@danceiny/gotry 0.0.1-rc.8 → 0.2.0-rc.27

package/dist/scripts/managed-dsh-cleanup-diagnostic-proof.js

@@ -0,0 +1,184 @@
+import assert from 'node:assert/strict';
+import { spawn, spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { ManagedDshRunPort } from '../src/booking-surface/managed-dsh-run-port.js';
+import { ManagedDshCleanupError, managedDshGroupIsQuiescent, parseManagedDshGroupSnapshot, readManagedDshWorkerStart, snapshotManagedDshGroup, } from '../src/booking-surface/managed-dsh-cleanup-diagnostic.js';
+const workerPath = fileURLToPath(new URL('./fixtures/managed-dsh-worker-fixture.mjs', import.meta.url));
+async function proveFailedObservation(kind) {
+    const port = new ManagedDshRunPort({ workerPath, graceMs: 50, cleanupRole: kind === 'timeout' ? 'task' : 'warmer' });
+    // This seam injects an observation failure, not a real process-cleanup bug.
+    // Launch and termination still use the installed runtime and real child tree.
+    const handle = port.handle;
+    const waitForExit = handle.waitForExit.bind(handle);
+    try {
+        const result = await port.run('fixture', { sessionId: 'cleanup-diagnostic-proof' });
+        const descendant = result.events[0].grandchildPid;
+        handle.waitForExit = async () => {
+            if (kind === 'rejected')
+                throw new Error('PRIVATE_PROVIDER_TOKEN_DO_NOT_EXPOSE');
+            return false;
+        };
+        const closing = port.close();
+        assert.strictEqual(port.close(), closing, 'failure remains sticky for every close caller');
+        const error = await closing.then(() => undefined, (reason) => reason);
+        assert.ok(error instanceof ManagedDshCleanupError, 'failure carries a typed safe diagnostic');
+        const diagnostic = error.diagnostic;
+        assert.equal(diagnostic.role, kind === 'timeout' ? 'task' : 'warmer');
+        assert.equal(diagnostic.schemaVersion, 'managed-dsh-cleanup.v2');
+        if (process.platform === 'darwin')
+            assert.ok(Number.isSafeInteger(diagnostic.workerPid) && diagnostic.workerPid > 0, 'direct fallback receipt identifies the worker');
+        assert.equal(diagnostic.deadlineMs, 1_000, 'existing minimum teardown deadline is preserved');
+        assert.equal(diagnostic.graceMs, 50);
+        assert.ok(diagnostic.elapsedMs >= 0);
+        assert.ok(['pending', 'exited', 'failed'].includes(diagnostic.workerOutcome.state));
+        assert.equal(diagnostic.processGroup.expectedPgid, process.platform === 'darwin' ? diagnostic.workerPid : null);
+        assert.equal(JSON.stringify(error).includes('PRIVATE_'), false, 'provider observation errors are not forwarded');
+        const log = spawnSync(process.execPath, ['--input-type=module', '-e',
+            'let error = new Error(process.argv[1]); for (let i = 0; i < 3; i++) error = new AggregateError([error], "nested cleanup"); throw error',
+            error.message], { encoding: 'utf8', timeout: 5_000 });
+        assert.equal(log.status, 1, 'nested uncaught error child fails as intended');
+        assert.ok(log.stderr.includes(`diagnostic=${JSON.stringify(diagnostic)}`), 'default nested error log retains every safe diagnostic value');
+        assert.equal(log.stderr.includes('PRIVATE_'), false, 'nested log does not expose provider errors');
+        for (const member of diagnostic.processGroup.members) {
+            assert.equal(member.pgid, diagnostic.workerPid, 'only the owned process group is returned');
+            assert.deepEqual(Object.keys(member).sort(), ['pgid', 'pid', 'ppid', 'startedAt', 'state', 'zombie']);
+            assert.equal(member.zombie, member.state.startsWith('Z'), 'zombie flag matches the observed state letter');
+        }
+        if (kind === 'timeout' && diagnostic.processGroup.status === 'observed') {
+            // Right after terminate() the real fixture tree still holds live members,
+            // so the safe snapshot must classify it as not quiescent.
+            assert.equal(diagnostic.processGroup.classification, 'has-live-members');
+            assert.ok(diagnostic.processGroup.liveMemberCount >= 1);
+            assert.equal(managedDshGroupIsQuiescent(diagnostic.processGroup), false);
+        }
+        assert.equal(await waitForExit(AbortSignal.timeout(2_000)), true, 'actual runtime still reaps the worker tree');
+        if (process.platform !== 'win32')
+            assert.throws(() => process.kill(descendant, 0), 'grandchild is reaped');
+        console.log(`MANAGED DSH CLEANUP DIAGNOSTIC: ${kind} observation preserves ${diagnostic.role} identity and actual tree teardown`);
+    }
+    finally {
+        handle.waitForExit = waitForExit;
+        handle.terminate();
+        assert.equal(await waitForExit(AbortSignal.timeout(2_000)), true, 'proof cleans its own processes even after an assertion failure');
+    }
+}
+/** Classify crafted ps tables without signalling anything. */
+async function proveSyntheticClassification() {
+    const anchor = 'Sun Sep 20 19:59:16 2026';
+    const zombieOnly = parseManagedDshGroupSnapshot(' 4242 1 4242 Z    Sun Sep 20 19:59:16 2026', 4242, anchor);
+    assert.equal(zombieOnly.status, 'observed');
+    assert.equal(zombieOnly.classification, 'zombie-only');
+    assert.deepEqual([zombieOnly.liveMemberCount, zombieOnly.zombieMemberCount], [0, 1]);
+    assert.equal(zombieOnly.workerIdentity, 'match');
+    assert.equal(managedDshGroupIsQuiescent(zombieOnly), true, 'a group holding only un-reaped zombies is quiescent');
+    const reused = parseManagedDshGroupSnapshot(' 4242 1 4242 Z    Mon Dec 1 08:00:00 2025', 4242, anchor);
+    assert.equal(reused.workerIdentity, 'mismatch', 'a start time that differs from the live anchor proves PID reuse');
+    const live = parseManagedDshGroupSnapshot(' 4242 1 4242 Ss   Sun Sep 20 19:59:16 2026\n 4243 4242 4242 R    Sun Sep 20 19:59:17 2026', 4242, anchor);
+    assert.equal(live.classification, 'has-live-members');
+    assert.deepEqual([live.liveMemberCount, live.zombieMemberCount], [2, 0]);
+    assert.equal(live.workerIdentity, 'match');
+    assert.equal(managedDshGroupIsQuiescent(live), false);
+    const mixed = parseManagedDshGroupSnapshot(' 4242 1 4242 Z    Sun Sep 20 19:59:16 2026\n 4243 4242 4242 U    Sun Sep 20 19:59:17 2026', 4242, null);
+    assert.equal(mixed.classification, 'has-live-members', 'an uninterruptible member is live, never zombie');
+    assert.equal(mixed.workerIdentity, 'unknown', 'without a live anchor identity stays unknown');
+    const empty = parseManagedDshGroupSnapshot('', 4242, anchor);
+    assert.equal(empty.classification, 'empty');
+    assert.equal(managedDshGroupIsQuiescent(empty), true);
+    assert.equal(parseManagedDshGroupSnapshot('4243 1 999 Z Sun Sep 20 19:59:16 2026', 4242).classification, 'empty', 'foreign groups are excluded');
+    console.log('MANAGED DSH CLEANUP DIAGNOSTIC: synthetic tables classify zombie-only, live, uninterruptible, empty and reused identities');
+}
+/**
+ * A live process that never reaps its child keeps a real zombie inside its own
+ * process group for as long as it lives: `sh -c 'sleep 0.3 & exec sleep 600'`
+ * leaves the exited background job owned by the exec'd sleep.
+ */
+async function proveRealGroupClassification() {
+    if (process.platform !== 'darwin') {
+        console.log('MANAGED DSH CLEANUP DIAGNOSTIC: real group classification is Darwin-only, skipped');
+        return;
+    }
+    const holder = spawn('/bin/sh', ['-c', 'sleep 0.3 & exec sleep 600'], { detached: true, stdio: 'ignore' });
+    try {
+        const anchor = await readManagedDshWorkerStart(holder.pid);
+        assert.ok(anchor, 'live holder reports its start-time anchor');
+        const deadline = Date.now() + 2_000;
+        let group;
+        while (Date.now() < deadline) {
+            group = await snapshotManagedDshGroup(holder.pid, anchor);
+            if (group.status === 'observed' && group.zombieMemberCount >= 1)
+                break;
+            await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+        assert.equal(group.status, 'observed');
+        assert.equal(group.classification, 'has-live-members', 'a live member holding a zombie is not zombie-only');
+        assert.ok(group.liveMemberCount >= 1 && group.zombieMemberCount >= 1, 'the real group holds one live holder and one real zombie');
+        for (const member of group.members) {
+            assert.ok(member.startedAt, 'every real member carries a start time');
+            assert.equal(member.zombie, member.state.startsWith('Z'));
+        }
+        assert.equal(group.workerIdentity, 'match', 'the live anchor matches the observed holder identity');
+        assert.equal(managedDshGroupIsQuiescent(group), false);
+        console.log(`MANAGED DSH CLEANUP DIAGNOSTIC: real group ${holder.pid} classified with live holder and real zombie member`);
+    }
+    finally {
+        try {
+            process.kill(-holder.pid, 'SIGKILL');
+        }
+        catch { /* already gone */ }
+        const reaped = Date.now() + 2_000;
+        while (Date.now() < reaped) {
+            try {
+                process.kill(-holder.pid, 0);
+                await new Promise((resolve) => setTimeout(resolve, 50));
+            }
+            catch {
+                break;
+            }
+        }
+    }
+}
+/** The close verdict: an observation deadline plus a quiescent group is a successful cleanup, not a timeout. */
+async function proveCloseVerdict(classification) {
+    let observedPgid = null;
+    const port = new ManagedDshRunPort({
+        workerPath, graceMs: 50, cleanupRole: 'task',
+        groupObserver: async (pid) => {
+            observedPgid = pid;
+            const table = classification === 'empty' ? '' : ` ${pid} 1 ${pid} ${classification === 'zombie-only' ? 'Z' : 'Ss'}   Sun Sep 20 19:59:16 2026`;
+            return parseManagedDshGroupSnapshot(table, pid, null);
+        },
+    });
+    const handle = port.handle;
+    const waitForExit = handle.waitForExit.bind(handle);
+    try {
+        await port.run('fixture', { sessionId: 'cleanup-verdict-proof' });
+        handle.waitForExit = async () => false;
+        const closing = port.close();
+        if (classification === 'has-live-members') {
+            const error = await closing.then(() => undefined, (reason) => reason);
+            assert.ok(error instanceof ManagedDshCleanupError, 'a live member still converts the deadline into a failure');
+            assert.equal(error.message.split(';')[0], 'managed DSH process tree cleanup timeout');
+            assert.equal(error.diagnostic.processGroup.classification, 'has-live-members');
+            assert.equal(error.diagnostic.processGroup.liveMemberCount, 1);
+        }
+        else {
+            await closing;
+        }
+        assert.ok(Number.isInteger(observedPgid) && observedPgid > 0, 'the verdict observer receives the owned worker identity');
+        assert.equal(await waitForExit(AbortSignal.timeout(2_000)), true, 'the real runtime still reaps the tree in every verdict case');
+    }
+    finally {
+        handle.waitForExit = waitForExit;
+        handle.terminate();
+        assert.equal(await waitForExit(AbortSignal.timeout(2_000)), true, 'proof cleans its own processes even after an assertion failure');
+    }
+}
+await proveFailedObservation('timeout');
+await proveFailedObservation('rejected');
+await proveSyntheticClassification();
+await proveRealGroupClassification();
+await proveCloseVerdict('zombie-only');
+await proveCloseVerdict('empty');
+await proveCloseVerdict('has-live-members');
+assert.equal((await snapshotManagedDshGroup(null)).status, 'unknown_worker');
+console.log('MANAGED DSH CLEANUP DIAGNOSTIC PROOF: observation failures, zombie classification, identity anchors and verdict-by-quiescence OK');

package/dist/scripts/managed-dsh-close-failure-proof.js

@@ -0,0 +1,172 @@
+import assert from 'node:assert/strict';
+import { spawn as nodeSpawn } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import LocalSubprocessRuntime from '@deepseek-ai/dsh-subprocess-local';
+import { ManagedDshRunPort } from '../src/booking-surface/managed-dsh-run-port.js';
+import { ManagedDshCleanupError } from '../src/booking-surface/managed-dsh-cleanup-diagnostic.js';
+const workerPath = fileURLToPath(new URL('./fixtures/managed-dsh-pending-worker-fixture.mjs', import.meta.url));
+function observe(promise) {
+    return promise.then((value) => ({ status: 'fulfilled', value }), (reason) => ({ status: 'rejected', reason }));
+}
+async function bounded(promise, timeoutMs, label) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(label)), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function reasonMessage(reason) {
+    return reason instanceof Error ? reason.message : String(reason);
+}
+async function assertRejected(promise, expected, label) {
+    const outcome = await bounded(promise, 2_000, `${label}: close did not settle`);
+    assert.equal(outcome.status, 'rejected', `${label}: close must reject`);
+    const reason = outcome.reason;
+    // Since #518 close failures carry the typed safe diagnostic; the stable
+    // public meaning lives before its appended diagnostic payload.
+    assert.ok(reason instanceof ManagedDshCleanupError, `${label}: close failure carries the typed cleanup diagnostic`);
+    assert.equal(reason.message.split(';')[0], expected, `${label}: stable close error`);
+}
+async function settleInjectedHandle(port, originalWaitForExit, doneOutcome) {
+    const handle = port.handle;
+    handle.waitForExit = originalWaitForExit;
+    // The pinned fallback owner makes the real observation deterministic: the
+    // spawn never produced a child (no pid), so the owner's liveness probe is
+    // immediately false and confirmed-empty arrives without any provider-side
+    // wait. The bounded window stays as harness safety, not as a contract.
+    const rangeEmpty = await bounded(originalWaitForExit(AbortSignal.timeout(12_000)), 13_500, 'real handle cleanup did not settle');
+    assert.equal(rangeEmpty, true, 'real handle cleanup must confirm the range empty (deterministic fallback owner)');
+    const done = await bounded(doneOutcome, 2_500, 'real handle done did not settle');
+    assert.equal(done.status, 'rejected', 'real spawn-failure handle.done rejects');
+    await bounded(observe(port.close()), 2_500, 'sticky close promise did not settle');
+}
+const runtimeProto = LocalSubprocessRuntime.prototype;
+/**
+ * Construct the port with the runtime's PUBLIC test hooks pinned to the POSIX
+ * fallback owner for the one synchronous spawn the constructor performs.
+ * `platform: 'darwin'` routes selectContainmentMode away from the linux-scope
+ * owner whose uncancellable shared wait can hang the runner; the recorded
+ * `spawn` hook delegates to the real node spawn so the missing-cwd failure is
+ * genuine. Prototype and per-instance internals are restored before any
+ * asynchronous assertion can observe them.
+ */
+function constructPortWithFallbackOwner(options) {
+    const spawnCalls = [];
+    let pinnedInternals = null;
+    const originalProtoSpawn = runtimeProto.spawn;
+    runtimeProto.spawn = function (spec) {
+        pinnedInternals = this.internals;
+        const hadPlatform = Object.hasOwn(this.internals, 'platform');
+        const previousPlatform = this.internals.platform;
+        const previousSpawn = this.internals.spawn;
+        this.internals.platform = 'darwin';
+        this.internals.spawn = (program, args, opts) => {
+            spawnCalls.push({ program, args: [...args], options: opts });
+            return (previousSpawn ?? nodeSpawn)(program, args, opts);
+        };
+        try {
+            return originalProtoSpawn.call(this, spec);
+        }
+        finally {
+            if (previousSpawn !== undefined)
+                this.internals.spawn = previousSpawn;
+            else
+                delete this.internals.spawn;
+            if (hadPlatform)
+                this.internals.platform = previousPlatform;
+            else
+                delete this.internals.platform;
+        }
+    };
+    let port;
+    try {
+        port = new ManagedDshRunPort(options);
+    }
+    finally {
+        runtimeProto.spawn = originalProtoSpawn;
+    }
+    return { port, spawnCalls, pinnedInternals, prototypeRestored: runtimeProto.spawn === originalProtoSpawn };
+}
+async function proveCloseFailure(mode, expected, unhandled) {
+    const root = mkdtempSync(join(tmpdir(), `gotry-510-close-${mode}-`));
+    const missingCwd = join(root, 'missing-cwd');
+    const { port, spawnCalls, pinnedInternals, prototypeRestored } = constructPortWithFallbackOwner({
+        cwd: missingCwd,
+        workerPath,
+        graceMs: 50,
+    });
+    // Containment-selection coverage: the pinned platform hook must have routed
+    // this spawn through the POSIX fallback owner — the ordinary spawn hook
+    // fired exactly once for the real Node executable with the real missing
+    // cwd and detached POSIX options (the native linux-scope branch would have
+    // exec'd systemd-run instead).
+    assert.equal(spawnCalls.length, 1, `${mode}: ordinary spawn fired exactly once (fallback owner selected)`);
+    assert.equal(spawnCalls[0].program, process.execPath, `${mode}: real worker executable spawned`);
+    assert.equal(spawnCalls[0].args.at(-1), workerPath, `${mode}: real worker path spawned`);
+    assert.equal(spawnCalls[0].options.cwd, missingCwd, `${mode}: real missing cwd passed to the real spawn`);
+    assert.equal(spawnCalls[0].options.detached, true, `${mode}: detached POSIX fallback owner selected`);
+    // Hook restoration coverage: nothing observable of the test hooks may
+    // outlive the synchronous construction.
+    assert.ok(prototypeRestored, `${mode}: runtime prototype spawn restored`);
+    assert.ok(pinnedInternals !== null && !Object.hasOwn(pinnedInternals, 'platform') && !Object.hasOwn(pinnedInternals, 'spawn'), `${mode}: internals test hooks restored`);
+    const handle = port.handle;
+    const originalWaitForExit = handle.waitForExit.bind(handle);
+    const doneOutcome = observe(handle.done);
+    const unhandledAtStart = unhandled.length;
+    const injected = mode === 'reject'
+        ? () => Promise.reject(new Error('fault-injected observation failure'))
+        : () => Promise.resolve(false);
+    handle.waitForExit = injected;
+    try {
+        const closePromise = port.close();
+        const repeatedClosePromise = port.close();
+        assert.strictEqual(repeatedClosePromise, closePromise, `${mode}: repeated close returns one Promise`);
+        await assertRejected(observe(closePromise), expected, mode);
+        await assertRejected(observe(repeatedClosePromise), expected, `${mode} repeated close`);
+        await settleInjectedHandle(port, originalWaitForExit, doneOutcome);
+        // Give the real done rejection a turn to expose an unhandled derived
+        // outcome Promise. The proof itself observes every public close Promise.
+        await new Promise((resolve) => setImmediate(resolve));
+        await new Promise((resolve) => setImmediate(resolve));
+        assert.equal(unhandled.length, unhandledAtStart, `${mode}: no unhandled rejection from close cleanup (${unhandled.slice(unhandledAtStart).map(reasonMessage).join('; ')})`);
+    }
+    finally {
+        handle.waitForExit = originalWaitForExit;
+        await bounded(observe(port.close()), 2_500, `${mode}: final cleanup did not settle`);
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+const unhandled = [];
+const onUnhandled = (reason) => { unhandled.push(reason); };
+process.on('unhandledRejection', onUnhandled);
+try {
+    const failures = [];
+    for (const [mode, expected] of [
+        ['reject', 'managed DSH process tree observation failed'],
+        ['false', 'managed DSH process tree cleanup timeout'],
+    ]) {
+        try {
+            await proveCloseFailure(mode, expected, unhandled);
+        }
+        catch (error) {
+            failures.push(error);
+            console.error(`MANAGED DSH CLOSE FAILURE PROOF RED (${mode}):`, error);
+        }
+    }
+    if (failures.length > 0)
+        throw new AggregateError(failures, 'managed DSH close failure proof failed');
+    console.log('MANAGED DSH CLOSE FAILURE PROOF: observation reject/timeout are bounded, idempotent, and handled');
+}
+finally {
+    process.off('unhandledRejection', onUnhandled);
+}

package/dist/scripts/managed-dsh-run-port-proof.js

@@ -0,0 +1,153 @@
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import { ManagedDshRunPort } from '../src/booking-surface/managed-dsh-run-port.js';
+const workerPath = fileURLToPath(new URL('./fixtures/managed-dsh-worker-fixture.mjs', import.meta.url));
+const port = new ManagedDshRunPort({ workerPath, graceMs: 50 });
+const result = await port.run('fixture', { sessionId: 'managed-dsh-proof' });
+const pid = result.events[0].grandchildPid;
+assert.ok(Number.isInteger(pid) && pid > 0, 'fixture reports its grandchild pid');
+const started = Date.now();
+await port.close();
+assert.ok(Date.now() - started < 2_000, 'tree teardown is bounded');
+const deadline = Date.now() + 1_000;
+let alive = true;
+while (alive && Date.now() < deadline) {
+    try {
+        process.kill(pid, 0);
+    }
+    catch {
+        alive = false;
+    }
+    if (alive)
+        await new Promise((resolve) => setTimeout(resolve, 25));
+}
+assert.equal(alive, false, `TERM-resistant grandchild ${pid} must be reaped with its worker tree`);
+assert.ok(existsSync(join(process.cwd(), 'node_modules/@deepseek-ai/dsh-subprocess-local')), 'proof uses installed dsh subprocess-local runtime');
+console.log('MANAGED DSH RUN PORT TREE PROOF: bounded close reaps TERM-resistant grandchild');
+const pendingWorkerPath = fileURLToPath(new URL('./fixtures/managed-dsh-pending-worker-fixture.mjs', import.meta.url));
+async function waitForFile(path, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (!existsSync(path)) {
+        if (Date.now() >= deadline)
+            throw new Error(`fixture marker did not appear: ${path}`);
+        await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+}
+async function waitForFileText(path, expected, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (!existsSync(path) || readFileSync(path, 'utf8') !== expected) {
+        if (Date.now() >= deadline)
+            throw new Error(`fixture marker did not reach ${expected}: ${path}`);
+        await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+}
+async function waitForDead(pid, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        try {
+            process.kill(pid, 0);
+        }
+        catch {
+            return;
+        }
+        if (Date.now() >= deadline)
+            throw new Error(`fixture process ${pid} was not reaped`);
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+}
+async function bounded(promise, timeoutMs, label) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(label)), timeoutMs); }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function assertPendingRejected(settledPromise, expected, label) {
+    const settled = await bounded(settledPromise, 1_500, `${label}: pending requests did not settle`);
+    assert.equal(settled.length, expected, `${label}: every pending request settled`);
+    assert.ok(settled.every((entry) => entry.status === 'rejected'), `${label}: every pending request rejected`);
+}
+async function proveWorkerExitRejectsPending() {
+    const root = mkdtempSync(join(tmpdir(), 'gotry-managed-dsh-exit-'));
+    const pidFile = join(root, 'pid.json');
+    const requestFile = join(root, 'requests');
+    const statusFile = join(root, 'status.json');
+    const port = new ManagedDshRunPort({
+        workerPath: pendingWorkerPath,
+        graceMs: 50,
+        env: {
+            ...process.env,
+            MANAGED_DSH_FIXTURE_PID_FILE: pidFile,
+            MANAGED_DSH_FIXTURE_REQUEST_FILE: requestFile,
+            MANAGED_DSH_FIXTURE_STATUS_FILE: statusFile,
+            MANAGED_DSH_FIXTURE_EXIT_AFTER_REQUESTS: '3',
+            MANAGED_DSH_FIXTURE_EXIT_CODE: '23',
+        },
+    });
+    try {
+        await waitForFile(pidFile, 1_000);
+        const pending = [
+            port.run('first pending run', { sessionId: 'managed-dsh-exit-1' }),
+            port.run('second pending run', { sessionId: 'managed-dsh-exit-2' }),
+            port.warmup(),
+        ];
+        const settledPromise = Promise.allSettled(pending);
+        await waitForFileText(requestFile, '3', 1_000);
+        await assertPendingRejected(settledPromise, pending.length, 'worker exit');
+        await waitForFile(statusFile, 1_000);
+        const status = JSON.parse(readFileSync(statusFile, 'utf8'));
+        assert.equal(status.exitCode, 23, 'fixture exit code is recorded');
+        assert.equal(status.signal, null, 'fixture exited without a signal');
+        assert.ok(status.stderr.length <= 128, 'fixture stderr evidence is bounded');
+        assert.equal(status.stderr.includes('PRIVATE_'), false, 'fixture stderr evidence contains no sensitive marker');
+    }
+    finally {
+        await port.close().catch(() => undefined);
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+async function proveCloseRejectsPendingAndReapsTree() {
+    const root = mkdtempSync(join(tmpdir(), 'gotry-managed-dsh-close-'));
+    const pidFile = join(root, 'pid.json');
+    const requestFile = join(root, 'requests');
+    const port = new ManagedDshRunPort({
+        workerPath: pendingWorkerPath,
+        graceMs: 50,
+        env: { ...process.env, MANAGED_DSH_FIXTURE_PID_FILE: pidFile, MANAGED_DSH_FIXTURE_REQUEST_FILE: requestFile },
+    });
+    try {
+        await waitForFile(pidFile, 1_000);
+        const pids = JSON.parse(readFileSync(pidFile, 'utf8'));
+        assert.ok(Number.isInteger(pids.workerPid) && Number.isInteger(pids.grandchildPid), 'pending fixture reports its worker tree');
+        const pending = [
+            port.run('first close run', { sessionId: 'managed-dsh-close-1' }),
+            port.run('second close run', { sessionId: 'managed-dsh-close-2' }),
+            port.warmup(),
+        ];
+        const settledPromise = Promise.allSettled(pending);
+        await waitForFileText(requestFile, '3', 1_000);
+        const closeStarted = Date.now();
+        const closePromise = port.close();
+        assert.strictEqual(port.close(), closePromise, 'repeated close returns the same cleanup promise');
+        await assertPendingRejected(settledPromise, pending.length, 'caller close');
+        await closePromise;
+        assert.ok(Date.now() - closeStarted < 2_000, 'caller close and pending rejection are bounded');
+        await waitForDead(pids.workerPid, 1_000);
+        await waitForDead(pids.grandchildPid, 1_000);
+    }
+    finally {
+        await port.close().catch(() => undefined);
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+await proveWorkerExitRejectsPending();
+await proveCloseRejectsPendingAndReapsTree();
+console.log('MANAGED DSH RUN PORT PENDING PROOF: worker exit and caller close reject two runs plus warmup; tree cleanup remains bounded');