@crouton-kit/crouter 0.3.18 → 0.3.19

package/dist/core/__tests__/broker-sdk-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/broker-sdk-wiring.test.js

@@ -0,0 +1,166 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/broker-sdk-wiring.test.ts
+//
+// REAL-SDK regression tests for the latent broker gaps the viewer-reuse scout
+// (node mq5thyli) found (findings-viewer-reuse.md §Q2). These deliberately drive
+// the ACTUAL `@earendil-works/pi-coding-agent` SDK — NOT the `CRTR_BROKER_ENGINE`
+// fake the lifecycle suite uses — because C3 and C4 slipped past the Phase-3 gate
+// PRECISELY because that gate mocked the SDK out. Each test exercises the exact
+// production wiring (`buildBrokerSession` / `makeBrokerUiContext`) and would FAIL
+// against the pre-fix broker:
+//
+//   C3 — the broker drives the SERVICES path, so an extension-registered custom
+//        model provider is registered into the ModelRegistry and resolves onto
+//        the session. Plain createAgentSession never calls registerProvider, so a
+//        custom-provider node would get NO model.
+//   C4 — a project AGENTS.md is injected into the assembled system prompt (the
+//        services path loads project context; 0.78.1 has no project-trust gate so
+//        context is unconditionally loaded — see buildBrokerSession's C4 note).
+//   C2 — with ZERO viewers attached, the broker UI context resolves confirm() /
+//        select() / input() / editor() to deny/cancel IMMEDIATELY (noOp), instead
+//        of relying on a per-dialog timeout and hanging the agent turn forever.
+//
+// These run offline (no network/auth): registration + system-prompt assembly +
+// dialog routing are all local. No tmux, no broker process — direct unit drives.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createAgentSessionServices, createAgentSessionFromServices, SessionManager, VERSION, } from '../runtime/broker-sdk.js';
+import { buildBrokerSession, makeBrokerUiContext } from '../runtime/broker.js';
+// The REAL engine, assembled from broker-sdk's static SDK re-exports — bypasses
+// the CRTR_BROKER_ENGINE seam entirely so these tests can never accidentally hit
+// the fake (the whole point: prove the wiring the mock hid).
+const realEngine = {
+    createAgentSessionServices,
+    createAgentSessionFromServices,
+    SessionManager,
+    VERSION,
+};
+const HERE = dirname(fileURLToPath(import.meta.url));
+const C3_EXT = join(HERE, 'fixtures', 'c3-custom-provider-ext.ts');
+function cfg(cwd, extra = {}) {
+    return { cwd, extensionPaths: [], ...extra };
+}
+// ===========================================================================
+// C3 — the SERVICES path registers an extension's custom model provider, so the
+// broker resolves a model that plain createAgentSession (no registerProvider)
+// would never see.
+// ===========================================================================
+test('C3 — services path registers an extension model provider; the broker session gets it', async () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'crtr-c3-'));
+    try {
+        const { session, services } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT], model: 'c3prov/c3model' }));
+        try {
+            // The extension's provider was registered into the SERVICES registry (this
+            // is the registerProvider step plain createAgentSession skips).
+            const found = services.modelRegistry.find('c3prov', 'c3model');
+            assert.ok(found, 'C3: extension-registered model is present in the services ModelRegistry');
+            assert.equal(found.provider, 'c3prov', 'C3: provider name round-trips');
+            assert.equal(found.id, 'c3model', 'C3: model id round-trips');
+            // …and the broker resolved it onto the session AGAINST the services registry
+            // (a fresh ModelRegistry would have returned undefined → no model).
+            assert.equal(session.model?.id, 'c3model', 'C3: the broker session got the custom-provider model');
+        }
+        finally {
+            session.dispose();
+        }
+    }
+    finally {
+        rmSync(cwd, { recursive: true, force: true });
+    }
+});
+// ===========================================================================
+// C4 — project context (AGENTS.md) is injected into the system prompt. The
+// services path loads project context files; on the 0.78.1 pin there is no
+// project-trust gate, so they load unconditionally (and buildBrokerSession does
+// NOT re-introduce the CLI's headless trust resolver, which would drop them).
+// ===========================================================================
+test('C4 — a project AGENTS.md is injected into the assembled system prompt', async () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'crtr-c4-'));
+    try {
+        const marker = 'C4_AGENTS_MARKER_' + Math.random().toString(36).slice(2);
+        writeFileSync(join(cwd, 'AGENTS.md'), `# Project rules\n\n${marker}\n`);
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd));
+        try {
+            assert.ok(session.systemPrompt.includes(marker), 'C4: project AGENTS.md content is present in the assembled system prompt');
+        }
+        finally {
+            session.dispose();
+        }
+    }
+    finally {
+        rmSync(cwd, { recursive: true, force: true });
+    }
+});
+// ===========================================================================
+// C2 — zero-viewer dialogs resolve to deny/cancel IMMEDIATELY (noOp), never
+// hanging the turn and never waiting on a per-dialog timeout. Drives the REAL
+// makeBrokerUiContext (the exact ExtensionUIContext the SDK hands extensions),
+// with a controller() that reports zero viewers.
+// ===========================================================================
+test('C2 — zero-viewer UI context resolves dialogs to deny/cancel immediately (noOp, no hang)', async () => {
+    const ctx = makeBrokerUiContext({
+        controller: () => null, // ZERO viewers attached
+        forward: () => {
+            throw new Error('C2: must NOT forward a dialog when no controller is attached');
+        },
+        pending: new Map(),
+    });
+    // confirm() WITH a large timeout: the fix must resolve at once (deny), NOT after
+    // the timeout — the old timeout-reliant path would have waited 60s (or, with no
+    // timeout, hung forever). Race against a 2s "HANG" sentinel to make a regression
+    // a hard failure rather than a slow pass.
+    const start = Date.now();
+    const confirmed = await Promise.race([
+        ctx.confirm('proceed?', 'really?', { timeout: 60_000 }),
+        new Promise((r) => setTimeout(() => r('HANG'), 2_000)),
+    ]);
+    assert.equal(confirmed, false, 'C2: confirm() denies (false) with zero viewers');
+    assert.ok(Date.now() - start < 1_000, 'C2: resolved immediately, not after the 60s timeout');
+    // The other blocking dialogs cancel to undefined — including editor(), which
+    // takes NO opts at all (so it could never carry a timeout to lean on).
+    assert.equal(await ctx.select('pick', ['a', 'b']), undefined, 'C2: select() cancels (undefined)');
+    assert.equal(await ctx.input('name'), undefined, 'C2: input() cancels (undefined)');
+    assert.equal(await ctx.editor('edit'), undefined, 'C2: editor() cancels (undefined)');
+});
+// ===========================================================================
+// M2 (review mq5wkqep / T4) — REPLACES the Wave-0 M-1 cancel-on-detach. A dialog
+// forwarded to a controller that then DETACHES must NOT be cancelled: it stays
+// pending so a brief detach/reattach (or a handoff to another controller) does
+// not lose an answerable dialog. The broker-side default timeout is the ONLY
+// non-answer resolution (proven here with a short per-dialog timeout standing in
+// for the 120s default). Guards against regressing to the over-eager cancel.
+// ===========================================================================
+test('M2 — a forwarded dialog stays pending on controller detach, resolving only on the broker-side timeout', async () => {
+    const pending = new Map();
+    let attached = true;
+    const ctx = makeBrokerUiContext({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        controller: () => (attached ? { id: 'c1' } : null),
+        forward: () => {
+            /* a real controller would receive the request over its socket */
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        pending: pending,
+    });
+    // Controller attached → confirm() forwards + registers a pending dialog (with the
+    // request retained for welcome.pending_dialog / re-route, T4) and does NOT
+    // resolve yet. A short per-dialog timeout stands in for the 120s broker default.
+    const p = ctx.confirm('proceed?', 'really?', { timeout: 80 });
+    assert.equal(pending.size, 1, 'M2: a forwarded dialog is pending while a controller is attached');
+    const entry = [...pending.values()][0];
+    assert.ok(entry.request, 'M2: the pending entry retains the request (welcome/re-route need it)');
+    assert.equal(entry.cancel, undefined, 'M2: there is no cancel-on-detach path anymore');
+    // Controller detaches → the dialog STAYS pending (the broker no longer cancels it).
+    attached = false;
+    assert.equal(pending.size, 1, 'M2: detach does NOT cancel the in-flight dialog');
+    // Only the broker-side timeout resolves it, to the SAFE default (deny).
+    const resolved = await Promise.race([
+        p,
+        new Promise((r) => setTimeout(() => r('HANG'), 2_000)),
+    ]);
+    assert.equal(resolved, false, 'M2: resolves to deny on the broker-side timeout, never hangs');
+    assert.equal(pending.size, 0, 'M2: the pending registry is drained after the timeout');
+});

package/dist/core/__tests__/cascade-close.test.js

@@ -134,13 +134,23 @@ test('cascade close: middle-node close reaps EXACTLY its subtree (canceled), anc
         // ASSERT 3 — EXCLUSIVE-SUBTREE OWNERSHIP: nothing ABOVE (A) and nothing
         // SIDEWAYS (S, G) was reaped. close(B) reaped EXACTLY B's own subtree.
         // ===================================================================
-        // Ancestor A — fully untouched: still the live resident root, inbox intact.
+        // Ancestor A — lifecycle untouched (still the live resident root), but A is
+        // the SURVIVING manager of the close-root B, so the wake doctrine fix WAKES
+        // it: a "child closed" notice is fanned to a manager OUTSIDE the closing set
+        // (D-1 — previously A heard nothing and a dormant A could hang forever).
         {
             const a = h.node(A);
             assert.equal(a.status, 'active', 'A (ancestor) still active — untouched by the cascade');
             assert.equal(a.lifecycle, 'resident', 'A still resident');
             assert.equal(a.intent ?? null, null, 'A intent untouched');
-            assert.deepEqual(h.inbox(A), aInboxBefore, "A's inbox is byte-for-byte intact across the close (cascade touches only closed nodes' inboxes)");
+            // A's PRIOR entries are preserved; exactly ONE new child-closed entry
+            // from the closed child B is appended (the doctrine wake).
+            const aInbox = h.inbox(A);
+            assert.deepEqual(aInbox.slice(0, aInboxBefore.length), aInboxBefore, "A's prior inbox entries are preserved across the close");
+            const added = aInbox.slice(aInboxBefore.length);
+            assert.equal(added.length, 1, 'exactly one new entry appended to the surviving manager A');
+            assert.equal(added[0].from, B, 'the new entry is from the closed child B');
+            assert.match(added[0].label, /closed/i, 'the new entry tells A its child B was closed');
         }
         // Sideways subtree S→G — wholly alive: status active AND real panes alive.
         for (const id of sideways) {

package/dist/core/__tests__/child-death-wake.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/child-death-wake.test.js

@@ -0,0 +1,245 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/child-death-wake.test.ts
+//
+// D-1 BUG REGRESSION + node/canvas LIFECYCLE — "the runtime wakes a dormant
+// parent on ANY terminal child outcome."
+//
+// The bug (D-1 finding, context/d1-finding.md): a parent that delegates and
+// then JUST STOPS — retaining its inbox-wait, arming no self-wake — was woken
+// ONLY when a child `push final`s or never boots. A child that crashes AFTER
+// booting, is daemon-finalized after a quiet turn, or is `node close`d marked
+// the child dead/done/canceled with NO push to the parent, so a purely-inbox-
+// waiting parent hung dormant forever. The wake doctrine ("delegate and stop;
+// the runtime wakes you") is only honest if EVERY terminal child outcome reaches
+// the parent — this locks that in.
+//
+// The fix fans a system inbox entry to subscribersOf(child) on three previously-
+// silent terminal outcomes — mirroring surfaceBootFailure:
+//   • daemon CRASH after boot   (crtrd pane-gone, mid-generation → 'dead')
+//   • daemon FINALIZE on quiet   (crtrd pane-gone, turn ended, nothing live → 'done')
+//   • `node close`               (close.ts, the surviving manager outside the set)
+//
+// THE CRUX (the whole risk): the wake must fire ONLY on genuine death/close —
+// NEVER on healthy dormancy. A child that ended its turn STILL waiting (an active
+// live grandchild, or a pending self-wake) is alive-and-dormant, not dead; waking
+// its parent then would re-create the spurious-wake storm the doctrine exists to
+// kill (the concrete case: a developer child that finished its edits, spawned its
+// own reviewer, and went dormant waiting on it — its parent must stay asleep).
+// The daemon draws that boundary EXACTLY where the stop-guard does:
+// hasActiveLiveSubscription || hasPendingSelfWake ⇒ healthy dormancy ⇒ release,
+// no wake.
+//
+// Faithful: REAL canvas data layer, REAL tmux panes, the REAL daemon decision
+// pass (superviseTick) and the REAL closeNode. The wake travels through the ONE
+// channel the d1-finding identified — an entry appended to the parent's
+// inbox.jsonl — so each direction asserts that channel: the system entry appears
+// (parent woken: its dormant pi is then revived by the daemon's second pass,
+// observed via a cycles bump) or it does NOT (parent stays asleep, cycles flat).
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createNode, getNode, subscribe } from '../canvas/canvas.js';
+import { armWake } from '../canvas/wakeups.js';
+import { closeDb } from '../canvas/db.js';
+import { readInboxSince } from '../feed/inbox.js';
+import { markBusy, clearBusy } from '../runtime/busy.js';
+import { closeNode } from '../runtime/close.js';
+import { superviseTick } from '../../daemon/crtrd.js';
+let home;
+function node(id, over = {}) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        ...over,
+    };
+}
+function hasTmux() {
+    return spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0;
+}
+/** A pid that is guaranteed dead. */
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
+}
+const cyclesOf = (id) => getNode(id)?.cycles ?? 0;
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-child-death-wake-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+/** Run `fn` with a real, live tmux session + its window's live `%pane_id`. The
+ *  PARENT occupies this (frozen) pane while pi-dead + idle-released — the
+ *  faithful shape of an unfocused dormant orchestrator the daemon's second pass
+ *  revives on an unseen inbox entry. */
+async function withLivePane(tag, fn) {
+    const session = `crtr-cdw-${process.pid}-${tag}`;
+    spawnSync('tmux', ['new-session', '-d', '-s', session, '-c', '/tmp', 'sleep 600']);
+    try {
+        const w = spawnSync('tmux', ['list-windows', '-t', session, '-F', '#{window_id}'], { encoding: 'utf8' });
+        const window = (w.stdout ?? '').trim().split('\n')[0];
+        const p = spawnSync('tmux', ['display-message', '-p', '-t', `${session}:${window}`, '#{pane_id}'], { encoding: 'utf8' });
+        const pane = (p.stdout ?? '').trim();
+        await fn(session, window, pane);
+    }
+    finally {
+        spawnSync('tmux', ['kill-session', '-t', session], { stdio: 'ignore' });
+    }
+}
+/** A guaranteed-DEAD pane id inside `window`: split a fresh pane, then kill it.
+ *  The window survives via its original pane. This is how a child's pane reads
+ *  "gone" to the daemon while the session/window are still alive. */
+function deadPaneIn(session, window) {
+    const sp = spawnSync('tmux', ['split-window', '-d', '-P', '-F', '#{pane_id}', '-t', `${session}:${window}`, 'sleep 600'], { encoding: 'utf8' });
+    const dead = (sp.stdout ?? '').trim();
+    spawnSync('tmux', ['kill-pane', '-t', dead], { stdio: 'ignore' });
+    return dead;
+}
+/** A dormant, unfocused PARENT: pi-dead, idle-released, frozen on the live pane,
+ *  home_session set so the daemon's second pass can revive it. */
+function dormantParent(id, session, window, pane) {
+    createNode(node(id, {
+        pane,
+        tmux_session: session,
+        window,
+        pi_pid: deadPid(),
+        pi_session_id: 'booted',
+        intent: 'idle-release',
+        status: 'idle',
+        home_session: session,
+    }));
+}
+// ===========================================================================
+// POSITIVE — a genuine terminal child outcome WAKES the dormant parent.
+// ===========================================================================
+test('CRASH after boot (mid-generation, pane gone) wakes the dormant inbox-waiting parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('crash', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true); // the spawn-time spine edge
+        markBusy('CHILD'); // pane died INSIDE a turn → genuine mid-run crash
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(getNode('CHILD').status, 'dead', 'CHILD crashed → dead');
+        // THE WAKE CHANNEL: a system entry from CHILD lands in PARENT's inbox.
+        const wake = readInboxSince('PARENT').find((e) => e.from === 'CHILD');
+        assert.ok(wake, 'crash fanned a system inbox entry to the dormant parent (mirrors surfaceBootFailure)');
+        assert.match(wake.label, /died/i, 'the entry tells the parent WHICH child died and how');
+        // END-TO-END: the dormant parent is REVIVED on the same tick (second pass).
+        assert.equal(cyclesOf('PARENT'), before + 1, 'dormant PARENT revived on the same tick — no longer hangs');
+        clearBusy('CHILD');
+    });
+});
+test('quiet-turn FINALIZE (pane gone, nothing live to wait for) wakes the dormant parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('finalize', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        // Booted, turn finished (NO busy marker), no live subscription, no pending
+        // self-wake → the daemon finalizes it (done): a dismissal of a finished node.
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true);
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(getNode('CHILD').status, 'done', 'CHILD finalized → done');
+        const wake = readInboxSince('PARENT').find((e) => e.from === 'CHILD');
+        assert.ok(wake, 'finalize fanned a system inbox entry to the dormant parent');
+        assert.match(wake.label, /without a final report/i, 'the entry tells the parent the child ended with no final');
+        assert.equal(cyclesOf('PARENT'), before + 1, 'dormant PARENT revived on the same tick');
+    });
+});
+test('node close of a child wakes its SURVIVING manager (the parent outside the closing set)', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('close', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const childPane = deadPaneIn(session, window); // any pane handle; closeNode tears it down
+        createNode(node('CHILD', {
+            pane: childPane, tmux_session: session, window,
+            pi_session_id: 'booted', status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true); // PARENT is a manager OUTSIDE the close set
+        // Closing CHILD: closingSet({CHILD}) cannot pull in PARENT (PARENT is a
+        // SUBSCRIBER of CHILD, never a descendant), so PARENT survives + must wake.
+        const res = closeNode('CHILD');
+        assert.deepEqual(res.closed, ['CHILD'], 'only CHILD is closed; PARENT spared');
+        assert.equal(getNode('CHILD').status, 'canceled', 'CHILD canceled by close');
+        const wake = readInboxSince('PARENT').find((e) => e.from === 'CHILD');
+        assert.ok(wake, 'node close fanned a child-closed entry to the surviving manager (D-1: previously none)');
+        assert.match(wake.label, /closed/i, 'the entry names the closed child');
+        // The dormant parent is then revived by the daemon's second pass.
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(cyclesOf('PARENT'), before + 1, 'dormant PARENT revived on the close entry — no longer hangs');
+    });
+});
+// ===========================================================================
+// NEGATIVE — HEALTHY DORMANCY must NOT wake the parent (the correctness crux).
+// ===========================================================================
+test('CRUX: a child dormant while awaiting its OWN live grandchild does NOT wake the parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('dorm-sub', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        // CHILD finished its turn (no busy) and its pane is gone, BUT it actively
+        // subscribes to a LIVE grandchild — exactly the developer-spawned-reviewer
+        // case. This is HEALTHY dormancy, not death.
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        createNode(node('GRANDCHILD', { status: 'active', pi_session_id: 'booted' })); // live, no pane (inline)
+        subscribe('PARENT', 'CHILD', true);
+        subscribe('CHILD', 'GRANDCHILD', true); // CHILD awaits a LIVE grandchild
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        // CHILD is RELEASED (revivable), NOT finalized — the daemon must not orphan
+        // its in-flight grandchild and must not wake the parent.
+        assert.equal(getNode('CHILD').status, 'idle', 'CHILD released (revivable), NOT finalized');
+        assert.equal(getNode('CHILD').intent, 'idle-release', 'CHILD routed to idle-release');
+        assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — healthy dormancy raises no wake');
+        assert.equal(cyclesOf('PARENT'), before, 'dormant PARENT stays asleep (no revive) — no spurious wake');
+    });
+});
+test('CRUX: a child dormant on a pending self-wake (no live sub) does NOT wake the parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('dorm-wake', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true);
+        // CHILD has NO live subscription, but holds a pending self-wake (far-future
+        // so the wakeups pass never fires it this tick). hasPendingSelfWake(CHILD)
+        // ⇒ the daemon treats it as STILL WAITING (the stop-guard's boundary), so
+        // it RELEASES instead of finalizing. NON-VACUOUS: drop the hasPendingSelfWake
+        // guard and CHILD finalizes → PARENT is spuriously woken.
+        const future = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString();
+        armWake({ wakeup_id: 'wk-cdw-child', node_id: 'CHILD', owner_id: 'CHILD', fire_at: future, kind: 'bare' });
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(getNode('CHILD').status, 'idle', 'CHILD with a pending self-wake is RELEASED, not finalized');
+        assert.equal(getNode('CHILD').intent, 'idle-release', 'CHILD routed to idle-release (its clock will wake it)');
+        assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — a pending clock is healthy dormancy');
+        assert.equal(cyclesOf('PARENT'), before, 'dormant PARENT stays asleep — pending self-wake is not death');
+    });
+});