@mindrian_os/cli 1.13.0-beta.10 → 1.13.0-beta.44

package/lib/memory/brain-derivation-graceful-degradation.test.cjs

@@ -1,1019 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/*
- * Copyright (c) 2026 Mindrian. BSL 1.1.
- *
- * Phase 90-08 -- Graceful Degradation End-to-End Suite
- * ====================================================
- * Third-line defense for Phase 90. Proves the Brain derivation layer
- * survives every realistic failure mode with four invariants intact:
- *
- *   A. NO CRASH -- no uncaught exception; deriveSection / aggregator /
- *      dispatcher NEVER throw; every path returns a structured result.
- *   B. NO CORRUPTION -- no partial BRAIN.md left on disk; no
- *      BRAIN.md.tmp.*.brain orphans; atomic rename contract honored.
- *   C. USER-VISIBLE STATUS -- caller learns what happened via
- *      {success:false, reason:'...'} OR stderr / stdout markers.
- *   D. RETRY PATH -- after the failure clears (Brain back online, etc.),
- *      re-running the same invocation produces a correct BRAIN.md at
- *      the same path.
- *
- * Canon Part 8 is asserted AS A FAILURE-MODE GUARANTEE: every scenario
- * that lands a BRAIN.md on disk is grep-scanned against the frozen
- * FORBIDDEN_PATTERNS set; every captured Brain query payload is scanned
- * too. If the boundary is real, it survives every failure.
- *
- * Scenarios (14):
- *   01 Brain offline permanent
- *   02 Brain offline intermittent (succeeds then fails)
- *   03 API quota exhausted (rate_limited)
- *   04 Timeout mid-derivation (hanging promise)
- *   05 Schema drift mid-session (brain_graph_version shifts)
- *   06 Malformed Brain response
- *   07 Network partition (ECONNREFUSED)
- *   08 Filesystem EACCES on section dir
- *   09 Disk full on atomic rename (ENOSPC)
- *   10 Concurrent deriveSection on same section
- *   11 Canon Part 8 regression under ordinary operation
- *       (dangerous fixture; Brain succeeds normally)
- *   12 Canon Part 8 regression under timeout
- *       (dangerous fixture; Brain times out)
- *   13 Cross-room aggregator survives corrupt peer room
- *   14 Concurrent session-start staleness scans (queue idempotency)
- *
- * Cross-cutting audits (after all scenarios):
- *   A1 Canon Part 8 forbidden-regex sweep across every BRAIN.md landed
- *   A2 Orphan tmpfile sweep across every tmp dir touched
- *
- * Runtime budget: total suite < 30 seconds. Each scenario self-contained
- * via mkdtempSync + require.cache mock.
- *
- * Pure CJS, node built-ins only, zero npm deps.
- */
-
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const crypto = require('node:crypto');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-// ---------- Suite-wide state ----------
-
-let passed = 0;
-let failed = 0;
-const failures = [];
-
-// Track every tmp root created so A2 can sweep for orphans.
-const TMP_ROOTS = [];
-// Track every BRAIN.md written so A1 can scan for forbidden regex hits.
-const LANDED_BRAIN_FILES = [];
-
-// Suite-wide wall clock.
-const SUITE_START = Date.now();
-
-// ---------- Canon Part 8 forbidden-regex set ----------
-//
-// Byte-for-byte parity with lib/core/cross-room-aggregator.cjs
-// FORBIDDEN_PATTERNS + the same set used by Plan 90-05 invariants.
-// If this drifts from the canonical set, downstream tests will fail
-// open. Keep in sync.
-
-const FORBIDDEN_PATTERNS = Object.freeze([
-  /@[a-zA-Z0-9._-]+\.[a-zA-Z]{2,}/,                                       // email
-  /\$[0-9][\d,.]*[KMB]?\b/,                                               // currency magnitude
-  /\b(Lawrence|Jonathan|Nimrod|Oren|Dror)\s+(said|revealed|told|mentioned)\b/i, // quoted-person
-  /\bmeeting with\b/i,                                                    // meeting fragment
-  /\b\d{3}-\d{2}-\d{4}\b/,                                                // SSN-like
-  /\b\+?1?[\s.\-]?\(?\d{3}\)?[\s.\-]?\d{3}[\s.\-]?\d{4}\b/,                // phone-like
-]);
-
-// Extra forbidden tokens used by the adversarial fixtures (hard subset;
-// not regex-reachable from FORBIDDEN_PATTERNS alone).
-const DANGEROUS_SUBSTRINGS = Object.freeze([
-  'Lawrence',
-  '5M',
-  'revenue',
-  'Q4 meeting',
-  'jonathan@mindrian.com',
-  '123-45-6789',
-]);
-
-// ---------- Tmp + filesystem helpers ----------
-
-function mkTmp(tag) {
-  const d = fs.mkdtempSync(path.join(os.tmpdir(), 'gd-' + tag + '-'));
-  TMP_ROOTS.push(d);
-  return d;
-}
-
-function writeFile(p, body) {
-  fs.mkdirSync(path.dirname(p), { recursive: true });
-  fs.writeFileSync(p, body, 'utf8');
-}
-
-// Walk + chmod to restore before rmSync (needed for Scenario 08).
-function walkChmod(root, mode) {
-  try {
-    fs.chmodSync(root, mode);
-    const entries = fs.readdirSync(root, { withFileTypes: true });
-    for (const e of entries) {
-      const p = path.join(root, e.name);
-      if (e.isDirectory()) walkChmod(p, mode);
-      else {
-        try { fs.chmodSync(p, mode); } catch (_e) { /* best effort */ }
-      }
-    }
-  } catch (_e) { /* best effort */ }
-}
-
-process.on('exit', function () {
-  for (const d of TMP_ROOTS) {
-    try {
-      walkChmod(d, 0o755);
-      fs.rmSync(d, { recursive: true, force: true });
-    } catch (_e) { /* best effort */ }
-  }
-});
-
-// Count orphan tmpfiles under a directory (recursive).
-function countOrphanTmpfiles(root) {
-  let count = 0;
-  const orphans = [];
-  function walk(dir) {
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-    catch (_e) { return; }
-    for (const e of entries) {
-      const p = path.join(dir, e.name);
-      if (e.isDirectory()) walk(p);
-      else if (/BRAIN\.md\.tmp\..*\.brain$/.test(e.name)) {
-        count += 1;
-        orphans.push(p);
-      }
-    }
-  }
-  walk(root);
-  return { count: count, paths: orphans };
-}
-
-// ---------- Fixture builders ----------
-
-function buildSection(sectionPath, opts) {
-  opts = opts || {};
-  fs.mkdirSync(sectionPath, { recursive: true });
-  const section = path.basename(sectionPath);
-  writeFile(path.join(sectionPath, 'ROOM.md'), [
-    '---',
-    'name: "' + section + '"',
-    'kind: section',
-    'created_at: "2026-04-20T00:00:00Z"',
-    'updated_at: "2026-04-20T00:00:00Z"',
-    '---',
-    '',
-    '# ' + section,
-    '',
-    opts.identity_text || 'A generic venture identity paragraph with zero personal data.',
-    '',
-    '## Section links',
-    '',
-  ].join('\n'));
-  writeFile(path.join(sectionPath, 'STATE.md'), [
-    '---',
-    'artifact_count: ' + (opts.artifact_count || 2),
-    'gap_status: ' + (opts.gap_status || 'partial'),
-    'completeness_score: ' + (opts.completeness_score || 0.5),
-    'minto_health: ' + (opts.minto_health || 'ok'),
-    'last_activity_at: "2026-04-20T00:00:00Z"',
-    '---',
-    '',
-    '## State',
-    '',
-  ].join('\n'));
-  const governingThought = opts.governing_thought === undefined
-    ? 'The venture needs to validate its primary assumption within 90 days.'
-    : opts.governing_thought;
-  const argsCount = opts.arguments_count == null ? 4 : opts.arguments_count;
-  const evDensity = opts.evidence_density == null ? 0.6 : opts.evidence_density;
-  const meceStatus = opts.mece_status || 'pass';
-  const rhs = opts.reasoning_health_score == null ? 0.7 : opts.reasoning_health_score;
-  writeFile(path.join(sectionPath, 'MINTO.md'), [
-    '---',
-    'schema_version: 88',
-    'version: 1',
-    'section: "' + section + '"',
-    'last_generated_at: "2026-04-20T00:00:00Z"',
-    'last_artifact_write_seen_at: "2026-04-20T00:00:00Z"',
-    'arguments_count: ' + argsCount,
-    'evidence_density: ' + evDensity,
-    'mece_status: ' + meceStatus,
-    'reasoning_health_score: ' + rhs,
-    'flagged_weaknesses: []',
-    'decision_log: []',
-    '---',
-    '',
-    '## Governing Thought',
-    '',
-    governingThought || '(empty)',
-    '',
-    '## Arguments',
-    '',
-    '- arg 1',
-    '- arg 2',
-    '',
-  ].join('\n'));
-}
-
-// Build a room with N sections. Returns { root, sections: [absolute paths] }.
-function buildRoom(opts) {
-  opts = opts || {};
-  const root = mkTmp(opts.tag || 'room');
-  const count = Number.isFinite(opts.count) ? opts.count : 3;
-  const sections = [];
-  for (let i = 1; i <= count; i++) {
-    const name = opts.names && opts.names[i - 1] ? opts.names[i - 1] : ('section-' + i);
-    const p = path.join(root, name);
-    buildSection(p, opts.sectionOpts ? opts.sectionOpts(i, name) : {});
-    sections.push(p);
-  }
-  return { root: root, sections: sections };
-}
-
-// Dangerous-content fixture used by Scenarios 11 + 12.
-function buildDangerousSection(sectionPath) {
-  buildSection(sectionPath, {
-    identity_text: 'The room identity mentions Lawrence said 5M revenue at the Q4 meeting with jonathan@mindrian.com.',
-    governing_thought: 'Lawrence said we will hit 5M revenue by Q4 if pricing holds. SSN 123-45-6789 was leaked.',
-  });
-}
-
-// ---------- Brain-client mock helpers ----------
-
-function installMockBrainClient(opts) {
-  opts = opts || {};
-  const audit = {
-    isAvailable_calls: 0,
-    schema_calls: 0,
-    query_calls: [],
-    search_calls: [],
-    smartSearch_calls: [],
-  };
-  const brainClientPath = require.resolve('../core/brain-client.cjs');
-  const realClient = require('../core/brain-client.cjs');
-  const fakeExports = {
-    isAvailable: function () {
-      audit.isAvailable_calls += 1;
-      if (typeof opts.isAvailable === 'function') return opts.isAvailable(audit.isAvailable_calls);
-      return opts.isAvailable === undefined ? true : !!opts.isAvailable;
-    },
-    schema: async function () {
-      audit.schema_calls += 1;
-      if (typeof opts.schemaReturn === 'function') return opts.schemaReturn(audit.schema_calls);
-      if (opts.schemaThrows) { throw new Error(opts.schemaThrows); }
-      return opts.schemaReturn || { brain_graph_version: 21432 };
-    },
-    query: async function (cypher) {
-      audit.query_calls.push({ cypher: cypher });
-      if (typeof opts.query === 'function') return opts.query(cypher, audit.query_calls.length);
-      return { records: [{ name: 'SWOT', description: 'Classic framework' }] };
-    },
-    search: async function (q, o) {
-      audit.search_calls.push({ query: q, options: o });
-      if (typeof opts.search === 'function') return opts.search(q, o, audit.search_calls.length);
-      return { matches: [{ title: 'Analogy 1', score: 0.8 }] };
-    },
-    smartSearch: async function (q, o) {
-      audit.smartSearch_calls.push({ query: q, options: o });
-      return null;
-    },
-    _test: realClient._test,
-  };
-  require.cache[brainClientPath] = {
-    id: brainClientPath,
-    filename: brainClientPath,
-    loaded: true,
-    exports: fakeExports,
-  };
-  return audit;
-}
-
-function resetRequireCache() {
-  const targets = [
-    '../core/brain-client.cjs',
-    '../core/brain-derivation.cjs',
-    '../core/brain-derivation-prompts.cjs',
-    '../core/brain-derivation-queue.cjs',
-    '../core/cross-room-aggregator.cjs',
-    '../core/folder-memory.cjs',
-    '../core/folder-memory-shared.cjs',
-  ];
-  for (const t of targets) {
-    try {
-      const p = require.resolve(t);
-      delete require.cache[p];
-    } catch (_e) { /* best effort */ }
-  }
-}
-
-// Capture a deriveSection result's on-disk BRAIN.md (if any) for the A1
-// cross-cutting audit.
-function recordLandedBrainMd(sectionPath) {
-  const p = path.join(sectionPath, 'BRAIN.md');
-  if (fs.existsSync(p)) LANDED_BRAIN_FILES.push(p);
-}
-
-// Run a deriveSection call and assert invariants A + B + C. Returns the
-// result object for scenario-specific assertions.
-//
-// Invariant A: never throws. Promise rejection counts as a crash.
-// Invariant B: no orphan tmpfile in sectionPath after the call.
-// Invariant C: result is a structured object with success boolean.
-async function runDerive(sectionPath, options) {
-  const { deriveSection } = require('../core/brain-derivation.cjs');
-  const roomPath = path.dirname(sectionPath);
-  const section = path.basename(sectionPath);
-  let result;
-  let threw = false;
-  let err = null;
-  try {
-    result = await deriveSection(roomPath, section, options || {});
-  } catch (e) {
-    threw = true;
-    err = e;
-  }
-  // Invariant A.
-  assert.equal(threw, false, 'deriveSection must NEVER throw; got: ' + (err && err.stack ? err.stack : String(err)));
-  // Invariant B.
-  const orphans = countOrphanTmpfiles(sectionPath);
-  assert.equal(orphans.count, 0, 'orphan tmpfile detected after deriveSection: ' + orphans.paths.join(','));
-  // Invariant C.
-  assert.equal(typeof result, 'object', 'deriveSection must return an object');
-  assert.equal(typeof result.success, 'boolean', 'result.success must be a boolean');
-  // Record for A1.
-  recordLandedBrainMd(sectionPath);
-  return result;
-}
-
-// ---------- Scenario runner ----------
-
-async function runScenario(name, fn) {
-  resetRequireCache();
-  const start = Date.now();
-  try {
-    await fn();
-    passed += 1;
-    process.stdout.write('  ok  ' + name + '  (' + (Date.now() - start) + 'ms)\n');
-  } catch (err) {
-    failed += 1;
-    failures.push({ name: name, err: err });
-    process.stderr.write('  FAIL  ' + name + '\n');
-    process.stderr.write('        ' + (err && err.stack ? err.stack : err) + '\n');
-  } finally {
-    // Leave tmp dirs for the post-suite A2 sweep; cleaned on process exit.
-  }
-}
-
-// ---------- 14 SCENARIOS ----------
-
-async function main() {
-
-  // ------------------------------------------------------------------
-  // Scenario 01: Brain offline PERMANENT
-  // ------------------------------------------------------------------
-  // Setup: isAvailable returns false for every call.
-  // Action: deriveSection on 5 sections.
-  // Assert: no BRAIN.md written; every call returns {success:false,
-  //         reason:'brain_unavailable'}; no crash; no tmpfile debris;
-  //         audit shows zero query/search calls fired (boundary holds
-  //         under the offline failure mode).
-  //
-  // Retry path (D): re-run with Brain online -> success.
-  await runScenario('Scenario 01: Brain offline permanent', async function () {
-    const audit = installMockBrainClient({ isAvailable: false });
-    const { root, sections } = buildRoom({ tag: 's01', count: 5 });
-    const results = [];
-    for (const s of sections) {
-      const r = await runDerive(s, {});
-      results.push(r);
-    }
-    // Invariant A (no crash) + B (no corruption) asserted by runDerive.
-    // Invariant C: user-visible status.
-    for (const r of results) {
-      assert.equal(r.success, false);
-      assert.equal(r.reason, 'brain_unavailable', 'offline scenario must yield brain_unavailable');
-      assert.equal(r.cost_tokens, 0);
-    }
-    // Zero BRAIN.md on disk.
-    for (const s of sections) {
-      assert.equal(fs.existsSync(path.join(s, 'BRAIN.md')), false, 'no BRAIN.md when Brain is offline');
-    }
-    // Part 8 under failure: zero Brain payload traffic.
-    assert.equal(audit.query_calls.length, 0, 'zero query calls under offline');
-    assert.equal(audit.search_calls.length, 0, 'zero search calls under offline');
-    assert.equal(audit.schema_calls, 0, 'zero schema calls under offline');
-    // Invariant D (retry path): Brain back online -> success.
-    resetRequireCache();
-    installMockBrainClient({});
-    const r2 = await runDerive(sections[0], {});
-    assert.equal(r2.success, true, 'retry after Brain online must succeed');
-    assert.ok(fs.existsSync(path.join(sections[0], 'BRAIN.md')), 'retry writes BRAIN.md');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 02: Brain offline INTERMITTENT
-  // ------------------------------------------------------------------
-  // Setup: isAvailable -> true, but a throw on the third section's
-  //        schema() fires. The first two must derive cleanly.
-  // Action: sequentially deriveSection on 5 sections.
-  // Assert: exactly 2 BRAIN.md files written; 3 failures report
-  //         structured reason; no tmpfile debris anywhere.
-  await runScenario('Scenario 02: Brain offline intermittent', async function () {
-    // State machine: schema_calls >= 3 throws brain_unavailable.
-    let schemaCalls = 0;
-    installMockBrainClient({
-      isAvailable: true,
-      schemaReturn: function () {
-        schemaCalls += 1;
-        if (schemaCalls >= 3) {
-          throw new Error('brain_unavailable; backend dropped');
-        }
-        return { brain_graph_version: 21432 };
-      },
-    });
-    const { root, sections } = buildRoom({ tag: 's02', count: 5 });
-    const results = [];
-    for (const s of sections) {
-      results.push(await runDerive(s, {}));
-    }
-    // First 2 succeed; sections 3-5 fail (derivation_error/brain_unavailable).
-    assert.equal(results[0].success, true);
-    assert.equal(results[1].success, true);
-    for (let i = 2; i < 5; i++) {
-      assert.equal(results[i].success, false);
-      assert.ok(
-        results[i].reason === 'derivation_error' ||
-        results[i].reason === 'brain_unavailable' ||
-        results[i].reason === 'derivation_timeout',
-        'intermittent failure reason expected; got ' + results[i].reason
-      );
-    }
-    // Exactly 2 BRAIN.md on disk.
-    let landed = 0;
-    for (const s of sections) {
-      if (fs.existsSync(path.join(s, 'BRAIN.md'))) landed += 1;
-    }
-    assert.equal(landed, 2, 'exactly 2 BRAIN.md under intermittent offline');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 03: API quota exhausted (rate_limited after 1 call)
-  // ------------------------------------------------------------------
-  // Setup: the first section's query pipeline succeeds, second section's
-  //        FIRST cypher call throws 429.
-  // Action: sequential deriveSection on 5 sections.
-  // Assert: exactly 1 BRAIN.md (section 1); sections 2..5 all report
-  //         reason=rate_limited (subsequent ones also because the mock
-  //         persists the 429 for every section 2+ query).
-  await runScenario('Scenario 03: API quota exhausted', async function () {
-    let sectionCount = 0;
-    // Track which section boundary we are in by schema() calls (one per
-    // deriveSection). After the first deriveSection, flip the rate-limit.
-    installMockBrainClient({
-      schemaReturn: function () {
-        sectionCount += 1;
-        return { brain_graph_version: 21432 };
-      },
-      query: function (cypher) {
-        if (sectionCount >= 2) {
-          throw new Error('429 rate_limited too many requests');
-        }
-        return { records: [{ name: 'SWOT' }] };
-      },
-      search: function () {
-        if (sectionCount >= 2) {
-          throw new Error('429 rate_limited too many requests');
-        }
-        return { matches: [{ title: 'Analogy 1' }] };
-      },
-    });
-    const { sections } = buildRoom({ tag: 's03', count: 5 });
-    const results = [];
-    for (const s of sections) {
-      results.push(await runDerive(s, {}));
-    }
-    assert.equal(results[0].success, true, 'first section must succeed before rate-limit');
-    for (let i = 1; i < 5; i++) {
-      assert.equal(results[i].success, false, 'section ' + (i + 1) + ' should fail under rate limit');
-      assert.equal(results[i].reason, 'rate_limited',
-        'expected rate_limited; got ' + results[i].reason + ' for section ' + (i + 1));
-    }
-    let landed = 0;
-    for (const s of sections) {
-      if (fs.existsSync(path.join(s, 'BRAIN.md'))) landed += 1;
-    }
-    assert.equal(landed, 1, 'exactly 1 BRAIN.md after rate-limit mid-batch');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 04: Timeout mid-derivation (hanging promise)
-  // ------------------------------------------------------------------
-  // Setup: query returns a promise that rejects after 200ms with ETIMEDOUT.
-  // Action: deriveSection; assert we come back promptly.
-  // Assert: success:false; reason is timeout-flavored; no BRAIN.md.
-  //
-  // Invariant D (retry): remove the timeout behavior, re-run -> success.
-  await runScenario('Scenario 04: Timeout mid-derivation', async function () {
-    installMockBrainClient({
-      query: function () {
-        return new Promise(function (_resolve, reject) {
-          setTimeout(function () { reject(new Error('ETIMEDOUT brain query timed out')); }, 50);
-        });
-      },
-    });
-    const { sections } = buildRoom({ tag: 's04', count: 1 });
-    const s = sections[0];
-    const start = Date.now();
-    const r = await runDerive(s, {});
-    const elapsed = Date.now() - start;
-    assert.ok(elapsed < 5000, 'deriveSection timeout path must not hang (elapsed ' + elapsed + 'ms)');
-    assert.equal(r.success, false);
-    assert.ok(
-      r.reason === 'derivation_timeout' || r.reason === 'derivation_error',
-      'timeout reason expected; got ' + r.reason
-    );
-    assert.equal(fs.existsSync(path.join(s, 'BRAIN.md')), false);
-    // Retry path (D).
-    resetRequireCache();
-    installMockBrainClient({});
-    const r2 = await runDerive(s, {});
-    assert.equal(r2.success, true, 'retry after timeout clears must succeed');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 05: Schema drift mid-session
-  // ------------------------------------------------------------------
-  // Setup: schema() returns brain_graph_version=100 for first section,
-  //        101 for second, 100 again for third.
-  // Action: 3 deriveSection calls.
-  // Assert: all 3 write BRAIN.md; each BRAIN.md records the version that
-  //         was live at derivation time; no corruption. (Plan 90-05
-  //         staleness re-check is a separate concern.)
-  await runScenario('Scenario 05: Schema drift mid-session', async function () {
-    let idx = 0;
-    const versions = [100, 101, 100];
-    installMockBrainClient({
-      schemaReturn: function () {
-        const v = versions[idx] || 100;
-        idx += 1;
-        return { brain_graph_version: v };
-      },
-    });
-    const { sections } = buildRoom({ tag: 's05', count: 3 });
-    const results = [];
-    for (const s of sections) {
-      results.push(await runDerive(s, {}));
-    }
-    for (const r of results) assert.equal(r.success, true);
-    // Each BRAIN.md carries its frontmatter brain_graph_version.
-    const bodies = sections.map(function (s) { return fs.readFileSync(path.join(s, 'BRAIN.md'), 'utf8'); });
-    assert.ok(/brain_graph_version:\s*100/.test(bodies[0]), 'section 1 must record v100');
-    assert.ok(/brain_graph_version:\s*101/.test(bodies[1]), 'section 2 must record v101');
-    assert.ok(/brain_graph_version:\s*100/.test(bodies[2]), 'section 3 must record v100');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 06: Malformed Brain response
-  // ------------------------------------------------------------------
-  // Setup: query returns {results: 'not-an-array'} (wrong shape).
-  // Action: deriveSection.
-  // Assert: deriveSection does NOT crash; renderRecords coerces to
-  //         empty / '(no signal)'; BRAIN.md STILL lands with empty
-  //         section bodies (the derivation layer tolerates malformed
-  //         records the same as empty results).
-  //
-  // (The canonical "malformed" case the Brain API can emit in practice
-  // is a well-formed JSON payload with an unexpected array shape; the
-  // renderer is defensive by design. This scenario proves that.)
-  await runScenario('Scenario 06: Malformed Brain response', async function () {
-    installMockBrainClient({
-      query: function () { return { results: 'not-an-array-as-expected' }; },
-      search: function () { return { hits: 'also-not-an-array' }; },
-    });
-    const { sections } = buildRoom({ tag: 's06', count: 1 });
-    const s = sections[0];
-    const r = await runDerive(s, {});
-    assert.equal(r.success, true, 'malformed responses must not crash the derivation');
-    const body = fs.readFileSync(path.join(s, 'BRAIN.md'), 'utf8');
-    // Every section body falls through to (no signal) since records are
-    // not in the expected shape.
-    assert.ok(/no signal/.test(body), 'body must mark sections as no signal under malformed response');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 07: Network partition (ECONNREFUSED)
-  // ------------------------------------------------------------------
-  // Setup: query throws Error('ECONNREFUSED ...') synchronously.
-  // Action: deriveSection.
-  // Assert: success:false; reason derivation_error (no more specific
-  //         category); no BRAIN.md; no tmpfile.
-  await runScenario('Scenario 07: Network partition', async function () {
-    installMockBrainClient({
-      query: function () { throw new Error('ECONNREFUSED brain.mindrian.ai:443'); },
-      search: function () { throw new Error('ECONNREFUSED brain.mindrian.ai:443'); },
-    });
-    const { sections } = buildRoom({ tag: 's07', count: 1 });
-    const s = sections[0];
-    const r = await runDerive(s, {});
-    assert.equal(r.success, false);
-    assert.ok(r.reason === 'derivation_error' || r.reason === 'brain_unavailable' || r.reason === 'derivation_timeout',
-      'network partition reason; got ' + r.reason);
-    assert.equal(fs.existsSync(path.join(s, 'BRAIN.md')), false);
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 08: Filesystem EACCES
-  // ------------------------------------------------------------------
-  // Setup: chmod section dir to 0o555 (read+execute, no write). rename
-  //        into the dir should fail with EACCES.
-  // Action: deriveSection.
-  // Assert: success:false; reason fs_error; no BRAIN.md; no tmpfile.
-  //
-  // Retry (D): restore permissions and re-derive -> success.
-  await runScenario('Scenario 08: Filesystem EACCES', async function () {
-    // Skip on root (tests cannot simulate EACCES as root -- bypass perms).
-    if (typeof process.getuid === 'function' && process.getuid() === 0) {
-      process.stdout.write('  skip  EACCES scenario skipped (running as root)\n');
-      return;
-    }
-    installMockBrainClient({});
-    const { sections } = buildRoom({ tag: 's08', count: 1 });
-    const s = sections[0];
-    // Make the section dir read-only.
-    fs.chmodSync(s, 0o555);
-    try {
-      const r = await runDerive(s, {});
-      // Either fs_error or write path blocked; assert no BRAIN.md.
-      assert.equal(r.success, false, 'expected failure under EACCES');
-      assert.ok(r.reason === 'fs_error' || r.reason === 'schema_rejected' || /fs|access|perm/i.test(r.reason || ''),
-        'expected fs_error-flavored reason; got ' + r.reason);
-      assert.equal(fs.existsSync(path.join(s, 'BRAIN.md')), false);
-    } finally {
-      // Restore before cleanup (so rmSync can enter) and for retry path.
-      fs.chmodSync(s, 0o755);
-    }
-    // Retry (D).
-    resetRequireCache();
-    installMockBrainClient({});
-    const r2 = await runDerive(s, {});
-    assert.equal(r2.success, true, 'retry after perms restored must succeed');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 09: Disk full on atomic rename (ENOSPC)
-  // ------------------------------------------------------------------
-  // Setup: monkey-patch fs.renameSync to throw ENOSPC the first call.
-  // Action: deriveSection.
-  // Assert: success:false; reason fs_error; tmpfile cleaned; no BRAIN.md.
-  //
-  // Retry (D): restore fs.renameSync, re-run -> success.
-  await runScenario('Scenario 09: Disk full on atomic rename (ENOSPC)', async function () {
-    installMockBrainClient({});
-    const { sections } = buildRoom({ tag: 's09', count: 1 });
-    const s = sections[0];
-    const origRename = fs.renameSync;
-    let thrown = false;
-    fs.renameSync = function (from, to) {
-      if (!thrown && typeof from === 'string' && from.indexOf('BRAIN.md.tmp') !== -1) {
-        thrown = true;
-        const err = new Error('ENOSPC: no space left on device');
-        err.code = 'ENOSPC';
-        throw err;
-      }
-      return origRename.apply(fs, arguments);
-    };
-    try {
-      const r = await runDerive(s, {});
-      assert.equal(r.success, false);
-      assert.equal(r.reason, 'fs_error', 'ENOSPC must surface as fs_error; got ' + r.reason);
-      assert.equal(fs.existsSync(path.join(s, 'BRAIN.md')), false);
-    } finally {
-      fs.renameSync = origRename;
-    }
-    // Retry (D).
-    resetRequireCache();
-    installMockBrainClient({});
-    const r2 = await runDerive(s, {});
-    assert.equal(r2.success, true, 'retry after ENOSPC clears must succeed');
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 10: Concurrent deriveSection on same section
-  // ------------------------------------------------------------------
-  // Setup: launch two deriveSection calls via Promise.all on same path.
-  // Action: Promise.all([deriveSection, deriveSection]).
-  // Assert: at least one succeeds; BRAIN.md lands; no tmpfile debris.
-  //         If one loses the race, its reason is fs_error (EEXIST from
-  //         exclusive-create wx-flag openSync on the same tmpfile).
-  await runScenario('Scenario 10: Concurrent deriveSection on same section', async function () {
-    installMockBrainClient({});
-    const { sections } = buildRoom({ tag: 's10', count: 1 });
-    const s = sections[0];
-    const { deriveSection } = require('../core/brain-derivation.cjs');
-    const roomPath = path.dirname(s);
-    const section = path.basename(s);
-    const [a, b] = await Promise.all([
-      deriveSection(roomPath, section, {}),
-      deriveSection(roomPath, section, {}),
-    ]);
-    // At least one must have succeeded.
-    assert.ok(a.success || b.success, 'at least one concurrent deriveSection must succeed');
-    // BRAIN.md present on disk.
-    assert.ok(fs.existsSync(path.join(s, 'BRAIN.md')));
-    // No tmpfile debris.
-    const orphans = countOrphanTmpfiles(s);
-    assert.equal(orphans.count, 0, 'no orphan tmpfiles after concurrent calls');
-    recordLandedBrainMd(s);
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 11: Canon Part 8 under ORDINARY operation (dangerous fixture)
-  // ------------------------------------------------------------------
-  // Setup: dangerous triple ("Lawrence said 5M", emails, SSN).
-  //        Brain succeeds normally.
-  // Action: deriveSection.
-  // Assert: BRAIN.md lands; forbidden regex set finds ZERO hits in
-  //         BRAIN.md body; every captured Brain payload (cypher +
-  //         pinecone search) is scrubbed of the same forbidden
-  //         patterns. Canon Part 8 holds under normal operation.
-  await runScenario('Scenario 11: Canon Part 8 under ordinary operation', async function () {
-    const audit = installMockBrainClient({});
-    const { sections } = buildRoom({
-      tag: 's11',
-      count: 1,
-      names: ['market-analysis'],
-      sectionOpts: function () { return {}; }, // placeholder
-    });
-    // Overwrite with dangerous content.
-    buildDangerousSection(sections[0]);
-    const r = await runDerive(sections[0], {});
-    assert.equal(r.success, true, 'ordinary derivation must succeed');
-    const body = fs.readFileSync(path.join(sections[0], 'BRAIN.md'), 'utf8');
-    for (const bad of DANGEROUS_SUBSTRINGS) {
-      assert.equal(body.indexOf(bad), -1, 'BRAIN.md leaks dangerous substring: ' + bad);
-    }
-    for (const re of FORBIDDEN_PATTERNS) {
-      assert.equal(re.test(body), false, 'BRAIN.md matches forbidden regex: ' + re);
-    }
-    // Brain payload audit.
-    const payloads = [
-      ...audit.query_calls.map(function (c) { return c.cypher; }),
-      ...audit.search_calls.map(function (c) { return String(c.query || ''); }),
-    ];
-    assert.ok(payloads.length >= 1, 'at least 1 Brain payload expected');
-    for (const p of payloads) {
-      for (const bad of DANGEROUS_SUBSTRINGS) {
-        assert.equal(p.indexOf(bad), -1, 'Brain payload leaks ' + bad + ': ' + p);
-      }
-      for (const re of FORBIDDEN_PATTERNS) {
-        assert.equal(re.test(p), false, 'Brain payload matches forbidden regex: ' + re);
-      }
-    }
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 12: Canon Part 8 under TIMEOUT (dangerous fixture)
-  // ------------------------------------------------------------------
-  // Setup: dangerous triple + query rejects with ETIMEDOUT.
-  // Action: deriveSection.
-  // Assert: NO BRAIN.md on disk; captured Brain payloads (if any) are
-  //         scrubbed of forbidden content. The failure path does NOT
-  //         open a backdoor into the user-content egress boundary.
-  await runScenario('Scenario 12: Canon Part 8 under timeout', async function () {
-    const audit = installMockBrainClient({
-      query: function () {
-        return new Promise(function (_r, reject) {
-          setTimeout(function () { reject(new Error('ETIMEDOUT')); }, 30);
-        });
-      },
-    });
-    const { sections } = buildRoom({ tag: 's12', count: 1 });
-    buildDangerousSection(sections[0]);
-    const r = await runDerive(sections[0], {});
-    assert.equal(r.success, false);
-    assert.equal(fs.existsSync(path.join(sections[0], 'BRAIN.md')), false,
-      'timeout path must not write BRAIN.md');
-    // Brain payloads captured before the timeout fired: every one scrubbed.
-    const payloads = [
-      ...audit.query_calls.map(function (c) { return c.cypher; }),
-      ...audit.search_calls.map(function (c) { return String(c.query || ''); }),
-    ];
-    for (const p of payloads) {
-      for (const bad of DANGEROUS_SUBSTRINGS) {
-        assert.equal(p.indexOf(bad), -1, 'payload leaks ' + bad + ' under timeout');
-      }
-      for (const re of FORBIDDEN_PATTERNS) {
-        assert.equal(re.test(p), false, 'payload matches forbidden regex under timeout: ' + re);
-      }
-    }
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 13: Cross-room aggregator survives corrupt peer room
-  // ------------------------------------------------------------------
-  // Setup: current room valid; peer room has BRAIN.md with corrupt
-  //        frontmatter (missing required fields + garbled YAML).
-  // Action: aggregateContradictions.
-  // Assert: aggregator never throws; peer room skip_reasons shows
-  //         unreadable OR empty >= 1; other peers still scanned;
-  //         output sanitized.
-  await runScenario('Scenario 13: Cross-room aggregator survives corrupt peer room', async function () {
-    // Set MINDRIAN_ROOMS_ROOT env to a tmp dir and seed a registry.
-    const hostRoot = mkTmp('s13');
-    const envRoot = hostRoot;
-    const prev = process.env.MINDRIAN_ROOMS_ROOT;
-    process.env.MINDRIAN_ROOMS_ROOT = envRoot;
-    try {
-      // Build three rooms under envRoot.
-      const roomA = path.join(envRoot, 'room-a'); // current
-      const roomB = path.join(envRoot, 'room-b'); // corrupt peer
-      const roomC = path.join(envRoot, 'room-c'); // healthy peer
-      fs.mkdirSync(roomA, { recursive: true });
-      fs.mkdirSync(roomB, { recursive: true });
-      fs.mkdirSync(roomC, { recursive: true });
-      // Seed current room with a valid section.
-      buildSection(path.join(roomA, 'shared-section'), {});
-      // Seed ROOM.md on every room so aggregator does not opt-out.
-      for (const r of [roomA, roomB, roomC]) {
-        writeFile(path.join(r, 'ROOM.md'), [
-          '---', 'name: "' + path.basename(r) + '"', 'kind: room', '---', '', '# ' + path.basename(r), '',
-        ].join('\n'));
-      }
-      // Seed peer room B with corrupt BRAIN.md.
-      buildSection(path.join(roomB, 'shared-section'), {});
-      writeFile(path.join(roomB, 'shared-section', 'BRAIN.md'), [
-        '---',
-        'section: "shared-section"',
-        '!!!corrupt-yaml-body  not an actual frontmatter scalar {{',
-        'brain_generated_at: not-an-iso-date',
-        '---',
-        '',
-        '## Pattern Matches',
-        '',
-        '(corrupt body)',
-        '',
-      ].join('\n'));
-      // Seed peer room C with valid BRAIN.md.
-      buildSection(path.join(roomC, 'shared-section'), {});
-      writeFile(path.join(roomC, 'shared-section', 'BRAIN.md'), [
-        '---',
-        'section: "shared-section"',
-        'brain_generated_at: "2026-04-21T00:00:00Z"',
-        'brain_graph_version: 21432',
-        'governing_thought_hash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaa"',
-        'staleness: "fresh"',
-        'author: "brain"',
-        'stale_reason: null',
-        'prompt_version: "90-01-v1"',
-        'cost_tokens: 60',
-        'brain_query_count: 1',
-        '---',
-        '',
-        '## Pattern Matches',
-        '',
-        '- SWOT',
-        '',
-      ].join('\n'));
-      // Seed .rooms/registry.json under envRoot.
-      writeFile(path.join(envRoot, '.rooms', 'registry.json'), JSON.stringify({
-        version: 1,
-        rooms: {
-          'room-a': { path: roomA, active: true },
-          'room-b': { path: roomB, active: false },
-          'room-c': { path: roomC, active: false },
-        },
-      }, null, 2));
-      // Resolve the aggregator with the env override.
-      resetRequireCache();
-      const xroom = require('../core/cross-room-aggregator.cjs');
-      let threw = false;
-      let result;
-      try {
-        result = await xroom.aggregateContradictions(roomA, { opt_in: true });
-      } catch (e) {
-        threw = true;
-      }
-      assert.equal(threw, false, 'aggregator must not throw on corrupt peer');
-      assert.equal(typeof result, 'object', 'aggregator must return object');
-      assert.ok(Array.isArray(result.contradictions), 'contradictions must be array');
-      // Either unreadable OR empty OR no contradictions detected -- the
-      // critical assertion is that scanning proceeds.
-      const scannedOrSkipped = (result.scanned_rooms || 0) + (result.skipped_rooms || 0);
-      assert.ok(scannedOrSkipped >= 1, 'at least one peer must be processed (scanned or skipped)');
-      // JSON.stringify output must contain no forbidden content (Canon Part 8).
-      const ser = JSON.stringify(result);
-      for (const re of FORBIDDEN_PATTERNS) {
-        assert.equal(re.test(ser), false, 'aggregator output leaks forbidden regex under corrupt peer: ' + re);
-      }
-    } finally {
-      if (prev === undefined) delete process.env.MINDRIAN_ROOMS_ROOT;
-      else process.env.MINDRIAN_ROOMS_ROOT = prev;
-    }
-  });
-
-  // ------------------------------------------------------------------
-  // Scenario 14: Concurrent session-start staleness scans
-  // ------------------------------------------------------------------
-  // Setup: two simulated session-start staleness scans that both
-  //        enqueue the same section with the SAME new hash.
-  // Action: parallel enqueue().
-  // Assert: queue has a SINGLE entry for the section (idempotency from
-  //         Plan 90-02); queue JSON is valid; no lost entries.
-  await runScenario('Scenario 14: Concurrent session-start staleness scans', async function () {
-    const roomDir = mkTmp('s14-queue');
-    const q = require('../core/brain-derivation-queue.cjs');
-    const emptyHash = 'sha256:' + crypto.createHash('sha256').update('').digest('hex');
-    const newHash = 'sha256:' + crypto.createHash('sha256').update('governing thought v2').digest('hex');
-    // Fire 5 parallel enqueues on the same section + same new hash.
-    const targets = [];
-    for (let i = 0; i < 5; i++) {
-      targets.push(Promise.resolve().then(function () {
-        return q.enqueue(roomDir, 'market-analysis', emptyHash, newHash, q.ALLOWED_REASONS.SESSION_START_STALE);
-      }));
-    }
-    const results = await Promise.all(targets);
-    // All five must return queued:true.
-    for (const r of results) {
-      assert.equal(r.queued, true, 'every enqueue must return queued:true; got ' + JSON.stringify(r));
-    }
-    // Queue file is valid JSON with exactly one entry for this section.
-    const final = q.readQueue(roomDir);
-    const matches = final.entries.filter(function (e) { return e.section === 'market-analysis'; });
-    assert.equal(matches.length, 1, 'expected exactly 1 entry for section; got ' + matches.length);
-    assert.equal(matches[0].new_governing_thought_hash, newHash);
-    // Queue file is valid JSON.
-    const raw = fs.readFileSync(path.join(roomDir, '.mindrian', 'brain-derivation-queue.json'), 'utf8');
-    let parsed;
-    assert.doesNotThrow(function () { parsed = JSON.parse(raw); }, 'queue JSON must be valid after concurrent writes');
-    assert.equal(Array.isArray(parsed.entries), true);
-  });
-
-  // ------------------------------------------------------------------
-  // A1 Cross-cutting: Canon Part 8 forbidden-regex sweep across every
-  // BRAIN.md landed during the suite.
-  // ------------------------------------------------------------------
-  await runScenario('Audit A1: Canon Part 8 forbidden-regex sweep across all landed BRAIN.md', function () {
-    const hits = [];
-    const seen = new Set(LANDED_BRAIN_FILES);
-    for (const p of seen) {
-      if (!fs.existsSync(p)) continue;
-      const body = fs.readFileSync(p, 'utf8');
-      for (const re of FORBIDDEN_PATTERNS) {
-        if (re.test(body)) hits.push({ path: p, regex: String(re) });
-      }
-      for (const bad of DANGEROUS_SUBSTRINGS) {
-        if (body.indexOf(bad) !== -1) hits.push({ path: p, token: bad });
-      }
-    }
-    assert.equal(hits.length, 0, 'Canon Part 8 sweep found hits: ' + JSON.stringify(hits));
-  });
-
-  // ------------------------------------------------------------------
-  // A2 Cross-cutting: orphan tmpfile sweep across every tmp root.
-  // ------------------------------------------------------------------
-  await runScenario('Audit A2: orphan tmpfile sweep across all suite tmp roots', function () {
-    let total = 0;
-    const paths = [];
-    for (const root of TMP_ROOTS) {
-      const orphans = countOrphanTmpfiles(root);
-      total += orphans.count;
-      for (const p of orphans.paths) paths.push(p);
-    }
-    assert.equal(total, 0, 'orphan tmpfile(s) remain after suite: ' + paths.join(','));
-  });
-
-  // ---------- Final ----------
-
-  const suiteMs = Date.now() - SUITE_START;
-  process.stdout.write(
-    '\nbrain-derivation-graceful-degradation: ' + passed + '/' + (passed + failed) +
-    ' passed  (' + suiteMs + 'ms total)\n'
-  );
-  if (failed > 0) {
-    process.stderr.write('\nFAILURES:\n');
-    for (const f of failures) {
-      process.stderr.write('  - ' + f.name + '\n');
-    }
-  }
-  // Performance budget assertion: < 30s.
-  if (suiteMs > 30000) {
-    process.stderr.write('WARN: suite exceeded 30000ms budget (actual: ' + suiteMs + 'ms)\n');
-  }
-  process.exit(failed === 0 ? 0 : 1);
-}
-
-main().catch(function (e) {
-  process.stderr.write('Uncaught in main: ' + (e && e.stack ? e.stack : e) + '\n');
-  process.exit(1);
-});