@aviaratech/ai-delivery 0.3.8 → 0.3.10

package/README.md

@@ -323,10 +323,12 @@ The classifier owns the digest values and must include every relevant source, co
 
 Verification holds one file lease per worktree and durably records its writer and observed command process identities. A second writer in the same worktree is rejected before execution. Separate worktrees can overlap, including at the same head, with separate stage inputs and mutable manifests. Callers must first qualify their commands' CPU, memory, disk, I/O and shared-file/service requirements; a resource class alone grants no shared-resource exclusivity. The runtime adds no global executor cap. On retry after writer interruption, it refuses live or unknown ownership and reconciles only the recorded command group and observed descendants before reusing compatible completed stages. A launch interrupted before command identity was recorded requires explicit reconciliation. Process identity observation is required on supported POSIX hosts; unavailable or ambiguous observation fails closed.
 
-The `--admit` flag explicitly admits additional resource classes. Publication creates a draft PR only after exact-head verification; a high-risk policy also requires a prepublication review artifact. Ready promotion and merge require a submitted formal review. Merge checks live blockers, checks, base/head coordinates, and the policy boundary. Repositories may require an exact base/head lease for merge.
+The `--admit` flag explicitly admits additional resource classes for execution. Compatible complete stages are reused only after their existing stage, artifact, command-output and applicable resource proofs are fully validated, without admitting execution of those classes. Missing or incompatible proof requires the current invocation's admission for the actual stage class before any command runs; corrupt proof remains a hard failure. This permits serial `source_only`, `model`, then `postgres_docker` invocations to reuse prior completed stages while admitting only the next class to execute. Publication creates a draft PR only after exact-head verification; a high-risk policy also requires a prepublication review artifact. Ready promotion and merge require a submitted formal review. Merge checks live blockers, checks, base/head coordinates, and the policy boundary. Repositories may require an exact base/head lease for merge.
 
 For a bounded run, pass `--max-aggregate-rss-bytes`, `--min-free-disk-bytes`, and optionally `--max-new-output-bytes` with one or more `--output-root` paths to `verify`. `issue_verify` accepts the same values in `resourceBounds`. RSS is sampled across the observed child process tree, including observed detached descendants; free disk is checked before commands and during execution on the worktree and declared output filesystems. Positive file-size growth is sampled under the declared roots, with previously measured completed stages carried across a resume. The caller must declare every output root relevant to its allowance; aliases must resolve within those roots. The roots are relative to the issue worktree unless absolute. Output growth is separate from the 8 MiB captured stdout/stderr limit. Resource limits are opt in and do not impose a total runtime deadline.
 
+During a running command, an `ENOENT` from symlink resolution can reflect ordinary tree removal. The observer reports the first path and errno and retries complete scans for at most one second; it never accepts a partial scan or resets that observation-stall window. Cancellation interrupts the wait, and RSS and disk checks continue. Baseline and final scans remain strict; persistent broken links, cycles and escaping aliases fail closed. Failed commands retain captured stdout/stderr in the existing private content-addressed command-output store, with its digest and the actual exit status in the failure diagnostic. Output still buffered inside a killed child is unavailable to the runner.
+
 Real filesystem-negative tests can use `withVerificationFilesystemFixture` from `@aviaratech/ai-delivery` (or its `agent` export):
 
 ```js

package/dist/lifecycle.test.js

@@ -12,7 +12,7 @@ import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
 import { AI_DELIVERY_MCP_TOOLS } from './mcp/tools.js';
 import { createAiDeliveryMcpServer } from './mcp/index.js';
 import { loadDeliveryConfig, parseDeliveryConfig } from './config/deliveryConfig.js';
-import { digestValue } from './delivery/index.js';
+import { digestValue, stableJson } from './delivery/index.js';
 import { contextFor, executeTool, resumedIssueUpdate, startTrackedIssue } from './dispatch.js';
 import { defaultBaseRef, gitCommonDir } from './git.js';
 import * as githubClient from './github/client.js';
@@ -210,6 +210,7 @@ async function fixture(options = {}) {
     const remoteName = options.remote ?? 'origin';
     const counter = join(root, '.git', 'stage-count.txt');
     const secondCounter = join(root, '.git', 'second-stage-count.txt');
+    const thirdCounter = join(root, '.git', 'third-stage-count.txt');
     const failSecond = join(root, '.git', 'fail-second-stage');
     try {
         git(root, 'init', '-q', '-b', 'main');
@@ -290,11 +291,16 @@ export default {
       requiredStages: [{ id: 'check', dependsOn: [], semanticInputKeys: ['source'],
         ${options.componentPolicy ? "semanticInputs: [{ key: 'source', digest: bytes(readFileSync(new URL('./artifact.txt', import.meta.url))) }]," : ''}
         resourceClass: 'source_only', commands: [{ label: 'count', argv: [process.execPath, '-e',
-          ${JSON.stringify(options.firstStageScript ?? `const fs=require('fs');const p=${JSON.stringify(counter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }${options.twoStages
+          ${JSON.stringify(options.firstStageScript ?? `const fs=require('fs');const p=${JSON.stringify(counter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }${options.twoStages || options.serialResourceStages
             ? `, { id: 'second', dependsOn: ['check'], semanticInputKeys: ['source'],
         ${options.componentPolicy ? "semanticInputs: [{ key: 'source', digest: bytes(readFileSync(new URL('./component.txt', import.meta.url))) }]," : ''}
-        resourceClass: 'source_only', commands: [{ label: 'retry', argv: [process.execPath, '-e',
+        resourceClass: '${options.serialResourceStages ? 'model' : 'source_only'}', commands: [{ label: 'retry', argv: [process.execPath, '-e',
           ${JSON.stringify(options.secondStageScript ?? `const fs=require('fs');const p=${JSON.stringify(secondCounter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));if(fs.existsSync(${JSON.stringify(failSecond)}))process.exit(7);`)}] }] }`
+            : ''}${options.serialResourceStages
+            ? `, { id: 'postgres', dependsOn: ['second'], semanticInputKeys: ['source'],
+        ${options.componentPolicy ? "semanticInputs: [{ key: 'source', digest: bytes(readFileSync(new URL('./component.txt', import.meta.url))) }]," : ''}
+        resourceClass: 'postgres_docker', commands: [{ label: 'count', argv: [process.execPath, '-e',
+          ${JSON.stringify(`const fs=require('fs');const p=${JSON.stringify(thirdCounter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }`
             : ''}],
       risk: 'standard' };
   },
@@ -353,7 +359,7 @@ export default {
         mkdirSync(dirname(admissionPath), { recursive: true });
         if (!options.omitRuntimeAdmission)
             writeFileSync(admissionPath, JSON.stringify({ ...content, admissionId: digestValue(content) }), { mode: 0o600 });
-        return { root, counter, secondCounter, failSecond, runtimeEntryPath };
+        return { root, counter, secondCounter, thirdCounter, failSecond, runtimeEntryPath };
     }
     catch (error) {
         rmSync(root, { recursive: true, force: true });
@@ -1803,6 +1809,224 @@ test('a bounded passing run records measured resources in versioned evidence', a
         rmSync(root, { recursive: true, force: true });
     }
 });
+test.each([
+    { bounded: false, componentPolicy: false },
+    { bounded: true, componentPolicy: false },
+    { bounded: true, componentPolicy: true },
+])('serial admission reuses complete stages with bounds $bounded and component policy $componentPolicy', async ({ bounded, componentPolicy }) => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({
+        serialResourceStages: true,
+        componentPolicy,
+    });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            ...(bounded ? { resourceBounds: { maxAggregateRssBytes: 1_000_000_000, minFreeDiskBytes: 1 } } : {}),
+        };
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['source_only'] }), /Stage 'second' requires explicit model admission/u);
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        assert.equal(existsSync(secondCounter), false);
+        assert.equal(existsSync(thirdCounter), false);
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['model'] }), /Stage 'postgres' requires explicit postgres_docker admission/u);
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        assert.equal(readFileSync(secondCounter, 'utf8'), '1');
+        assert.equal(existsSync(thirdCounter), false);
+        const completed = await verifyIssue({ ...input, admittedResourceClasses: ['postgres_docker'] });
+        const repeated = await verifyIssue({ ...input, admittedResourceClasses: [] });
+        assert.deepEqual(repeated.stageReceipts, completed.stageReceipts);
+        for (const path of [counter, secondCounter, thirdCounter])
+            assert.equal(readFileSync(path, 'utf8'), '1');
+        if (bounded) {
+            assert.deepEqual(repeated.resources, completed.resources);
+            assert.ok((repeated.resources?.sampleCount ?? 0) > 0);
+            const first = completed.stageReceipts[0];
+            const stagePath = join(root, '.git', 'ai-delivery', first.input.schemaVersion === 'ai-delivery.stage-input@2' ? 'verification@2' : 'verification@1', 'stages', 'check', `${first.input.inputId.slice(7)}.json`);
+            rmSync(stagePath);
+            const repaired = await verifyIssue({ ...input, admittedResourceClasses: [] });
+            assert.deepEqual(repaired.stageReceipts, completed.stageReceipts);
+            assert.deepEqual(repaired.resources, completed.resources);
+            assert.equal(existsSync(stagePath), true);
+            assert.equal(readFileSync(counter, 'utf8'), '1');
+        }
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test.each(['missing', 'unmeasured', 'source', 'command', 'environment', 'runtime', 'producer', 'bounds'])('serial admission refuses execution after %s proof invalidation', async (changed) => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({ serialResourceStages: true });
+    const previousPath = process.env.PATH;
+    const versionDescriptor = Object.getOwnPropertyDescriptor(process, 'version');
+    const producerPath = join(import.meta.dirname, 'serial-producer-fixture.js');
+    let producerOwned = false;
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: { maxAggregateRssBytes: 1_000_000_000, minFreeDiskBytes: 1 },
+        };
+        const completed = await verifyIssue({
+            ...(changed === 'unmeasured' ? { issueNumber: input.issueNumber, repoRoot: input.repoRoot } : input),
+            admittedResourceClasses: ['source_only', 'model', 'postgres_docker'],
+        });
+        if (changed === 'missing') {
+            const id = completed.stageReceipts[0].input.inputId.slice(7);
+            rmSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check', `${id}.json`));
+            rmSync(join(root, '.git', 'ai-delivery', 'resource-stages@1', `${id}.json`));
+        }
+        else if (changed === 'source' || changed === 'command') {
+            const path = join(row.path, changed === 'source' ? 'change.txt' : 'policy.mjs');
+            writeFileSync(path, changed === 'source'
+                ? 'changed source\n'
+                : readFileSync(path, 'utf8').replace("label: 'count'", "label: 'changed-count'"));
+            git(row.path, 'add', '.');
+            git(row.path, 'commit', '-qm', 'synthetic checkpoint invalidation');
+        }
+        else if (changed === 'environment')
+            process.env.PATH = `${previousPath ?? ''}:/synthetic-environment`;
+        else if (changed === 'runtime')
+            Object.defineProperty(process, 'version', { value: 'v0.0.0' });
+        else if (changed === 'producer') {
+            assert.equal(existsSync(producerPath), false);
+            writeFileSync(producerPath, '// changed synthetic runner identity\n');
+            producerOwned = true;
+        }
+        else if (changed === 'bounds')
+            input.resourceBounds.maxAggregateRssBytes -= 1;
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['postgres_docker'] }), /Stage 'check' requires explicit source_only admission/u);
+        for (const path of [counter, secondCounter, thirdCounter])
+            assert.equal(readFileSync(path, 'utf8'), '1');
+    }
+    finally {
+        if (previousPath === undefined)
+            delete process.env.PATH;
+        else
+            process.env.PATH = previousPath;
+        Object.defineProperty(process, 'version', versionDescriptor);
+        if (producerOwned)
+            rmSync(producerPath);
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test.each([
+    'stage',
+    'canonical',
+    'artifact',
+    'output',
+    'resource',
+    'resource-bounds',
+    'resource-samples',
+    'missing-resource',
+    'baseline',
+])('serial admission rejects corrupt %s proof before considering execution', async (corrupt) => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({ serialResourceStages: true });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        mkdirSync(join(row.path, '.issue-cli'), { recursive: true });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: {
+                maxAggregateRssBytes: 1_000_000_000,
+                minFreeDiskBytes: 1,
+                maxNewOutputBytes: 1_000_000,
+                outputRoots: ['.issue-cli'],
+            },
+        };
+        const completed = await verifyIssue({
+            ...input,
+            admittedResourceClasses: ['source_only', 'model', 'postgres_docker'],
+        });
+        const first = completed.stageReceipts[0];
+        const common = join(root, '.git', 'ai-delivery');
+        const id = first.input.inputId.slice(7);
+        const stagePath = join(common, 'verification@1', 'stages', 'check', `${id}.json`);
+        const resourcePath = join(common, 'resource-stages@1', `${id}.json`);
+        if (corrupt === 'stage')
+            writeFileSync(stagePath, 'corrupt stage proof\n');
+        else if (corrupt === 'canonical')
+            writeFileSync(stagePath, `${readFileSync(stagePath, 'utf8')}\n`);
+        else if (corrupt === 'artifact') {
+            const { receiptId: _receiptId, ...content } = first;
+            const altered = { ...content, artifacts: [{ path: 'artifact.txt', digest: digestValue('corrupt artifact') }] };
+            writeFileSync(stagePath, stableJson({ ...altered, receiptId: digestValue(altered) }));
+        }
+        else if (corrupt === 'output') {
+            writeFileSync(join(common, 'verification@1', 'command-output', `${first.commands[0].outputDigest.slice(7)}.bin`), 'corrupt output');
+        }
+        else if (corrupt === 'resource')
+            writeFileSync(resourcePath, 'corrupt resource proof\n');
+        else if (corrupt === 'missing-resource')
+            rmSync(resourcePath);
+        else if (corrupt === 'baseline') {
+            const directory = join(common, 'output-baselines@1');
+            const file = readdirSync(directory).find((name) => name.endsWith('.json') && !name.endsWith('.state.json'));
+            writeFileSync(join(directory, file), 'corrupt baseline proof\n');
+        }
+        else {
+            const { checkpointId: _checkpointId, ...content } = JSON.parse(readFileSync(resourcePath, 'utf8'));
+            if (corrupt === 'resource-bounds')
+                content.resources.bounds.maxAggregateRssBytes += 1;
+            else
+                content.resources.sampleCount = 0;
+            writeFileSync(resourcePath, JSON.stringify({ ...content, checkpointId: digestValue(content) }));
+        }
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['postgres_docker'] }), (error) => error instanceof Error && !error.message.includes('admission'));
+        for (const path of [counter, secondCounter, thirdCounter])
+            assert.equal(readFileSync(path, 'utf8'), '1');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test('serial admission requires dependent execution after a real upstream rerun', async () => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({ serialResourceStages: true });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: { maxAggregateRssBytes: 1_000_000_000, minFreeDiskBytes: 1 },
+        };
+        const completed = await verifyIssue({
+            ...input,
+            admittedResourceClasses: ['source_only', 'model', 'postgres_docker'],
+        });
+        const id = completed.stageReceipts[0].input.inputId.slice(7);
+        rmSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check', `${id}.json`));
+        rmSync(join(root, '.git', 'ai-delivery', 'resource-stages@1', `${id}.json`));
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['source_only'] }), /Stage 'second' requires explicit model admission/u);
+        assert.equal(readFileSync(counter, 'utf8'), '2');
+        assert.equal(readFileSync(secondCounter, 'utf8'), '1');
+        assert.equal(readFileSync(thirdCounter, 'utf8'), '1');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
 test('bounded verification reruns unmeasured work and reuses only matching measured stages', async () => {
     const { root, counter, secondCounter, failSecond } = await fixture({ twoStages: true });
     try {
@@ -3797,6 +4021,170 @@ test.each([
 test('an unrelated consumer uses public MCP setup through verified configured-author publication, counted review readback, merge and cleanup', { timeout: 0 }, async () => {
     await syntheticLifecycle({ remote: 'origin', divergentOrigin: false, producerOnboarding: true });
 });
+test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary owned symlink teardown preserves observation and %s command evidence', async (mode) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-ordinary-teardown-')));
+    const { root } = await fixture();
+    const controller = new AbortController();
+    const events = join(output, 'events');
+    const ready = join(output, 'ready');
+    const release = join(output, 'release');
+    writeFileSync(join(output, 'unrelated'), 'preserved');
+    writeFileSync(join(output, 'target'), 'x'.repeat(128));
+    symlinkSync('./target', join(output, 'alias'));
+    let observedGap = false;
+    const observations = [];
+    let releaseTimer;
+    const progress = vi.spyOn(process.stderr, 'write').mockImplementation((line) => {
+        if (String(line).includes('ENOENT'))
+            observations.push(String(line));
+        if (!observedGap && existsSync(ready) && String(line).includes('sampledAggregateRssBytes')) {
+            observedGap = true;
+            // Synchronize real removal with the sample preceding the synchronous filesystem scan.
+            releaseTimer = setTimeout(() => {
+                if (mode === 'cancel')
+                    controller.abort();
+                else if (mode !== 'persistent')
+                    writeFileSync(release, 'continue');
+            }, 100);
+        }
+        return true;
+    });
+    const script = `
+(async () => {
+  const fs = require('node:fs');
+  const trace = value => fs.appendFileSync(${JSON.stringify(events)}, value + '\\n');
+  trace('command-started');
+  if (['command-error', 'persistent'].includes(${JSON.stringify(mode)})) console.error('synthetic buffered preparation failure');
+  fs.unlinkSync(${JSON.stringify(join(output, 'target'))});
+  trace('target-removed'); fs.writeFileSync(${JSON.stringify(ready)}, 'ready');
+  if (${JSON.stringify(mode)} === 'limit') fs.writeFileSync(${JSON.stringify(join(output, 'retained'))}, 'x'.repeat(512));
+  while (!fs.existsSync(${JSON.stringify(release)})) await new Promise(resolve => setTimeout(resolve, 10));
+  fs.unlinkSync(${JSON.stringify(join(output, 'alias'))}); trace('alias-removed');
+  process.exitCode = ${mode === 'command-error' ? 7 : 0};
+})().catch(error => { console.error(error); process.exitCode = 1; });`;
+    try {
+        const { withRuntimeSetupWriter } = await import('./verification.js');
+        const run = withRuntimeSetupWriter(root, (runner) => runner.run([process.execPath, '-e', script], {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: mode === 'limit' ? 256 : 4096,
+            outputRoots: [output],
+        }, controller.signal));
+        if (mode === 'pass')
+            await run;
+        else
+            await assert.rejects(run, (error) => {
+                const message = String(error);
+                assert.match(message, mode === 'cancel'
+                    ? /cancelled/u
+                    : mode === 'persistent'
+                        ? /remained unavailable.*First observation:.*ENOENT/u
+                        : mode === 'limit'
+                            ? /filesystem output.*exceeded/u
+                            : /exit 7/u);
+                assert.doesNotMatch(message, /cleanup failed/u);
+                assert.ok(message.includes(join(output, 'alias')));
+                assert.match(message, /ENOENT/u);
+                if (mode === 'command-error' || mode === 'persistent') {
+                    const digest = /Command output (sha256:[a-f0-9]{64})/u.exec(message)?.[1];
+                    assert.ok(digest);
+                    assert.match(readFileSync(join(root, '.git', 'ai-delivery', 'verification@1', 'command-output', `${digest.slice(7)}.bin`), 'utf8'), /synthetic buffered preparation failure/u);
+                }
+                return true;
+            });
+        assert.ok(observedGap);
+        assert.ok(observations.some((line) => {
+            const observation = JSON.parse(line.slice(line.indexOf('{')));
+            return observation.reason.includes(join(output, 'alias'));
+        }));
+        assert.equal(readFileSync(join(output, 'unrelated'), 'utf8'), 'preserved');
+        console.log(JSON.stringify({
+            scenario: 'ordinary-owned-symlink-teardown',
+            mode,
+            firstObservation: JSON.parse(observations[0].slice(observations[0].indexOf('{')))
+                .reason,
+            events: readFileSync(events, 'utf8').trim().split('\n'),
+            unrelatedPreserved: true,
+            aliasRetained: readdirSync(output).includes('alias'),
+        }));
+        assert.deepEqual(readFileSync(events, 'utf8').trim().split('\n'), mode === 'cancel' || mode === 'persistent'
+            ? ['command-started', 'target-removed']
+            : ['command-started', 'target-removed', 'alias-removed']);
+        if (mode === 'cancel' || mode === 'persistent') {
+            await assert.rejects(withRuntimeSetupWriter(root, (runner) => runner.run([process.execPath, '-e', ''], {
+                maxAggregateRssBytes: 1_000_000_000,
+                minFreeDiskBytes: 1,
+                maxNewOutputBytes: 4096,
+                outputRoots: [output],
+            })), (error) => {
+                assert.ok(String(error).includes(join(output, 'alias')));
+                assert.match(String(error), /ENOENT/u);
+                return true;
+            });
+        }
+    }
+    finally {
+        controller.abort();
+        if (releaseTimer !== undefined)
+            clearTimeout(releaseTimer);
+        progress.mockRestore();
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test('injected observation deadline rejects a late complete real filesystem retry', async () => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-observation-deadline-')));
+    const { root } = await fixture();
+    const target = join(output, 'target'), alias = join(output, 'alias'), release = join(output, 'release');
+    writeFileSync(target, 'target');
+    symlinkSync('./target', alias);
+    const now = Date.now.bind(Date);
+    let offset = 0;
+    let firstObservation;
+    let advance;
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => now() + offset);
+    const progress = vi.spyOn(process.stderr, 'write').mockImplementation((line) => {
+        if (firstObservation === undefined && String(line).includes('ENOENT')) {
+            firstObservation = String(line);
+            advance = setTimeout(() => {
+                // This test injects only the deadline. Alias removal and the subsequent complete scan are real.
+                unlinkSync(alias);
+                offset = 1100;
+                writeFileSync(release, 'finish');
+            }, 0);
+        }
+        return true;
+    });
+    const script = `(async () => {
+    const fs = require('node:fs'); fs.unlinkSync(${JSON.stringify(target)});
+    while (!fs.existsSync(${JSON.stringify(release)})) await new Promise(resolve => setTimeout(resolve, 10));
+  })().catch(error => { console.error(error); process.exitCode = 1; });`;
+    try {
+        const { withRuntimeSetupWriter } = await import('./verification.js');
+        await assert.rejects(withRuntimeSetupWriter(root, (runner) => runner.run([process.execPath, '-e', script], {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: 4096,
+            outputRoots: [output],
+        })), (error) => {
+            assert.match(String(error), /remained unavailable for 1 second/u);
+            assert.ok(String(error).includes(alias));
+            assert.match(String(error), /ENOENT/u);
+            assert.doesNotMatch(String(error), /cleanup failed/u);
+            return true;
+        });
+        assert.ok(firstObservation);
+        assert.equal(readdirSync(output).includes('alias'), false);
+    }
+    finally {
+        if (advance !== undefined)
+            clearTimeout(advance);
+        progress.mockRestore();
+        clock.mockRestore();
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
 test.each(['escape', 'broken', 'cycle'])('output observation rejects %s aliases without running policy commands', async (kind) => {
     const { root, counter } = await fixture();
     const base = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-output-alias-')));