@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/csv.test.js

@@ -179,6 +179,54 @@ async function run() {
   rejectsS("delim same as quote",   function () { b.csv.stringify([{ a: 1 }], { delimiter: "\"" }); }, /csv\/bad-delimiter/);
   rejectsS("bad eol",               function () { b.csv.stringify([{ a: 1 }], { eol: "X" }); }, /csv\/bad-opt/);
   check("stringify: empty array → empty string",   b.csv.stringify([]) === "");
+
+  // ---- DEFAULTS_PARSE — documented values + parse honors them ----
+  var dp = b.csv.DEFAULTS_PARSE;
+  check("DEFAULTS_PARSE.maxBytes is 16 MiB",       dp.maxBytes === 16777216);
+  check("DEFAULTS_PARSE.maxRows is 1,000,000",     dp.maxRows === 1000000);
+  check("DEFAULTS_PARSE.maxFieldBytes is 1 MiB",   dp.maxFieldBytes === 1048576);
+  check("DEFAULTS_PARSE.delimiter is comma",       dp.delimiter === ",");
+  check("DEFAULTS_PARSE.quote is double-quote",    dp.quote === "\"");
+  check("DEFAULTS_PARSE.header defaults true",     dp.header === true);
+  check("DEFAULTS_PARSE.trim defaults false",      dp.trim === false);
+  check("DEFAULTS_PARSE.onBadRow defaults throw",  dp.onBadRow === "throw");
+
+  // parse honors header:true by default → returns objects keyed by header.
+  var dpRows = b.csv.parse("k,v\nx,1");
+  check("DEFAULTS_PARSE: default header→objects",  !Array.isArray(dpRows[0]) && dpRows[0].k === "x");
+  // parse honors the default comma delimiter (a tab is data, not a split).
+  var dpTab = b.csv.parse("a\tb\nc\td");
+  check("DEFAULTS_PARSE: default delimiter is comma", dpTab[0]["a\tb"] === "c\td");
+  // parse enforces DEFAULTS_PARSE.maxBytes: input at the exact cap parses;
+  // one byte over is refused with csv/too-large. maxFieldBytes stays well
+  // above the tiny fixture so only the byte cap under test can fire.
+  var underCap = "h\n" + "a".repeat(dp.maxBytes - 2);              // exactly maxBytes
+  check("DEFAULTS_PARSE: input at maxBytes parses",
+        b.csv.parse(underCap, { maxFieldBytes: dp.maxBytes }).length === 1);
+  var overThrew = null;
+  try { b.csv.parse(underCap + "a"); } catch (e) { overThrew = e; }
+  check("DEFAULTS_PARSE: input over maxBytes refused",
+        !!overThrew && /csv\/too-large/.test(overThrew.code || ""));
+
+  // ---- DEFAULTS_STRINGIFY — documented values + stringify honors them ----
+  var ds = b.csv.DEFAULTS_STRINGIFY;
+  check("DEFAULTS_STRINGIFY.header defaults true", ds.header === true);
+  check("DEFAULTS_STRINGIFY.delimiter is comma",   ds.delimiter === ",");
+  check("DEFAULTS_STRINGIFY.eol is CRLF",          ds.eol === "\r\n");
+  check("DEFAULTS_STRINGIFY.quote is double-quote",ds.quote === "\"");
+  check("DEFAULTS_STRINGIFY.alwaysQuote false",    ds.alwaysQuote === false);
+  check("DEFAULTS_STRINGIFY.columns defaults null",ds.columns === null);
+
+  // stringify honors DEFAULTS_STRINGIFY.eol (CRLF) + header:true + no-quote.
+  var dsOut = b.csv.stringify([{ a: "1", bee: "2" }]);
+  var dsLines = dsOut.split(b.csv.DEFAULTS_STRINGIFY.eol);
+  check("DEFAULTS_STRINGIFY: default eol splits into header+row",
+        dsLines.length === 2 && dsLines[0] === "a,bee" && dsLines[1] === "1,2");
+  check("DEFAULTS_STRINGIFY: default eol is literally CRLF",
+        dsOut.indexOf("\r\n") !== -1);
+  // alwaysQuote:false default → a plain cell is emitted bare.
+  check("DEFAULTS_STRINGIFY: default alwaysQuote false leaves plain cell unquoted",
+        b.csv.stringify([{ a: "plain" }]).indexOf("\"") === -1);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/daemon.test.js

@@ -191,19 +191,477 @@ async function testDaemonStaleCleanupOnStartReap() {
   }
 }
 
+function testDaemonStartRejectsMalformedOptTypes() {
+  var threw = null;
+  try { b.daemon.start({ pidFile: "/tmp/x.pid", logFile: 123 }); } catch (e) { threw = e; }
+  check("start(): non-string logFile -> daemon/bad-log-file",
+        threw && /daemon\/bad-log-file/.test(threw.code || ""));
+
+  threw = null;
+  try { b.daemon.start({ pidFile: "/tmp/x.pid", command: 123 }); } catch (e) { threw = e; }
+  check("start(): non-string command -> daemon/bad-command",
+        threw && /daemon\/bad-command/.test(threw.code || ""));
+
+  threw = null;
+  try { b.daemon.start({ pidFile: "/tmp/x.pid", command: "/bin/true", args: "not-an-array" }); }
+  catch (e) { threw = e; }
+  check("start(): non-array args -> daemon/bad-args",
+        threw && /daemon\/bad-args/.test(threw.code || ""));
+
+  threw = null;
+  try { b.daemon.start({ pidFile: "/tmp/x.pid", signals: "SIGTERM" }); } catch (e) { threw = e; }
+  check("start(): non-array signals -> daemon/bad-signals",
+        threw && /daemon\/bad-signals/.test(threw.code || ""));
+
+  threw = null;
+  try { b.daemon.start({ pidFile: "/tmp/x.pid", signals: ["SIGTERM", ""] }); } catch (e) { threw = e; }
+  check("start(): empty-string signal element -> daemon/bad-signals",
+        threw && /daemon\/bad-signals/.test(threw.code || ""));
+
+  threw = null;
+  try { b.daemon.start({ pidFile: "/tmp/x.pid", bogusOpt: true }); } catch (e) { threw = e; }
+  check("start(): unknown opt refused by exhaustive shape",
+        threw && /daemon\/bad-opts/.test(threw.code || ""));
+}
+
+// The documented `cwd` opt (foreground-agnostic; forwarded to the detached
+// child's spawn) must be accepted and threaded through to processSpawn. It
+// was rejected by the exhaustive opts shape (undeclared field) despite being
+// advertised in @opts — a passing operator call threw daemon/bad-opts.
+async function testDaemonStartForwardsCwdToDetachedChild() {
+  var pidFile = _tmpFile("cwd.pid");
+  var chosenCwd = _tmpBase;
+  var origSpawn = processSpawn.spawn;
+  var captured = null;
+  processSpawn.spawn = function (cmd, args, opts) {
+    captured = { cmd: cmd, args: args, opts: opts };
+    return { pid: 515151, unref: function () {}, on: function () {} };
+  };
+  try {
+    var r = b.daemon.start({
+      pidFile: pidFile,
+      command: process.execPath,
+      args:    ["-e", "process.exit(0)"],
+      cwd:     chosenCwd,
+    });
+    check("cwd: documented opt accepted (no daemon/bad-opts)", r.pid === 515151);
+    check("cwd: forwarded to processSpawn opts.cwd", captured && captured.opts.cwd === chosenCwd);
+  } finally {
+    processSpawn.spawn = origSpawn;
+    try { fs.unlinkSync(pidFile); } catch (_e) { /* best-effort */ }
+  }
+}
+
+async function testDaemonStopRejectsMalformedNumericOpts() {
+  async function expect(opts, codeRe, label) {
+    var threw = null;
+    try { await b.daemon.stop(opts); } catch (e) { threw = e; }
+    check(label, threw && codeRe.test(threw.code || ""));
+  }
+  await expect({ pidFile: "/tmp/x.pid", signal: 123 }, /daemon\/bad-signal/,
+    "stop(): non-string signal -> daemon/bad-signal");
+  await expect({ pidFile: "/tmp/x.pid", timeoutMs: -1 }, /daemon\/bad-timeout/,
+    "stop(): negative timeoutMs -> daemon/bad-timeout");
+  await expect({ pidFile: "/tmp/x.pid", timeoutMs: 0 }, /daemon\/bad-timeout/,
+    "stop(): zero timeoutMs -> daemon/bad-timeout");
+  await expect({ pidFile: "/tmp/x.pid", timeoutMs: 1.5 }, /daemon\/bad-timeout/,
+    "stop(): non-integer timeoutMs -> daemon/bad-timeout");
+  await expect({ pidFile: "/tmp/x.pid", timeoutMs: Infinity }, /daemon\/bad-timeout/,
+    "stop(): Infinity timeoutMs -> daemon/bad-timeout");
+  await expect({ pidFile: "/tmp/x.pid", pollMs: -5 }, /daemon\/bad-poll/,
+    "stop(): negative pollMs -> daemon/bad-poll");
+  await expect({ pidFile: "/tmp/x.pid", pollMs: NaN }, /daemon\/bad-poll/,
+    "stop(): NaN pollMs -> daemon/bad-poll");
+}
+
+// stop() drives process.kill through three failure/edge branches that can't
+// be reached with a real long-lived child inside smoke. We stub the global
+// kill seam (restored in finally) to steer each branch deterministically.
+// These edge branches are the POSIX signal path: on Windows process.kill maps
+// any real signal to TerminateProcess, so stop() drives the cooperative
+// stop-request sentinel instead (SIGTERM→ESRCH→SIGKILL has no analogue there).
+// The Windows cooperative + terminate branches are covered by
+// testDaemonStopWin32CooperativeStop.
+async function testDaemonStopKillRaceAndEscalation() {
+  if (process.platform === "win32") {
+    check("kill-race edge branches are POSIX-only (win32 uses cooperative stop)", true);
+    return;
+  }
+  var origKill = process.kill;
+
+  // (1) Target dies between pidfile read and the first signal (ESRCH on the
+  //     real kill) -> reported stopped=true with the original signal, pidfile
+  //     cleaned, no escalation.
+  var pidFile = _tmpFile("race.pid");
+  fs.writeFileSync(pidFile, "4242\n");
+  process.kill = function (pid, sig) {
+    if (sig === 0) return true;                 // liveness probe: alive
+    var err = new Error("no such process"); err.code = "ESRCH"; throw err;
+  };
+  try {
+    var r1 = await b.daemon.stop({ pidFile: pidFile, signal: "SIGTERM" });
+    check("stop(): ESRCH between read+kill -> stopped=true", r1.stopped === true);
+    check("stop(): ESRCH race keeps original signal",        r1.signal === "SIGTERM");
+    check("stop(): ESRCH race did not escalate",             r1.escalated === undefined);
+    check("stop(): ESRCH race cleaned pidfile",              !fs.existsSync(pidFile));
+  } finally { process.kill = origKill; }
+
+  // (2) kill() fails with a non-ESRCH error (e.g. EINVAL bad signal name) ->
+  //     surfaced as a typed daemon/kill-failed, never an uncaught throw.
+  var pidFile2 = _tmpFile("killfail.pid");
+  fs.writeFileSync(pidFile2, "4243\n");
+  process.kill = function (pid, sig) {
+    if (sig === 0) return true;
+    var err = new Error("invalid signal"); err.code = "EINVAL"; throw err;
+  };
+  var threw = null;
+  try { await b.daemon.stop({ pidFile: pidFile2, signal: "SIGTERM" }); }
+  catch (e) { threw = e; }
+  finally { process.kill = origKill; }
+  check("stop(): non-ESRCH kill error -> daemon/kill-failed",
+        threw && /daemon\/kill-failed/.test(threw.code || ""));
+  try { fs.unlinkSync(pidFile2); } catch (_e) { /* best-effort */ }
+
+  // (3) Target ignores SIGTERM past timeoutMs -> escalate to SIGKILL. The stub
+  //     reports the pid alive until SIGKILL lands, then dead.
+  var pidFile3 = _tmpFile("escalate.pid");
+  fs.writeFileSync(pidFile3, "4244\n");
+  var killed = false;
+  process.kill = function (pid, sig) {
+    if (sig === 0) {
+      if (killed) { var e = new Error("gone"); e.code = "ESRCH"; throw e; }
+      return true;
+    }
+    if (sig === "SIGKILL") { killed = true; return true; }
+    return true;   // SIGTERM: swallowed, process keeps running
+  };
+  try {
+    var r3 = await b.daemon.stop({ pidFile: pidFile3, signal: "SIGTERM", timeoutMs: 20, pollMs: 5 });
+    check("stop(): unresponsive child escalates -> escalated=true", r3.escalated === true);
+    check("stop(): escalation reports signal=SIGKILL",              r3.signal === "SIGKILL");
+    check("stop(): escalation cleaned pidfile",                     !fs.existsSync(pidFile3));
+  } finally {
+    process.kill = origKill;
+    try { fs.unlinkSync(pidFile3); } catch (_e) { /* best-effort */ }
+  }
+}
+
+// Foreground start with a logFile opens an O_NOFOLLOW append fd (mode 0600)
+// and redirects the current process's stdout/stderr to it. Verify the
+// redirect actually routes writes into the log — restoring the real writers
+// before any assertion so the harness output is never swallowed.
+async function testDaemonForegroundLogRedirect() {
+  var pidFile = _tmpFile("fg-log.pid");
+  var logFile = _tmpFile("fg-log.log");
+  var origOut = process.stdout.write;
+  var origErr = process.stderr.write;
+  var r = null;
+  try {
+    r = b.daemon.start({ pidFile: pidFile, logFile: logFile, signals: ["SIGUSR2"] });
+    process.stdout.write("daemon-redirect-probe-out\n");
+    process.stderr.write("daemon-redirect-probe-err\n");
+  } finally {
+    process.stdout.write = origOut;
+    process.stderr.write = origErr;
+  }
+  try {
+    check("fg+log: mode=foreground", r && r.mode === "foreground");
+    check("fg+log: logFile created", fs.existsSync(logFile));
+    var mode = fs.statSync(logFile).mode & 0o777;
+    // Windows fs collapses POSIX perm bits; only assert the strict mode on POSIX.
+    if (process.platform !== "win32") {
+      check("fg+log: logFile mode is 0600", mode === 0o600);
+    }
+    var content = fs.readFileSync(logFile, "utf8");
+    check("fg+log: stdout redirected into logFile",
+          content.indexOf("daemon-redirect-probe-out") !== -1);
+    check("fg+log: stderr redirected into logFile",
+          content.indexOf("daemon-redirect-probe-err") !== -1);
+  } finally {
+    if (r) { await r.orchestrator.shutdown(); r.orchestrator._resetForTest(); }
+    b.daemon._resetForTest();
+    try { fs.unlinkSync(pidFile); } catch (_e) { /* best-effort */ }
+    try { fs.unlinkSync(logFile); } catch (_e) { /* best-effort */ }
+  }
+}
+
+// Foreground start where the logFile cannot be opened (a path component is a
+// regular file, so ensureDir/open throws) must release the just-acquired
+// pidLock and surface daemon/log-open-failed — not leak the lock.
+async function testDaemonForegroundLogOpenFailedReleasesLock() {
+  var pidFile = _tmpFile("fg-openfail.pid");
+  var blocker = _tmpFile("blocker-file");
+  fs.writeFileSync(blocker, "x");                 // a file, not a directory
+  var logFile = path.join(blocker, "cannot", "here.log");
+  var threw = null;
+  try {
+    b.daemon.start({ pidFile: pidFile, logFile: logFile, signals: ["SIGUSR2"] });
+  } catch (e) { threw = e; }
+  check("fg+log-open-fail: surfaced as daemon/log-open-failed",
+        threw && /daemon\/log-open-failed/.test(threw.code || ""));
+  check("fg+log-open-fail: pidLock released (pidFile gone)", !fs.existsSync(pidFile));
+  // Lock is free again: a second start on the same pidFile must succeed.
+  var r2 = null;
+  try {
+    r2 = b.daemon.start({ pidFile: pidFile, signals: ["SIGUSR2"] });
+    check("fg+log-open-fail: pidFile reusable after failure", r2.mode === "foreground");
+  } finally {
+    if (r2) { await r2.orchestrator.shutdown(); r2.orchestrator._resetForTest(); }
+    b.daemon._resetForTest();
+    try { fs.unlinkSync(pidFile); } catch (_e) { /* best-effort */ }
+    try { fs.unlinkSync(blocker); } catch (_e) { /* best-effort */ }
+  }
+}
+
+// #498 — daemon.status(): a READ-ONLY PID-liveness probe. Unlike stop() it
+// never unlinks the pidfile (a status check must not mutate the daemon's
+// lifecycle state), returns { running, pid, reason? }, and refuses hostile
+// pidfiles (symlink / oversized) as not-running rather than throwing.
+async function testDaemonStatusReadOnlyProbe() {
+  check("status: b.daemon.status is a function", typeof b.daemon.status === "function");
+  if (typeof b.daemon.status !== "function") return;   // remaining asserts need the export
+
+  // Missing pidfile -> not running, no pid.
+  var missing = _tmpFile("status-missing.pid");
+  var s1 = b.daemon.status({ pidFile: missing });
+  check("status: missing -> running=false",       s1.running === false);
+  check("status: missing -> pid=null",            s1.pid === null);
+  check("status: missing -> reason=no-pidfile",   s1.reason === "no-pidfile");
+
+  // Live (our own PID, guaranteed alive) -> running with our pid.
+  var livePid = _tmpFile("status-live.pid");
+  fs.writeFileSync(livePid, String(process.pid) + "\n");
+  var s2 = b.daemon.status({ pidFile: livePid });
+  check("status: live -> running=true",           s2.running === true);
+  check("status: live -> pid = our pid",          s2.pid === process.pid);
+  check("status: live pidfile NOT unlinked (read-only)", fs.existsSync(livePid));
+  try { fs.unlinkSync(livePid); } catch (_e) { /* best-effort */ }
+
+  // Stale (dead PID) -> not running, reason=stale, AND pidfile left in place.
+  var stalePid = _tmpFile("status-stale.pid");
+  fs.writeFileSync(stalePid, "999999\n");
+  var s3 = b.daemon.status({ pidFile: stalePid });
+  check("status: stale -> running=false",         s3.running === false);
+  check("status: stale -> pid=999999",            s3.pid === 999999);
+  check("status: stale -> reason=stale",          s3.reason === "stale");
+  check("status: stale pidfile NOT unlinked (read-only)", fs.existsSync(stalePid));
+  try { fs.unlinkSync(stalePid); } catch (_e) { /* best-effort */ }
+
+  // Oversized pidfile (> 1 KiB cap) -> refused as not-running, never throws.
+  var oversized = _tmpFile("status-oversized.pid");
+  fs.writeFileSync(oversized, "1".repeat(2048));
+  var s4 = null, s4Threw = null;
+  try { s4 = b.daemon.status({ pidFile: oversized }); } catch (e) { s4Threw = e; }
+  check("status: oversized pidfile does not throw", s4Threw === null);
+  check("status: oversized pidfile -> running=false", s4 && s4.running === false);
+  try { fs.unlinkSync(oversized); } catch (_e) { /* best-effort */ }
+
+  // Symlink pidfile -> refused (O_NOFOLLOW) as not-running, never throws.
+  // Windows may lack symlink-create privilege; skip the case if so.
+  var symTarget = _tmpFile("status-symtarget.pid");
+  fs.writeFileSync(symTarget, String(process.pid) + "\n");
+  var symLink = _tmpFile("status-symlink.pid");
+  var symMade = false;
+  try { fs.symlinkSync(symTarget, symLink); symMade = true; } catch (_e) { /* no symlink priv */ }
+  if (symMade) {
+    var s5 = null, s5Threw = null;
+    try { s5 = b.daemon.status({ pidFile: symLink }); } catch (e) { s5Threw = e; }
+    check("status: symlink pidfile does not throw", s5Threw === null);
+    check("status: symlink pidfile -> running=false (refused)", s5 && s5.running === false);
+    try { fs.unlinkSync(symLink); } catch (_e) { /* best-effort */ }
+  } else {
+    check("status: symlink case skipped (no symlink privilege)", true);
+  }
+  try { fs.unlinkSync(symTarget); } catch (_e) { /* best-effort */ }
+
+  // Bad opts -> config-time throw (same code the start/stop validators use).
+  var badThrew = null;
+  try { b.daemon.status({}); } catch (e) { badThrew = e; }
+  check("status: bad opts -> daemon/bad-pid-file",
+        badThrew && /daemon\/bad-pid-file/.test(badThrew.code || ""));
+}
+
+// #499 — a detached spawn that fails ASYNC leaves child.pid === undefined; the
+// try/catch only wraps the SYNCHRONOUS spawn call, so the old path wrote
+// "undefined\n" to the pidfile and reported success unconditionally. start()
+// must validate child.pid BEFORE any pidfile write and throw daemon/spawn-failed.
+async function testDaemonStartDetachedSpawnFailureUndefinedPid() {
+  var pidFile = _tmpFile("spawnfail.pid");
+  var origSpawn = processSpawn.spawn;
+  processSpawn.spawn = function () {
+    // Model an async spawn failure: the OS never launched the exec, so the
+    // returned child object carries no pid (the real failure arrives later
+    // via a 'error' event).
+    return { pid: undefined, unref: function () {}, on: function () {} };
+  };
+  var threw = null;
+  try {
+    b.daemon.start({ pidFile: pidFile, command: "/nonexistent/cmd", args: [] });
+  } catch (e) { threw = e; }
+  finally { processSpawn.spawn = origSpawn; }
+  check("spawn-fail: undefined child.pid -> daemon/spawn-failed",
+        threw && /daemon\/spawn-failed/.test(threw.code || ""));
+  check("spawn-fail: pidfile NOT written with 'undefined'",
+        !fs.existsSync(pidFile) ||
+        String(fs.readFileSync(pidFile, "utf8")).trim() !== "undefined");
+  try { fs.unlinkSync(pidFile); } catch (_e) { /* best-effort */ }
+}
+
+// #499 — a valid detached spawn must subscribe a one-shot child 'error' handler
+// so an async launch failure after a valid initial pid still reaps the pidfile
+// + audits, instead of leaving a stale sidecar for a child that never ran.
+async function testDaemonStartDetachedSubscribesErrorHandler() {
+  var pidFile = _tmpFile("spawn-errsub.pid");
+  var origSpawn = processSpawn.spawn;
+  var subscribed = Object.create(null);
+  processSpawn.spawn = function () {
+    return {
+      pid:   434343,
+      unref: function () {},
+      on:    function (event) { subscribed[event] = true; },
+    };
+  };
+  try {
+    var r = b.daemon.start({ pidFile: pidFile, command: process.execPath, args: ["-e", "0"] });
+    check("spawn-errsub: detached start succeeded with valid pid", r.pid === 434343);
+    check("spawn-errsub: start subscribed a child 'error' handler", subscribed.error === true);
+  } finally {
+    processSpawn.spawn = origSpawn;
+    try { fs.unlinkSync(pidFile); } catch (_e) { /* best-effort */ }
+  }
+}
+
+// #500 — on win32 process.kill(pid, "SIGTERM") maps to TerminateProcess (a hard
+// kill), so the graceful appShutdown orchestration is unreachable via signals.
+// stop() must instead write a cooperative <pidFile>.stop sentinel, poll for the
+// daemon to exit, and escalate to TerminateProcess ONLY on timeout — reporting
+// a `mechanism` that distinguishes the cooperative exit from the forced one.
+async function testDaemonStopWin32CooperativeStop() {
+  if (process.platform !== "win32") {
+    check("cooperative-stop test skipped on non-win32 (POSIX uses signals)", true);
+    return;
+  }
+  var origKill = process.kill;
+
+  // (A) Cooperative: the daemon exits once it observes the stop-request file.
+  var pidFile  = _tmpFile("coop.pid");
+  var sentinel = pidFile + ".stop";
+  fs.writeFileSync(pidFile, "5252\n");
+  var terminatedA = false;
+  process.kill = function (pid, sig) {
+    if (sig === 0) {
+      // Liveness probe: model a cooperative daemon that exits the moment it
+      // sees the sentinel stop() writes.
+      if (fs.existsSync(sentinel)) { var e = new Error("gone"); e.code = "ESRCH"; throw e; }
+      return true;
+    }
+    terminatedA = true;             // any real signal on win32 = TerminateProcess
+    return true;
+  };
+  try {
+    var rA = await b.daemon.stop({ pidFile: pidFile, timeoutMs: 2000, pollMs: 5 });
+    check("win32 stop: cooperative graceful exit -> stopped=true", rA.stopped === true);
+    check("win32 stop: mechanism=cooperative",                     rA.mechanism === "cooperative");
+    check("win32 stop: no hard TerminateProcess on graceful exit", terminatedA === false);
+    check("win32 stop: cooperative did not escalate",              rA.escalated === undefined);
+    check("win32 stop: sentinel cleaned up",                       !fs.existsSync(sentinel));
+    check("win32 stop: pidfile cleaned up",                        !fs.existsSync(pidFile));
+  } finally {
+    process.kill = origKill;
+    try { fs.unlinkSync(pidFile); } catch (_e) { /* best-effort */ }
+    try { fs.unlinkSync(sentinel); } catch (_e) { /* best-effort */ }
+  }
+
+  // (B) Forced: the daemon ignores the sentinel past the timeout -> escalate to
+  // TerminateProcess, reported as mechanism=terminate + escalated=true.
+  var pidFile2  = _tmpFile("coop-forced.pid");
+  var sentinel2 = pidFile2 + ".stop";
+  fs.writeFileSync(pidFile2, "5253\n");
+  var terminatedB = false;
+  process.kill = function (pid, sig) {
+    if (sig === 0) {
+      if (terminatedB) { var e = new Error("gone"); e.code = "ESRCH"; throw e; }
+      return true;                  // stays alive despite the sentinel
+    }
+    terminatedB = true;             // TerminateProcess escalation
+    return true;
+  };
+  try {
+    var rB = await b.daemon.stop({ pidFile: pidFile2, timeoutMs: 30, pollMs: 5 });
+    check("win32 stop: unresponsive daemon escalates -> escalated=true", rB.escalated === true);
+    check("win32 stop: mechanism=terminate on escalation",               rB.mechanism === "terminate");
+    check("win32 stop: TerminateProcess invoked on timeout",             terminatedB === true);
+    check("win32 stop: forced path cleaned pidfile",                     !fs.existsSync(pidFile2));
+    check("win32 stop: forced path cleaned sentinel",                    !fs.existsSync(sentinel2));
+  } finally {
+    process.kill = origKill;
+    try { fs.unlinkSync(pidFile2); } catch (_e) { /* best-effort */ }
+    try { fs.unlinkSync(sentinel2); } catch (_e) { /* best-effort */ }
+  }
+}
+
+// #500 — the other half of the cooperative channel: a foreground start() on
+// win32 must install a watcher on the sibling <pidFile>.stop sentinel so a
+// stop() from another process routes into the SAME appShutdown orchestrator the
+// POSIX signal path uses.
+async function testDaemonStartWin32CooperativeStopWatcher() {
+  if (process.platform !== "win32") {
+    check("cooperative stop-watcher test skipped on non-win32", true);
+    return;
+  }
+  var pidFile  = _tmpFile("coop-fg.pid");
+  var sentinel = pidFile + ".stop";
+  var r = b.daemon.start({ pidFile: pidFile, signals: ["SIGUSR2"] });
+  try {
+    check("coop-watcher: foreground start returned", r && r.mode === "foreground");
+    // Model daemon.stop()'s cooperative request by writing the sentinel.
+    fs.writeFileSync(sentinel, String(process.pid) + "\n");
+    await helpers.waitUntil(function () { return r.orchestrator.draining() === true; },
+      { timeoutMs: 5000, label: "coop-watcher: sentinel triggers orchestrator shutdown" });
+    check("coop-watcher: sentinel routed into graceful shutdown",
+          r.orchestrator.draining() === true);
+  } finally {
+    try { await r.orchestrator.shutdown(); } catch (_e) { /* best-effort */ }
+    r.orchestrator._resetForTest();
+    b.daemon._resetForTest();
+    try { fs.unlinkSync(pidFile); } catch (_e) { /* best-effort */ }
+    try { fs.unlinkSync(sentinel); } catch (_e) { /* best-effort */ }
+  }
+}
+
 async function run() {
   testDaemonSurface();
   testDaemonStartRejectsBadOpts();
+  testDaemonStartRejectsMalformedOptTypes();
+  await testDaemonStartForwardsCwdToDetachedChild();
   await testDaemonStopRejectsBadOpts();
+  await testDaemonStopRejectsMalformedNumericOpts();
   await testDaemonStopOnMissingPidfile();
   await testDaemonStopReapsStalePid();
+  await testDaemonStopKillRaceAndEscalation();
   await testDaemonStartDetachedSpawn();
   await testDaemonStartRejectsLivePidfile();
   await testDaemonStartForegroundAcquiresLock();
+  await testDaemonForegroundLogRedirect();
+  await testDaemonForegroundLogOpenFailedReleasesLock();
   await testDaemonStaleCleanupOnStartReap();
+  await testDaemonStatusReadOnlyProbe();
+  await testDaemonStartDetachedSpawnFailureUndefinedPid();
+  await testDaemonStartDetachedSubscribesErrorHandler();
+  await testDaemonStopWin32CooperativeStop();
+  await testDaemonStartWin32CooperativeStopWatcher();
 }
 
-module.exports = { run: run };
+module.exports = {
+  run: run,
+  _tests: {
+    testDaemonStatusReadOnlyProbe:                  testDaemonStatusReadOnlyProbe,
+    testDaemonStartDetachedSpawnFailureUndefinedPid: testDaemonStartDetachedSpawnFailureUndefinedPid,
+    testDaemonStartDetachedSubscribesErrorHandler:  testDaemonStartDetachedSubscribesErrorHandler,
+    testDaemonStopWin32CooperativeStop:             testDaemonStopWin32CooperativeStop,
+    testDaemonStartWin32CooperativeStopWatcher:     testDaemonStartWin32CooperativeStopWatcher,
+  },
+};
 
 if (require.main === module) {
   run().then(

package/lib/vendor/blamejs/test/layer-0-primitives/dark-patterns.test.js

@@ -63,6 +63,25 @@ async function run() {
   try { b.darkPatterns.assertParity(s, { kind: "cancel", resourceId: "different" }); }
   catch (e) { threw = e; }
   check("assertParity refuses resource mismatch", threw && threw.code === "dark-patterns/resource-mismatch");
+
+  // Prototype-member name as posture must be refused, not resolved to an
+  // inherited member. Drive with VALID, resourceId-matched flows (s and c both
+  // carry "plan-1") so the posture own-property guard is the assertion point —
+  // not an earlier shape or resource-mismatch check. A bare `POSTURES[name]`
+  // truthiness guard would let "constructor" / "__proto__" / "toString" resolve
+  // to an inherited member and run the parity check under it (fail-open).
+  ["constructor", "__proto__", "toString"].forEach(function (protoKey) {
+    var pkThrew = null;
+    try { b.darkPatterns.assertParity(s, c, { posture: protoKey }); }
+    catch (e) { pkThrew = e; }
+    check("assertParity refuses prototype-key posture '" + protoKey + "'",
+      pkThrew && pkThrew.code === "dark-patterns/bad-posture");
+  });
+
+  // A valid posture still produces a verdict.
+  var okVerdict = b.darkPatterns.assertParity(s, c, { posture: "ftc-2024" });
+  check("assertParity valid posture produces verdict",
+    okVerdict && typeof okVerdict.ok === "boolean");
 }
 
 module.exports = { run: run };