@crouton-kit/crouter 0.3.21 → 0.3.23

package/dist/core/__tests__/flagship-lifecycle.test.js

@@ -1,73 +1,80 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/flagship-lifecycle.test.ts
 //
-// FLAGSHIP end-to-end lifecycle test — the faithful integration harness driving
-// a full node-graph scenario through the REAL CLI, a REAL isolated tmux session,
-// the REAL extension hooks (fired inside the fake-pi vehicle), and the REAL
-// daemon decision pass (superviseTick, in-process). Every assertion reads the
-// canvas data layer and is checked against the state-model ORACLE.
+// HEADLESS RETARGET (foundation-spec §C.9 + §E). The flagship end-to-end
+// lifecycle scenario, driven entirely at the MODEL layer against FABRICATED
+// broker-hosted (paneless) nodes — no real tmux session, no pane chrome, and NO
+// real broker boot. The full status×intent×lifecycle×mode state machine is host-
+// independent: every hop is a CLI lifecycle verb (promote/yield) or a pure model
+// op (fabricate + subscribe + transition + pushFinal + superviseTick), so the
+// scenario never pays the ~5s SDK-boot cost.
 //
-// Scenario (each hop asserted):
-//   A (base→orchestrator, RESIDENT root) spawns terminal child B.
-//   B spawns child C, then goes DORMANT (terminal idle-release, unfocused→pane closes).
-//   C finishes → ONE-HOP wakes B (A is NOT woken — the oracle's wake contract).
-//   B PROMOTES to orchestrator (terminal), takes a turn (persona drift), then
-//   YIELDS and revives in place (refresh-yield).
-//   B spawns child D; D finishes; B pushes its final up to A.
+// THREE-PART LOCK HEADER ──────────────────────────────────────────────────
+// (1) BUG LOCKED — the full lifecycle state machine (state-model §2): each hop
+//     (spawn → terminal idle-release dormancy → one-hop wake → promote → yield-
+//     refresh → finish) must land in the correct durable (status,intent,
+//     lifecycle,mode) and route completion ONE HOP up the spine (a push fans to
+//     DIRECT subscribers only; an indirect ancestor hears nothing until a middle
+//     node re-pushes).
+// (2) WHY MODEL-LEVEL, NOT PANE/WINDOW — every transition lives in canvas.db +
+//     the lifecycle table (transition()) + the daemon's second-pass wake gate +
+//     the feed fan-out. A tmux node showed dormancy as a closed pane; a broker
+//     shows it as an EXITED process (status=idle, intent=idle-release, pi_pid
+//     dead) — fabricated directly. The only thing a pane ever added was a visible
+//     dormancy signal, which a broker expresses as a dead pid. No pane is read.
+// (3) HOW THE HEADLESS DRIVE STILL FAILS IF THE FIX REGRESSES — the one-hop wake
+//     is asserted via getNode(B).cycles (reviveNode bumps cycles +
+//     transition('revive') BEFORE the detached, unawaited broker spawn — revive.
+//     ts:114,145 — so the wake is observable INSTANTLY). If the daemon's second-
+//     pass reviveNode is removed, the post-inbox tick never bumps cycles → S7's
+//     "B revived" asserts go RED. If a push wrongly fanned past its direct
+//     subscriber, the "A inbox empty" one-hop asserts go RED.
 //
-// 2×2 coverage (mode {base,orchestrator} × lifecycle {terminal,resident}):
-//   • base×resident       — A's PERSISTED ROW SHAPE at S1 (a harness-set fixture,
-//                           NOT a real bootRoot — see S1 + MINOR-1 caveat below).
-//                           The resident BEHAVIOR (does not idle-release) is
-//                           exercised faithfully in live-mutation.test.ts.
-//   • orchestrator×resident — A after promote (top-level orchestrator)
-//   • base×terminal       — B/C/D workers (GENUINE managed-child birth at S3)
-//   • orchestrator×terminal — B after promote (sub-orchestrator)
+// STOPHOOK CAVEAT — split (option b). The original leaned on the REAL stophook
+// committing idle-release / the stall reprompt / the persona steer INSIDE a live
+// broker at agent_end/turn_end. Fabrication can set the post-stop row but cannot
+// run that hook. So for each such point this test fabricates the post-stop MODEL
+// state (or asserts the PURE decision the hook enacts — evaluateStop /
+// personaDrift) and asserts the downstream lifecycle/daemon CONSEQUENCE, leaving
+// the hook-commit proof to the already-pure siblings:
+//   • idle-release commit at agent_end → canvas-stophook-agentend.test.ts
+//     ('natural stop while awaiting a live worker → idle-release …').
+//   • stall reprompt at agent_end     → canvas-stophook-agentend.test.ts
+//     ('stalled leaf … is still reprompted').
+//   • persona-drift steer + ack commit at turn_end → persona.test.ts
+//     ('personaDrift detects base→orchestrator after promote, then clears on
+//     commit'). Here we assert only the PENDING drift the injector would deliver.
 //
-// ── Known coverage boundaries (DELIBERATE, documented gaps) ────────────────
-// This flagship + the live-mutation/cascade/subscription siblings cover the
-// HAPPY-PATH lifecycle and the live-mutation axis faithfully. The following
-// fault/grace/focus paths are OUT OF SCOPE for the faithful tier in this pass
-// (some are backstopped at the in-process unit tier, cited):
-//   • crash → dead (a vehicle that boots then its pane vanishes mid-run) — unit:
-//     daemon-liveness.test.ts "pane GONE … crash → dead".
-//   • boot-failure push (a vehicle that never boots → surfaceBootFailure urgent
-//     push up the spine) — no faithful coverage here.
-//   • focused-FREEZE (F3: a focused-dormant node frozen via remain-on-exit,
-//     pane-alive but pi-dead) — unit: daemon-liveness.test.ts "idle-release +
-//     live (frozen) pane …"; the grace-window double-spawn guard around it is
-//     exercised faithfully in grace-clock.test.ts.
-//   • node lifecycle --detach (A3: orphaned-focus-row hazard) — faithful E2E:
-//     detach-focus.test.ts (the real verb on a FOCUSED live node → terminal +
-//     pane relocated to the backstage + focus row CLOSED).
-//   • focused-finish → manager-TAKEOVER (handFocusToManager swap) — NOT harness-
-//     reachable: the harness root is a paneless never-booted row, so the done-
-//     branch only ever hits the paneless-manager false guard (closeFocusToShell),
-//     never a live/dormant-idle-release takeover. Unit: placement-teardown.test.ts.
-//   • node msg / focus / cycle wake of a dormant node (A7) — untested faithfully.
-// These are intentional boundaries, not oversights.
+// 2×2 coverage (mode {base,orchestrator} × lifecycle {terminal,resident}):
+//   • base×resident         — A's fabricated row shape at S1 (a spawnRoot
+//                             fixture; the real resident-birth boot path is
+//                             structurally unreachable headlessly).
+//   • orchestrator×resident — A after promote (top-level orchestrator).
+//   • base×terminal         — B/C/D workers (fabricated managed children).
+//   • orchestrator×terminal — B after promote (sub-orchestrator).
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { createHarness, hasTmux } from './helpers/harness.js';
-import { STALL_REPROMPT } from '../runtime/stop-guard.js';
-function sessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
+import { createHeadlessHarness } from './helpers/harness.js';
+import { subscribe } from '../canvas/canvas.js';
+import { transition } from '../runtime/lifecycle.js';
+import { pushFinal } from '../feed/feed.js';
+import { evaluateStop, STALL_REPROMPT } from '../runtime/stop-guard.js';
+import { personaDrift, commitPersonaAck } from '../runtime/persona.js';
+// A pid reaped (dead) by the time spawnSync returns — a released broker's exited
+// process (the headless analog of a closed pane).
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
 }
-test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote, yield, finish', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 180_000 }, async () => {
-    const h = await createHarness({ sessionPrefix: 'crtr-flagship' });
+test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote, yield, finish (headless)', { timeout: 30_000 }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-flagship' });
     try {
         // ===================================================================
-        // S1 — A's PERSISTED ROW SHAPE: base × RESIDENT (the user's front door).
-        //   ⚠ MINOR-1 caveat: this is NOT a real root birth. The harness mints A
-        //   via in-process createNode over a hand-built meta whose defaults ARE
-        //   mode:'base'/lifecycle:'resident' — the REAL birth/boot path (bootRoot)
-        //   execs pi inline and never returns, so it is structurally unreachable
-        //   from the harness (harness-design Wall #7). These four asserts therefore
-        //   PIN THE PERSISTED ROW SHAPE the rest of the scenario builds on — they
-        //   do NOT prove the real resident-birth path. The resident-at-birth 2×2
-        //   quadrant is out of reach; the resident *behavior* (no idle-release) is
-        //   exercised faithfully in live-mutation.test.ts, and the genuine real
-        //   birth of a managed child (→ terminal) IS exercised at S3 below.
+        // S1 — A's ROW SHAPE: base × RESIDENT (the user's front door). A spawnRoot
+        //   fixture pins the PERSISTED row shape the scenario builds on; the real
+        //   resident-birth boot path (bootRoot execs pi inline) is unreachable
+        //   headlessly, exactly as in the tmux flagship. The resident BEHAVIOR (no
+        //   idle-release) is exercised in live-mutation.test.ts.
         // ===================================================================
         const A = h.spawnRoot('top-level orchestrator');
         {
@@ -78,8 +85,9 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(a.intent ?? null, null, 'A no intent');
         }
         // ===================================================================
-        // S2 — A promotes: orchestrator × RESIDENT (top-level orchestrator).
-        //      mode flips; lifecycle/status/intent untouched (no transition()).
+        // S2 — A promotes: orchestrator × RESIDENT (top-level orchestrator). The
+        //      real `node promote` verb; mode flips, lifecycle/status/intent
+        //      untouched (no transition()).
         // ===================================================================
         {
             const res = h.cli(A, ['node', 'promote']);
@@ -91,88 +99,98 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(a.intent ?? null, null, 'A intent untouched by promote');
         }
         // ===================================================================
-        // S3 — A spawns terminal child B: base × TERMINAL. The spawn seed wires
-        //      the spine — A auto-subscribes ACTIVE to B, B spawned_by A.
+        // S3 — A spawns terminal child B: base × TERMINAL. Fabricated as a broker-
+        //      hosted node (pi_pid dead + pi_session_id set, so its later dormant
+        //      wake RESUMES that session); the spine seed is wired explicitly
+        //      (fabrication does not auto-subscribe). B is born acked to its own
+        //      persona (commitPersonaAck), mirroring a real birth.
         // ===================================================================
-        const B = await h.spawnChild(A, 'do the work', { kind: 'developer' });
+        const B = h.fabricateBrokerNode({
+            parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal',
+            status: 'active', pi_pid: deadPid(), pi_session_id: 'sess-B',
+        });
+        subscribe(A, B, true); // the load-bearing spine seed: A subscribes_to B (active).
+        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' }); // born acked to its persona
         {
             const b = h.node(B);
+            assert.equal(b.host_kind, 'broker', 'B broker-hosted (paneless)');
             assert.equal(b.mode, 'base', 'B born base');
             assert.equal(b.lifecycle, 'terminal', 'B born terminal (managed child)');
-            assert.equal(b.status, 'active', 'B active after boot');
+            assert.equal(b.status, 'active', 'B active');
             assert.equal(b.intent ?? null, null, 'B no intent');
             assert.equal(b.parent, A, 'B spawned_by / parent = A');
-            // The load-bearing spine seed: A subscribes_to B (active).
-            const subsToB = h.subscribers(B);
-            assert.deepEqual(subsToB, [{ node_id: A, active: true }], 'A is B\'s sole ACTIVE subscriber (spawn seed)');
+            assert.deepEqual(h.subscribers(B), [{ node_id: A, active: true }], "A is B's sole ACTIVE subscriber (spine seed)");
             assert.equal(h.inbox(A).length, 0, 'A inbox empty (spawn pushes nothing)');
         }
         // ===================================================================
         // S4 — B spawns child C (base × terminal). B now holds an active live
         //      subscription to C → B is legitimately "awaiting" if it stops.
         // ===================================================================
-        const C = await h.spawnChild(B, 'a subtask');
+        const C = h.fabricateBrokerNode({ parent: B, mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(B, C, true);
         {
             const c = h.node(C);
             assert.equal(c.mode, 'base', 'C base');
             assert.equal(c.lifecycle, 'terminal', 'C terminal');
             assert.equal(c.status, 'active', 'C active');
-            assert.deepEqual(h.subscribers(C), [{ node_id: B, active: true }], 'B is C\'s sole ACTIVE subscriber (spawn seed)');
+            assert.deepEqual(h.subscribers(C), [{ node_id: B, active: true }], "B is C's sole ACTIVE subscriber");
             assert.deepEqual(h.subscriptions(B), [{ node_id: C, active: true }], 'B subscribes_to C (active)');
             assert.equal(h.status(B), 'active', 'B still active');
         }
         // ===================================================================
-        // S5 — B goes DORMANT. It stops while awaiting C → terminal idle-release:
-        //      transition('release') → idle / idle-release; ctx.shutdown kills pi;
-        //      UNFOCUSED → the backstage pane CLOSES (fully dormant).
+        // S5 — B goes DORMANT. PURE precondition: B is TERMINAL holding an active
+        //      live sub to C, so the stop-guard classifies its stop 'awaiting'
+        //      (legitimate idle-release). We then enact the post-stop MODEL state
+        //      directly: transition('release') → idle / idle-release (a released
+        //      broker is a dead pid; pi_pid was fabricated dead at S3). The actual
+        //      agent_end idle-release COMMIT is locked by canvas-stophook-agentend
+        //      ('natural stop while awaiting a live worker → idle-release …').
         // ===================================================================
-        await h.stop(B);
-        await h.waitForStatus(B, 'idle');
+        {
+            const stop = evaluateStop(B, { pushedFinal: false, askedHuman: false });
+            assert.equal(stop.action, 'allow', 'awaiting terminal B → allow (legit idle-release)');
+            assert.equal(stop.reason, 'awaiting', "B classified awaiting on its ACTIVE live sub to C");
+        }
+        transition(B, 'release');
         {
             const b = h.node(B);
             assert.equal(b.status, 'idle', 'B idle (released)');
             assert.equal(b.intent, 'idle-release', 'B intent=idle-release');
         }
-        await h.waitForPaneGone(B);
-        assert.equal(h.paneAlive(B), false, 'B unfocused → pane closed on idle-release');
         assert.equal(h.status(C), 'active', 'C still active while B sleeps');
-        // A untouched — a dormant terminal worker does not disturb its manager.
-        assert.equal(h.status(A), 'active', 'A still active');
+        assert.equal(h.status(A), 'active', 'A still active (a dormant worker does not disturb its manager)');
         assert.equal(h.inbox(A).length, 0, 'A inbox still empty');
         // ===================================================================
-        // S6 — C FINISHES (push final). Pointer fans to subscribersOf(C) = {B}
+        // S6 — C FINISHES (pushFinal). The pointer fans to subscribersOf(C) = {B}
         //      ONLY. C → done/done. A is NOT a subscriber of C → A inbox stays
-        //      empty. This is the one-hop wake contract at the push site.
+        //      empty — the one-hop wake contract at the push site.
         // ===================================================================
-        await h.finish(C, 'C result body');
+        await pushFinal(C, 'C result body');
         {
             const c = h.node(C);
             assert.equal(c.status, 'done', 'C done');
             assert.equal(c.intent, 'done', 'C intent=done');
-            assert.equal(h.paneAlive(C), false, 'C pane closed on done');
-            const bInbox = h.inbox(B);
-            const cFinal = bInbox.find((e) => e.from === C && e.kind === 'final');
-            assert.ok(cFinal, 'B inbox received C\'s final pointer (one hop)');
-            // ORACLE: ONE-HOP. A is not woken — only B (the direct subscriber) hears C.
+            const cFinal = h.inbox(B).find((e) => e.from === C && e.kind === 'final');
+            assert.ok(cFinal, "B inbox received C's final pointer (one hop)");
             assert.equal(h.inbox(A).length, 0, 'A inbox empty — A NOT woken by C (one-hop)');
         }
         // ===================================================================
         // S7 — WAKE B. The in-process daemon second pass sees B idle/idle-release,
-        //      pi dead, an unseen inbox entry → reviveNode(resume). B → active,
-        //      intent cleared (revive). Its FRESH watcher delivers C's report.
+        //      pi dead, an unseen inbox entry → reviveNode(resume). reviveNode
+        //      bumps cycles + transition('revive') BEFORE the (detached, unawaited)
+        //      broker spawn, so the wake is observable INSTANTLY via cycles — no
+        //      awaitBoot. (The real inbox-watcher's redelivery of C's report on the
+        //      fresh boot is an engine artifact, out of the model tier; the wake
+        //      DECISION is locked here by cycles + the S6 inbox entry.)
         // ===================================================================
-        const injBeforeWake = h.injected(B).length;
-        await h.tick(); // one superviseTick: 1st pass nulls the stale window, 2nd revives on inbox
-        await h.waitForStatus(B, 'active');
+        assert.equal(h.node(B).cycles ?? 0, 0, 'B not yet revived');
+        await h.tick();
         {
             const b = h.node(B);
+            assert.equal(b.cycles ?? 0, 1, 'unseen inbox + tick → daemon pass-2 REVIVED (cycles bumped to 1)');
             assert.equal(b.status, 'active', 'B revived → active');
             assert.equal(b.intent ?? null, null, 'B intent cleared by revive');
         }
-        await h.awaitBoot(B, { minCount: 2 }); // the resume boot (spawn boot + wake boot)
-        const wakeDigests = await h.awaitWake(B, { sinceCount: injBeforeWake, match: /C result body/ });
-        assert.ok(wakeDigests.some((d) => /C result body/.test(d)), 'B\'s real inbox-watcher delivered C\'s report after the wake');
-        // Still one-hop: A remained dormant-as-resident and was never touched.
         assert.equal(h.inbox(A).length, 0, 'A inbox STILL empty after B woke (one-hop confirmed)');
         assert.equal(h.status(A), 'active', 'A unchanged');
         // ===================================================================
@@ -189,35 +207,45 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(b.intent ?? null, null, 'B intent untouched by promote');
         }
         // ===================================================================
-        // S9 — B takes a TURN. turn_end detects the base→orchestrator persona
-        //      drift and injects the orchestration guidance as a 'steer', then
-        //      commits the ack. agent_end then stalls (no live sub, no final) →
-        //      STALL_REPROMPT (followUp). Both are real stophook branches.
+        // S9 — The next turn's hooks, asserted as the PURE decisions they enact:
+        //      (a) turn_end would inject the base→orchestrator persona-drift steer —
+        //          personaDrift(B) reports that PENDING drift (the guidance the
+        //          injector delivers). The actual delivery + ack commit is locked
+        //          by persona.test.ts.
+        //      (b) agent_end would stall (orchestrator, no live sub — C done, D not
+        //          yet spawned — no final) → evaluateStop → 'stalled'/STALL_REPROMPT.
+        //          The actual reprompt injection is locked by canvas-stophook-agentend.
         // ===================================================================
-        const injBeforeTurn = h.injected(B).length;
-        await h.turn(B, 'orchestrating');
-        const turnInjected = await h.waitFor(() => {
-            const fresh = h.injected(B).slice(injBeforeTurn);
-            // MINOR-3: match the steer by CONTENT (/ORCHESTRATOR/i), not deliverAs
-            // alone — mirroring live-mutation.test.ts's orchestrationSteers() — so
-            // this pins the orchestration guidance specifically, not "some steer."
-            const steer = fresh.find((e) => e.deliverAs === 'steer' && /ORCHESTRATOR/i.test(e.content));
-            const reprompt = fresh.find((e) => e.content.includes(STALL_REPROMPT));
-            return steer && reprompt ? fresh : null;
-        }, { timeoutMs: 15_000, label: 'B turn injected persona-drift steer + stall reprompt' });
-        assert.ok(turnInjected.some((e) => e.deliverAs === 'steer' && /ORCHESTRATOR/i.test(e.content)), 'turn_end injected the base→orchestrator persona-drift guidance (steer with ORCHESTRATOR content)');
-        assert.ok(turnInjected.some((e) => e.content.includes(STALL_REPROMPT)), 'agent_end stalled (orchestrator, no live sub, no final) → STALL_REPROMPT');
-        assert.equal(h.status(B), 'active', 'B still active after the turn (reprompt keeps it alive)');
+        {
+            const drift = personaDrift(B);
+            assert.ok(drift !== null, 'turn_end would inject a persona-drift steer (drift pending)');
+            assert.deepEqual(drift?.from, { mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
+            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
+            assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the steer carries the base→orchestrator guidance');
+            const stop = evaluateStop(B, { pushedFinal: false, askedHuman: false });
+            assert.equal(stop.action, 'reprompt', 'orchestrator B with no live sub, no final → reprompt');
+            assert.equal(stop.reason, 'stalled', 'classified stalled');
+            assert.equal(stop.action === 'reprompt' ? stop.message : '', STALL_REPROMPT, 'the stall reprompt nudge');
+        }
         // ===================================================================
-        // S10 — B YIELDS + revives. node yield → intent=refresh (active kept);
-        //       agent_end (b') runs reviveInPlace (respawn-pane -k) IN the fake-pi
-        //       pane; the fresh pi's session_start clears refresh → active. mode
-        //       and lifecycle survive the refresh.
+        // S10 — B YIELDS. The real `node yield` verb sets intent=refresh (already
+        //       orchestrator → no auto-promote); persona survives the request. We
+        //       then model the daemon's completed refresh-revive with transition
+        //       ('revive') (the in-place fresh boot is engine; its model effect —
+        //       active, intent cleared, persona preserved — is asserted here).
         // ===================================================================
-        await h.yieldNode(B, 'refresh against the roadmap');
+        {
+            const res = h.cli(B, ['node', 'yield', 'refresh against the roadmap']);
+            assert.equal(res.code, 0, `node yield exit 0\n${res.stderr}`);
+            const b = h.node(B);
+            assert.equal(b.intent, 'refresh', 'yield set intent=refresh');
+            assert.equal(b.mode, 'orchestrator', 'B mode survives the yield request');
+            assert.equal(b.lifecycle, 'terminal', 'B lifecycle survives the yield request');
+        }
+        transition(B, 'revive'); // model the completed refresh-revive (fresh boot is engine)
         {
             const b = h.node(B);
-            assert.equal(b.status, 'active', 'B active after refresh-yield');
+            assert.equal(b.status, 'active', 'B active after the refresh-revive');
             assert.equal(b.intent ?? null, null, 'B intent=refresh cleared by the fresh boot');
             assert.equal(b.mode, 'orchestrator', 'B mode survives the refresh');
             assert.equal(b.lifecycle, 'terminal', 'B lifecycle survives the refresh');
@@ -225,7 +253,8 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         // ===================================================================
         // S11 — B spawns child D (base × terminal). New spine seed B→D active.
         // ===================================================================
-        const D = await h.spawnChild(B, 'a second subtask');
+        const D = h.fabricateBrokerNode({ parent: B, mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(B, D, true);
         {
             const d = h.node(D);
             assert.equal(d.mode, 'base', 'D base');
@@ -236,32 +265,27 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         // ===================================================================
         // S12 — D FINISHES → pointer to B (its only subscriber).
         // ===================================================================
-        await h.finish(D, 'D result body');
+        await pushFinal(D, 'D result body');
         {
             assert.equal(h.node(D).status, 'done', 'D done');
             const dFinal = h.inbox(B).find((e) => e.from === D && e.kind === 'final');
-            assert.ok(dFinal, 'B inbox received D\'s final pointer');
+            assert.ok(dFinal, "B inbox received D's final pointer");
         }
         // ===================================================================
         // S13 — B pushes its FINAL up the spine → done/done; the pointer fans to
         //       subscribersOf(B) = {A}. NOW A finally hears B (its own explicit
         //       push — the only way the chain propagates a hop).
         // ===================================================================
+        await pushFinal(B, 'all work complete');
         {
-            const res = h.cli(B, ['push', 'final', 'all work complete']);
-            assert.equal(res.code, 0, `B push final exit 0\n${res.stderr}`);
             const b = h.node(B);
             assert.equal(b.status, 'done', 'B done after push final');
             assert.equal(b.intent, 'done', 'B intent=done');
             const aInbox = h.inbox(A);
-            assert.equal(aInbox.length, 1, 'A inbox now has exactly B\'s final (one hop, on B\'s push)');
-            assert.equal(aInbox[0].from, B, 'A\'s entry is from B');
-            assert.equal(aInbox[0].kind, 'final', 'A\'s entry is a final');
+            assert.equal(aInbox.length, 1, "A inbox now has exactly B's final (one hop, on B's push)");
+            assert.equal(aInbox[0].from, B, "A's entry is from B");
+            assert.equal(aInbox[0].kind, 'final', "A's entry is a final");
         }
-        // Close B's window faithfully (done branch shutdown).
-        await h.stop(B);
-        await h.waitForPaneGone(B);
-        assert.equal(h.paneAlive(B), false, 'B pane closed on done');
         // A — the resident top-level orchestrator — is still alive and well.
         {
             const a = h.node(A);
@@ -271,9 +295,6 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         }
     }
     finally {
-        const session = h.session;
         await h.dispose();
-        // Teardown leaves NO stray session.
-        assert.equal(sessionExists(session), false, 'isolated session killed — no stray');
     }
 });

package/dist/core/__tests__/frame-decoder-perf.test.js

@@ -18,7 +18,11 @@
 // These tests lock in (a) behavioral equivalence with the old decoder across
 // randomized chunkings — frames, blank-line skip, malformed-JSON drop, multibyte
 // splits, and both FrameOverflowError caps with identical byte accounting — and
-// (b) the linear growth curve, so the quadratic shape cannot silently return.
+// (b) the linear growth curve via a SCALING-RATIO assertion (per-MiB decode cost
+// at 4 MiB vs 16 MiB must stay ~flat), so the quadratic shape cannot silently
+// return. The ratio is measured with min-of-reps and interleaved sizes so it is
+// robust to CPU contention from parallel `test:full` workers — see the perf test
+// for the full rationale.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { StringDecoder } from 'node:string_decoder';
@@ -167,32 +171,54 @@ test('FrameDecoder — a frame exactly AT each cap passes; one byte over throws
     }
 });
 test('FrameDecoder — large-frame decode is linear, not quadratic (the observed attach-lag regression)', () => {
-    // Decode a single N-MiB frame in 64 KiB chunks; compare per-MiB cost at 2 MiB
-    // vs 8 MiB. Quadratic shape ⇒ per-MiB cost grows ~4× per 4× size (measured
-    // 5.5×+ pre-fix); linear stays ~flat. Threshold 3× is far above linear noise
-    // and far below the quadratic signature, so this fails ONLY on a complexity
-    // regression, not on a slow CI box.
+    // STRATEGY (contention-robust SCALING assertion): decode a single frame in
+    // 64 KiB socket-sized chunks at two sizes 4× apart (4 MiB vs 16 MiB) and assert
+    // the per-MiB cost stays ~flat. A linear decoder has per-MiB cost independent of
+    // size (ratio ≈ 1); the O(n²) bug makes per-MiB cost grow with size, so over a 4×
+    // size jump it grows ~4× (measured 5.5×+ pre-fix). Threshold 3× sits cleanly
+    // between the two signatures: well above linear noise, well below the quadratic
+    // signature.
+    //
+    // Why a RATIO, not an absolute wall-clock budget: an absolute budget is fragile
+    // under the parallel `test:full` workers — CPU contention scales every
+    // measurement up, so a tight budget flakes red on a loaded box without any code
+    // regression. A ratio of two contention-scaled measurements cancels whole-box
+    // slowdown, leaving only the algorithmic shape. Two further guards keep the
+    // minima clean under load: (1) MIN across REPS — contention only ADDS time, so
+    // the minimum approximates the uncontended cost; (2) the two sizes are timed
+    // INTERLEAVED within each rep, so a contention burst inflates both numerator and
+    // denominator alike instead of skewing the ratio. This fails ONLY on a
+    // complexity regression, not on a slow/busy CI box.
     const CHUNK = 64 * 1024;
-    const decodeMs = (mib) => {
+    const SMALL_MIB = 4;
+    const LARGE_MIB = 16; // 4× SMALL — quadratic ⇒ per-MiB ~4×; linear ⇒ ~1×
+    const REPS = 7;
+    const makeFrame = (mib) => {
         const overhead = Buffer.byteLength('{"type":"welcome","blob":""}\n');
-        const frame = Buffer.from(`{"type":"welcome","blob":"${'x'.repeat(mib * 1024 * 1024 - overhead)}"}\n`);
-        let best = Infinity;
-        for (let rep = 0; rep < 3; rep++) {
-            const dec = new FrameDecoder(CLIENT_READ_CAPS);
-            const t0 = performance.now();
-            let n = 0;
-            for (let off = 0; off < frame.length; off += CHUNK) {
-                n += dec.push(frame.subarray(off, Math.min(off + CHUNK, frame.length))).length;
-            }
-            const ms = performance.now() - t0;
-            assert.equal(n, 1, 'decoded exactly one frame');
-            if (ms < best)
-                best = ms;
+        return Buffer.from(`{"type":"welcome","blob":"${'x'.repeat(mib * 1024 * 1024 - overhead)}"}\n`);
+    };
+    const smallFrame = makeFrame(SMALL_MIB);
+    const largeFrame = makeFrame(LARGE_MIB);
+    const decodeMs = (frame) => {
+        const dec = new FrameDecoder(CLIENT_READ_CAPS);
+        const t0 = performance.now();
+        let n = 0;
+        for (let off = 0; off < frame.length; off += CHUNK) {
+            n += dec.push(frame.subarray(off, Math.min(off + CHUNK, frame.length))).length;
         }
-        return best;
+        const ms = performance.now() - t0;
+        assert.equal(n, 1, 'decoded exactly one frame');
+        return ms;
     };
-    decodeMs(1); // warmup
-    const perMibSmall = decodeMs(2) / 2;
-    const perMibLarge = decodeMs(8) / 8;
-    assert.ok(perMibLarge < perMibSmall * 3, `per-MiB decode cost grew superlinearly: ${perMibSmall.toFixed(2)}ms/MiB @2MiB → ${perMibLarge.toFixed(2)}ms/MiB @8MiB (quadratic regression)`);
+    decodeMs(smallFrame); // warm JIT on both paths before timing
+    decodeMs(largeFrame);
+    let bestSmall = Infinity;
+    let bestLarge = Infinity;
+    for (let rep = 0; rep < REPS; rep++) {
+        bestSmall = Math.min(bestSmall, decodeMs(smallFrame));
+        bestLarge = Math.min(bestLarge, decodeMs(largeFrame));
+    }
+    const perMibSmall = bestSmall / SMALL_MIB;
+    const perMibLarge = bestLarge / LARGE_MIB;
+    assert.ok(perMibLarge < perMibSmall * 3, `per-MiB decode cost grew superlinearly: ${perMibSmall.toFixed(2)}ms/MiB @${SMALL_MIB}MiB → ${perMibLarge.toFixed(2)}ms/MiB @${LARGE_MIB}MiB (ratio ${(perMibLarge / perMibSmall).toFixed(2)}×; quadratic regression)`);
 });