bucketing, so the path was never exercised. Thread the scenario's bucket into the reactive effect host and normalize the renderer call, matching what the scheduled-event resize path already did. `dispatched_at_ms` and `captured_at_ms` stay raw on both paths, so this changes only the one inconsistent clock. Also replace the wall-clock-scheduled interactive PTY scenario with terminal_text triggers. A fixed `at_ms` could fire before the child wrote its prompt under host contention, dropping the input and the resize echo. That rewrite is what surfaced this bug, and it now passes deterministically. Replace the 11 `if (!capability.available) return;` guards across the PTY suite with a shared it.skipIf gate. The old form reported a green pass with zero assertions on any host lacking native PTY authority; skips are now named and reported. Verified by reverting only the normalization, which reproduces the validation failure immediately. * fix(install): add recovery guidance to version-mismatch failure Every installer failure except one told the user what to do next. The version-mismatch failure reported only that the installed version did not match, with no remedy, which contradicts the requirement to keep diagnostics actionable for mismatch locations. Add a remedy in the same style as the neighbouring failures and drop the exemption the test carried for it, so all ten installer failures now assert they carry a recovery action. * ci: repair stale curated Windows lane and unblind the duplication gate The `windows-curated` job listed fifteen test files and nine of them no longer existed, including six `processOwnership*` files moved to `src/process/` in 4ecc7a72. Vitest silently drops unmatched paths, so the job ran six files and reported success. Repoint the paths at their current locations and add a test that fails when any listed path is renamed or removed, so the lane cannot silently lose coverage again. The duplication gate ignored `**/*.test.ts`, so it reported zero clones across the test tree while running on every PR. Include test files, remove the two largest duplicated clusters, and ratchet the threshold to the measured result so the gate can no longer pass by not looking. Run local tests with two workers instead of one. A single worker made a full local run cost ~140s of wall time at ~100% CPU on a 10-core host, which was the largest dev-cycle cost in the repository. Local now matches the concurrency CI already proves green, and PTY scenarios moved to a serial project because they contend for host terminal resources. Full local suite: 140s to ~89s. Regenerate the managed conformance manifest. Commit 4ecc7a72 edited SKILL.md without refreshing the digest, so `npm run check:pr` has been failing on main since that commit. * test: replace implementation lock-in with behavioural assertions Audit the suite for tests that cost maintenance without catching defects, then remove the lock-in rather than the coverage. Replace assertions that froze incidental detail: - toolContracts.test.ts pinned group sizes and 50 lines of literal tool names, so any additive catalog change required a test edit. Replace with four structural invariants: global name uniqueness, group containment in the published inventory, group disjointness, and non-empty groups. Both invariants are mutation-checked by orphaning and duplicating a tool. - Six tests asserted only that a schema accepts its own canonical fixture. Replace five with real rejections and two with property tests covering the invariants those tests were gesturing at: `isDbSaveComplete` is downward closed in every expected count, and frame retention holds at any size. - A concurrency test whose fake returned `? [] : []` could not fail. Give the fake real shared state so a lost update is observable. - providerProcess.test.ts asserted listener and timer counts plus exact cleanup retry counts. Assert detachment behaviour instead, so an unrelated internal timer no longer breaks the test. - Scale tests that rebuilt removed caps: 16 MiB and 10,001 files to prove limits that no longer exist, 100,001 frames compared against their own length, and a projection asserting a literal 10,201 bridge candidates. Replace with derived relationships that hold at any size. - installScript.test.ts merged two tables and now asserts alongside the exact wording that every failure carries a recovery action. - cdpBrowserProvider.sensitive_data asserted outcomes produced after the observation window closes while using a zero-length window; give it a real window so it measures the malformed-body rejection rather than host speed. - runtime.test.ts repeated the catalog assertion from the MCP boundary suite while spawning a second stdio server. Give the database-kind scenario its own claim and make stale-build failures legible. Extract two byte-identical fixture preambles that the max-lines rule had split across five and three files respectively, removing ~1,000 duplicated lines. Profile the heaviest files rather than only running them: the Apple projection test drops from 6.4s to 0.28s and the reference source import from 2.3s to 0.2s, with stronger assertions in both cases. * ci: keep native-authority suites out of the curated Windows lane CI showed the repointed curated list was red. Three of the restored files require verified Windows native authority, which windows-latest does not provide by design: - src/ghidra/GhidraProvider.test.ts, the replacement for the deleted tests/boundary/providers/ghidra/ghidraProvider.test.ts - tests/boundary/providers/ghidra/ghidraClient.test.ts - tests/boundary/process/providerProcess.test.ts All three fail with PrivateRuntimeRootUnavailableError, because Job Object process ownership and private-runtime DACL enforcement are unimplemented. The previous ghidraClient and providerProcess entries were added in this branch and never belonged here; the GhidraProvider replacement does not inherit the deleted file's Windows behaviour. Those claims belong behind the same approval boundary as the real Ghidra Windows workflow rather than the default lane. Record the exclusion in the guard test so the lane cannot regress to red, and in ci.yml so the next reader knows the omission is deliberate. The lane now runs 14 files, up from the 6 it silently ran before, all verified green on windows-latest. * test: stop max-lines from forcing test files to split The 500-line cap on test files only ever produced duplication. It chopped one binary session suite across nine files whose names were truncated mid-sentence, and it is why the curated Windows lane referenced six `processOwnership*` paths that had been split apart in the first place. Turn the cap off for tests and fixtures, keeping the function-length limit, then merge the nine binary session files back into one suite. That restores all 22 cases under a single module registry instead of nine and cuts the composition project from 20 files to 12. The merged cases become nine top-level describes grouped by concern, because a single wrapping describe would itself breach the function-length limit. Drop applicationWorkflowVerifier.test.ts. Its first case asserted `verified: true`, which the script emits as a literal after its own checks, so it could not fail, and every remaining assertion was `expect.any`. Its second case asserted an export-shape comparison that applicationWorkflowCli.test.ts already asserts through the product CLI, which is the stronger claim. Finally, five javascriptSemanticAnalysis files imported `it` from @fast-check/vitest while containing no properties. Import `it` from vitest so those files no longer read as property-based coverage. * test: stop creating temp scaffolding the temp helper immediately deletes `createTestTempDirectory` called `createTestWorkspace`, which creates `home` and `xdg/{config,cache}`, then deleted two of those three directories so the caller would receive an empty root. Every caller paid three `mkdir` calls and two `rm` calls per temporary directory for scaffolding it never used, across roughly a hundred test files. Create the directory directly instead. Callers that genuinely need a home or XDG tree can call `createTestWorkspace`. * test: merge the split process reactive runtime suite Five files shared one describe name in pairs and re-imported the same fixture helpers. With the shared preamble already extracted into processReactiveRuntime.fixture.ts, merge them into one suite of five top-level describes grouped by concern. All 12 cases are preserved and the domain project drops from 92 files to 88. * test: drop two identity round-trips from node runtime characterization One test built a plan with `max_calls: 10_001` and asserted the field came back as 10_001, which asserts that the plan constructor copies a field the test just set, and freezes a former ceiling in the process. The other built a 201-character alias and asserted it parsed back to the same string, which round-trips a value the test created. Neither could fail for a reason that matters. The remaining cases still cover preparation, stale-plan rejection, single dispatch, and artifact write. * test: hoist duplicated graph fixtures into the shared fixture module Eleven copies of three helpers were spread across the seven javascriptApplicationGraph files: `completeCoverage` five times, `nodeByLabel` four times, and `firstOf` twice, all byte-identical. The fixture module already carried a private `completeCoverage`. Export all three from javascriptApplicationGraph.fixture.ts and import them, removing 95 duplicated lines. * test: separate the reactive fixture's two PTY writes The multi-source run resolved target_lost instead of passed intermittently. The ready transition matches terminal text "Ready" and consumes that observation, advancing the terminal frontier; the collecting state then needs "Collecting" in a later observation. The fixture wrote both back to back, so the PTY sometimes coalesced them into one chunk and the collecting trigger could never match. Move the "Collecting" write after the synchronous shim probe. The probe takes real wall time, so the reader has drained the first chunk before the second is written, which makes the ordering deterministic rather than timing dependent. Measured 33/34 isolated passes, against roughly even odds before. Under four concurrent copies it still failed 2 of 12, so this narrows the window rather than closing it: the underlying race is that node-pty delivers buffered output through a callback the exit path never awaits, so the harness can declare the target lost before the last chunk is ingested. The test is left strict because it is correctly detecting that. * test: replace expect.any placeholders with real results Four acceptance scenarios and one composition scenario asserted only that a field was a string, number, object, or array. Those assertions cannot fail for a reason that matters, and three of them sit behind real CLI process spawns that cost about 1.5s. Capture the actual results once and assert them exactly. The CLI parity scenario now pins the trace summary and coverage, the version comparison summary and coverage, and the source-to-bundle summary and coverage, so each spawn earns its cost. The MCP rejection case now asserts `invalid_request` with category `invalid_input`, which is what makes it a caller-input failure rather than a provider one. The artifact comparison case asserted three `expect.any` values immediately before an assertion that subsumed them. Replace them with the claim that actually matters above 500 entries: manifest counts must reconcile with the arrays returned, and every written file must appear as an occurrence, so a reintroduced truncation would fail. * test: remove impossible and incidental prompt assertions Two assertions in toolResult could never fail: each asserted that the serialized result did not contain a string that appears nowhere in its own inputs, so only in the assertion itself. promptContracts asserted that a `Set` built from a locally declared six element literal had no duplicates, and pinned thirteen incidental fragments of rendered prompt prose. Drop the tautology and reduce the prose block to the five properties an analyst actually depends on: caller input framed as data rather than instruction, tools offered as options rather than a mandated sequence, the epistemic vocabulary present, tools never framed as authorization, and deterministic suggestion order. * test: hoist the remaining duplicated graph fixtures Eight more byte-identical helper copies across the javascriptApplicationGraph files: `graphForNode` four times, `unknownEvidence` twice, and `contentNode` twice. Move them into javascriptApplicationGraph.fixture.ts alongside the three hoisted earlier, and drop the imports they left behind. Net -92 lines across the seven files. * test: drop enhancedTools helpers already in the shared harness Three of the six enhancedTools files still carried local copies of PROCEDURES, inventory, and emptyBounded that are byte-identical to the exports added to enhancedToolsHarness.ts. Import them instead. Only fixturePort, connect, and jsonResult differ per file, so those stay local. * test: replace repeated process-tree event literals with fixture builders The file spelled out nineteen thirteen-field event literals and thirteen-field process nodes inline, varying only three or four fields each, so a test read as a wall of repeated boilerplate rather than the transitions under test. Add eventProcessTree.fixture.ts with spawn, exit, re-exec and reparent builders plus a process-node builder, and express each case as the sequence it describes. The test drops from 422 to 214 lines with all nine cases intact. * test: share the process-ownership validation fixtures The two process-ownership validation files each declared byte-identical copies of an `ownership` constant and a 24-line `host` builder. Move both into ProcessOwnership.fixture.ts and import them. * test: make rejection and retention assertions exact The reactive scenario rejection table asserted only that each of its six fixtures failed to parse. A typo anywhere in a fixture would satisfy that, including one that invalidated an unrelated field. Record the field each row is meant to invalidate and require the reported issue to point at that path with the expected code. Verified by making one row valid except for an unknown key: the row now fails instead of passing for the wrong reason. The large-body replay test asserted that the serialized result exceeded five million characters as a proxy for the bodies being retained, which escaping or padding could satisfy even under truncation. Compare each retained body to the input byte for byte and total the retained length. Verified by shaving one byte off the expected value, which now fails. * test: share the elicitation grants fixtures The three processCaptureElicitationGrants files each declared the same five helpers inline: an elicitation request, a fixed clock, a ceiling-only permission authority, a request-context builder, and a verified-state stub. Move them into elicitationGrantsHarness.ts and import them. * fix(process): wait for trailing PTY chunks before declaring target loss The exit path drained the reactive coordinator and then submitted target_lost, but node-pty delivers buffered output through onData callbacks that run outside the coordinator's queue. A trailing chunk that had not been delivered yet produced no journal entry, so the drain had nothing to wait for and the target was declared lost while a terminal trigger was still satisfiable. That is what made the multi-source reactive fixture resolve target_lost instead of passed at roughly even odds. Yield to the event loop until the capture journal stops growing before draining, bounded so a pathological stream cannot stall exit. The fixture change that accompanied this is no longer carrying the weight on its own; the ordering it introduced remains correct and worth keeping. Measured 18 consecutive passes across isolated and four-way concurrent runs, against roughly even odds beforehand. A control run with the wait disabled did not reproduce the failure, so the machine was not loaded enough for a controlled comparison; the before/after numbers are from separate sessions. * test: hoist the last duplicated domain and coordinator fixtures processTraceComparison and its Part2 declared the same eight helpers, and the two ProcessReactiveCoordinatorFailures files declared the same three. All were byte-identical. Move them into shared fixture modules and import them, netting 429 fewer lines. The earlier attempts at this failed because depth-based scanning mis-detected helper boundaries: bracket characters inside type annotations, such as `options: { truncated?: boolean }`, unbalance the count. Extracting by verified line range instead worked first time, and unused imports were then settled by alternating typecheck and lint rather than by guessing which names a body uses. * ci: ratchet the duplication gate to the reduced baseline Test-file duplication is down to 2.58% of lines across src and tests, from 3.39% when tests were first included in the gate. Lower the threshold from 3.2 to 2.7 so the reduction cannot regress. * test: merge the remaining artificially split test files Five suites were each split across two or three files by the max-lines rule that is no longer applied to tests, and every split produced a duplicate describe name and a duplicated import block. Merge them back: processTraceComparison, ProcessReactiveCoordinatorFailures, ProcessOwnership.validation, processCaptureElicitationGrants, and processCaptureElicitation. Net -62 lines and five fewer files. Give each merged describe a name describing what it covers, since the splits were arbitrary and the names now collide. Test bodies are unchanged; every describe already fitted the function-length limit, so merging them as separate top-level blocks satisfies it. Imports were settled by writing each block explicitly after typecheck and lint disagreed. Lint is right about names that appear only inside string literals, such as `values(["terminal", "process", "http", "websocket"])`, while typecheck is right about names a body genuinely references, so neither alone was sufficient. * test: merge the graph suite and share the enhancedTools result helper The seven javascriptApplicationGraph files were one suite with one describe name repeated seven times. Merge them into a single file with seven describes named for what each covers, keeping all 18 cases. Three of the enhancedTools files declared byte-identical copies of a jsonResult helper. Move it into enhancedToolsHarness.ts alongside the rest of the shared fixtures. The remaining enhancedTools files stay split: their fixturePort helpers are three genuinely different provider doubles rather than duplicates, so merging them would mean renaming per-file seams and lose the reason each exists. * ci: repoint the Windows lane at the merged ownership validation file Merging the split ProcessOwnership.validation files removed the two Part paths the curated Windows lane referenced. The curated-lane guard test caught it on CI, which is the failure it was added to prevent. * test(process): make lifecycle assertions falsifiable and scope them to POSIX Two assertions could not fail, so neither observed the behaviour it claimed. The deadline disposal test aborted an already-aborted controller and then read an immutable interruption, so it passed whether or not disposal released the timer or the listener. Dispose before aborting instead and assert the owned timer count reaches zero, which distinguishes a released deadline from a retained one. Verified by mutation: emptying dispose, dropping the listener removal, and dropping the timer clear each fail the test. The supervisor test asserted that a repeated stop still resolved, but stop caches its promise, so it proved nothing about detachment. Replace it with a late error and close event after disposal and assert the diagnostic channel stays untouched, keeping an attached control that proves the channel works. Verified by mutation: retaining the error listener fails the test. Also mark the TERM-to-KILL escalation POSIX-only. libuv maps every signal to TerminateProcess on Windows, where a child that ignores SIGTERM cannot survive the TERM step, so the escalation and SIGKILL signal code are unreachable there. * fix(vitest): restore cross-project scheduling for local runs Dropping the per-project `sequence.groupOrder` made every project run concurrently. `fileParallelism: false` only serialises files inside a single project, so `process-boundary` could still overlap with the boundary projects that observe host process and terminal state, which is the contention that drops input and resize echoes. The removed blanket per-project serialisation was slower, but it was never what isolated projects from each other. Keep the two-worker intra-project parallelism that made local runs fast and apply the ordering locally only, so CI keeps the concurrency it proves green. * fix(acceptance): make the database startup record check observable The check asserted stderr contained no fatal record, but a database-kind startup that only lists the catalog starts no bridge work and writes no records at all, so the assertion passed without observing anything. Reading stderr while the child was still running also raced the pipe, and splitting the buffer could parse a partial trailing line. Call a tool so startup records are actually produced, parse only complete newline-delimited records, and read after the transport closes so delivery is no longer in question. Guard the result with an explicit non-vacuity assertion so the fatal check cannot silently stop observing anything. Verified by mutation: injecting a level-60 record through the stderr logger now fails the test. * test(acceptance): restore the application workflow verifier coverage Nothing else in the repository executes scripts/verify-local-application-workflows.mjs, so deleting this file left the only automated check on a shipped script. Regressions in its dist imports, argument handling, or two-version and export-shape output could ship with a green suite. The two cases cost about 350ms and 500ms, so the duplication that motivated removing them was never the reason to drop the coverage. Verified by mutation: flipping the reported verification status fails the suite. * test(contracts): add a published tool name floor Every remaining inventory invariant is structural, so deleting a contract from both its group and the aggregate left the whole file green while the catalog regenerated without it. Structural checks cannot detect removal; only a declared baseline can. Declare the 114 published names as a floor rather than an equality. Adding a tool still needs no edit, while removing one now fails with a message naming the tool. Verified by mutation: dropping a contract from its group so the aggregate loses it too fails the floor. * test: restore no-ceiling coverage above plausible truncation limits Four suites claimed a result was complete at any scale while their own inputs were bounded below where a truncation would appear, so the guarantee they described was not actually under test. Scale independence cannot be asserted as a relationship over a fixture smaller than the cap being ruled out. Raise each fixture past any ceiling a regression would plausibly introduce, which is far cheaper than the removed cases: referenceSourceImport 600 entries/64 KiB -> 5,000 entries with a 4 MiB member customProtocolCapture generated max 40 frames -> 300..1,000 appleApplication 12 frameworks/16 candidates -> 250/1,600 nodeRuntimeCharacterization assert the absent call-budget and alias bounds where they would be added, since the budget derives from the case count Verified by mutation: a 1,000-entry import cap, a 500-frame capture cap, a 100-framework projection cap, a 100,000-call budget cap, and a 200-character alias cap each fail the corresponding suite. * fix(process): require a quiet period before declaring the target lost Returning on the first unchanged journal sample granted a single event-loop turn of grace. A chunk queued on a later iteration therefore still let `target_lost` be submitted before the final terminal observation, discarding a satisfiable reactive trigger under the same load-dependent exit scenario the drain was added for, and `maxTicks` never bounded that because the loop exited early every time. Require several consecutive unchanged turns so a callback arriving on any of the next few iterations still lands first, while keeping the overall tick bound so a pathological stream cannot stall exit. * fix: stop a 4 GiB fixture and measure the drain quiet period in time The reference import fixture cycled its five sizes across all 5,000 entries, which made a thousand 4 MiB members and nearly 4 GiB of fixture written concurrently. It happened to fit locally but cannot fit a runner's disk. Cross the two boundaries independently instead: entry count by volume of tiny members, byte size by a single 4 MiB member, for about 4.2 MiB total. Verified by mutation that a 1,000-entry cap and a 1 MiB per-member cap both still fail. The drain check counted scheduler turns, but consecutive setImmediate turns elapse in microseconds, so four of them finish long before a pty callback delayed under host contention, which is when the trailing chunk matters. Measure the quiet interval in elapsed time instead, so a late callback within the window still lands before target loss. Verified by simulation: the turn-count version missed any delay beyond a few microseconds, the timed version observes delays up to the quiet interval.	2026-10-03 23:22:07 +08:00
morluto	d4dc940bd8	refactor(test): keep coverage at behavioral boundaries (#474) ... * refactor(test): keep coverage at behavioral boundaries * fix(ci): restore package workflow temp-root classification	2026-08-11 18:34:32 +08:00