@north-light/crouter 0.3.317 → 0.3.319

package/dist/core/__tests__/daemon-boot.test.js

@@ -1,422 +0,0 @@
-import { test, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnSync, spawn } from 'node:child_process';
-import { createServer } from 'node:net';
-import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { closeDb, migrate, openDb } from '../canvas/db.js';
-import { closeScopedStores } from '../scoped-state/db.js';
-import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
-import { beginExecution, recordExecutionPid } from '../canvas/executions.js';
-import { openTurn } from '../canvas/recovery.js';
-import { superviseTick } from '../../daemon/crtrd.js';
-import { readPidfile } from '../../daemon/pidfile.js';
-import { verifyDaemonStartup, waitForDaemonExit } from '../../daemon/manage.js';
-import { waitForBrokerViewSocket } from '../runtime/placement-tmux.js';
-import { viewSocketPath } from '../canvas/paths.js';
-import { headlessBrokerHost } from '../runtime/host.js';
-import { bindTestFleet } from './helpers/fleet.js';
-import { resetFleetForTests } from '../runtime/fleet.js';
-let home;
-let scopeHome;
-let originalCwd;
-let originalHome;
-let tf;
-function node(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: '/tmp/work',
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-/** Wire `parent subscribes_to child` — the spawn-time edge (parent wakes on the
- *  child's pushes), so the daemon's boot-failure push reaches the parent. */
-function spawnEdge(parent, child) {
-    subscribe(parent, child, true);
-}
-/** A pid that is guaranteed dead (models a crashed engine). */
-function deadPid() {
-    const r = spawnSync('true', [], { stdio: 'ignore' });
-    return r.pid ?? 0x7ffffffe;
-}
-function wakeMail(nodeId) {
-    return openDb().prepare(`SELECT m.sender_node_id AS "from", d.urgency AS tier, m.label
-    FROM deliveries d JOIN messages m ON m.message_id = d.message_id
-    WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.wake = 1
-    ORDER BY m.seq`).all(nodeId);
-}
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-daemon-boot-'));
-    scopeHome = mkdtempSync(join(tmpdir(), 'crtr-daemon-boot-home-'));
-    originalCwd = process.cwd();
-    originalHome = process.env['HOME'];
-    process.chdir(scopeHome);
-    process.env['HOME'] = scopeHome;
-    process.env['CRTR_HOME'] = home;
-    // superviseTick + exit-policy delivery require a bound fleet (D-2).
-    tf = bindTestFleet();
-});
-beforeEach(() => {
-    closeDb();
-    closeScopedStores();
-    rmSync(home, { recursive: true, force: true });
-    initializeFreshScopedStore({ kind: 'user', root: join(scopeHome, '.crouter') });
-    migrate(openDb());
-});
-after(() => {
-    closeDb();
-    closeScopedStores();
-    rmSync(home, { recursive: true, force: true });
-    process.chdir(originalCwd);
-    rmSync(scopeHome, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-    if (originalHome === undefined)
-        delete process.env['HOME'];
-    else
-        process.env['HOME'] = originalHome;
-    tf.fleet.dispose();
-    resetFleetForTests();
-});
-// A broker that exits while pi_session_id was NEVER set: the vehicle died
-// before pi ever booted. The spawner already returned status="active", so the
-// authoritative tick applies table row 8 and tells the parent. The delivered
-// exit is observation-only.
-test('never-booted broker is marked dead by the tick and surfaced to the parent as urgent', async () => {
-    createNode(node('P', { kind: 'developer', lifecycle: 'resident' }));
-    const crashedPid = deadPid();
-    createNode(node('C', {
-        parent: 'P',
-        kind: 'explore',
-        pi_pid: crashedPid, // launch recorded its process before it died
-        pi_session_id: null, // never booted
-        intent: null,
-    }));
-    recordExecutionPid(beginExecution('C', { daemonEpoch: 'test' }), 'C', crashedPid);
-    spawnEdge('P', 'C');
-    // The launch's real child exit is delivered synthetically here, then the
-    // authoritative tick classifies the dead recorded pid as table row 8:
-    // pi_session_id null, no fork claim → boot failure. No grace, no retry.
-    tf.fleet.deliverExit('C', { code: 1, signal: null });
-    await tf.drain();
-    await superviseTick();
-    assert.equal(getNode('C').status, 'dead', 'never-booted child is dead');
-    // Row 8 fans TWO entries: the urgent surfaceBootFailure push and the normal
-    // doctrine wake (design flow B row 8 — crash + surfaceBootFailure + doctrine
-    // wake), both from C.
-    const inbox = wakeMail('P');
-    assert.equal(inbox.length, 2, 'parent received the boot-failure push and the doctrine wake');
-    const urgent = inbox.find((e) => e.tier === 'urgent');
-    assert.ok(urgent, 'boot failure is delivered as urgent');
-    assert.equal(urgent.from, 'C');
-    assert.match(urgent.label, /Spawn failed/);
-    const wake = inbox.find((e) => e.tier === 'normal');
-    assert.ok(wake, 'the doctrine wake rides beside the urgent push');
-    assert.match(wake.label, /crashed/i);
-});
-test('a crashed booted child is relaunched on its saved session, not reaped, and raises no false boot-failure alarm', async () => {
-    const originalLaunch = headlessBrokerHost.launch;
-    const launches = [];
-    headlessBrokerHost.launch = (nodeId) => {
-        launches.push(nodeId);
-        const handle = { pid: 424_242, exited: new Promise(() => { }) };
-        tf.fleet.register(nodeId, handle); // the real host contract: registration at the launch seam
-        return handle;
-    };
-    try {
-        createNode(node('P2', { kind: 'developer', lifecycle: 'resident' }));
-        const crashedPid = deadPid();
-        createNode(node('C2', {
-            cwd: home, // a cwd that exists — reviveNode's preflight refuses a missing one
-            parent: 'P2',
-            kind: 'explore',
-            pi_pid: crashedPid, // engine crashed — its recorded pid is dead
-            pi_session_id: '019e8f00-booted-once', // it booted before dying
-            intent: null,
-        }));
-        spawnEdge('P2', 'C2');
-        const executionId = beginExecution('C2', { daemonEpoch: 'test' });
-        recordExecutionPid(executionId, 'C2', crashedPid);
-        openTurn(executionId, { reason: 'agent-start' }); // died mid-generation
-        await superviseTick();
-        const afterFirstTick = getNode('C2');
-        assert.deepEqual(launches, [], 'the first tick records the failed launch without relaunching');
-        assert.equal(afterFirstTick.respawn_failures, 1, 'the first tick records failure one durably');
-        assert.ok(afterFirstTick.respawn_not_before, 'the first tick records durable backoff');
-        await superviseTick(Date.parse(afterFirstTick.respawn_not_before));
-        assert.deepEqual(launches, ['C2'], 'the matured tick recovers the crash through the policy table');
-        assert.equal(getNode('C2').status, 'active', 'crashed booted child is relaunched, NOT marked dead');
-        assert.equal(wakeMail('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
-    }
-    finally {
-        headlessBrokerHost.launch = originalLaunch;
-        tf.fleet.forget('C2');
-    }
-});
-// An unplaced active node is not daemon-managed; the daemon leaves it untouched
-// rather than treating the missing broker/session fields as a boot failure.
-test('an unplaced active node is left alone before it boots', async () => {
-    createNode(node('S', { status: 'active', pi_session_id: null }));
-    await superviseTick();
-    assert.equal(getNode('S').status, 'active', 'unplaced active node is not reaped');
-});
-// Major-4 (kept under exit-event authority): a correctly-dormant idle-release
-// node with no fleet entry must NOT be spuriously revived by the tick. Pass-2
-// is the ONLY wake path for a released node, and it fires solely on an unseen
-// inbox entry — a null recorded pid plus a saved session must never read as a
-// "stranded relaunch" (that inference branch is deleted). With nothing left to
-// wake it and no live subscriber awaiting its report, the same pass settles it
-// as a terminal node torn down before finishing rather than leaving a
-// permanently protected idle row.
-test('idle-release node with a boot-cleared (null) pid and no unseen inbox is settled, never revived', async () => {
-    createNode(node('D', {
-        status: 'idle',
-        intent: 'idle-release',
-        pi_pid: null, // cleared by boot reconciliation
-        pi_session_id: '019e8f00-freed-while-dormant', // set → would look like a stranded relaunch
-    }));
-    const t0 = Date.now();
-    await superviseTick(t0); // first observation
-    await superviseTick(t0 + 60_000); // well past the boot grace
-    const after = getNode('D');
-    assert.equal(after.status, 'canceled', 'a dormant terminal row nobody awaits becomes prunable canceled history');
-    assert.equal(after.intent, null, 'no revive fired — the row is settled, not relaunched');
-    assert.equal(after.pi_pid, null, 'no fresh pid — reviveNode was never invoked');
-});
-// Daemon start guard: spawnDaemon must not report success before the daemon's
-// pidfile owner is live AND its Unix API socket serves. This is a pure bounded
-// poll over injected clocks/probes, so we can lock it down deterministically
-// without a real daemon process.
-test('verifyDaemonStartup waits for pidfile, live pid, and serving socket before reporting success', async () => {
-    let now = 0;
-    let pidfileReady = false;
-    let pidAliveReady = false;
-    let socketServing = false;
-    let slept = 0;
-    const existingPid = await verifyDaemonStartup(42, 50, {
-        now: () => now,
-        readPidfile: () => (pidfileReady ? 42 : null),
-        isPidAlive: () => pidAliveReady,
-        isDaemonServing: async () => socketServing,
-        sleepMs: (ms) => {
-            slept += ms;
-            now += ms;
-            if (now >= 20)
-                pidfileReady = true;
-            if (now >= 30)
-                pidAliveReady = true;
-            if (now >= 40)
-                socketServing = true;
-        },
-    });
-    assert.equal(existingPid, null, 'the spawned daemon owns the pidfile when startup succeeds');
-    assert.equal(pidfileReady, true, 'pidfile must have appeared before success');
-    assert.equal(pidAliveReady, true, 'pid must have been alive before success');
-    assert.equal(socketServing, true, 'the Unix API socket must serve before success');
-    assert.equal(slept >= 40, true, 'the guard must actually poll through socket readiness');
-});
-test('runDaemon initializes SQL before binding restricted repair', () => {
-    const source = readFileSync(fileURLToPath(new URL('../../daemon/crtrd.ts', import.meta.url)), 'utf8');
-    const runDaemonAt = source.indexOf('export async function runDaemon');
-    const ownershipAt = source.indexOf('claimDaemonOwnership(', runDaemonAt);
-    const profileAt = source.indexOf('runProfileManifestMigrations(', ownershipAt);
-    const migrateAt = source.indexOf('migrate(openDb());', profileAt);
-    const restrictionAt = source.indexOf("phase: 'initializing'", migrateAt);
-    const pidfileAt = source.indexOf('writePidfile();', restrictionAt);
-    const serverAt = source.indexOf('createApiServer(', pidfileAt);
-    const activationAt = source.indexOf('await activateOnDiskMigrations(', serverAt);
-    assert.ok(runDaemonAt >= 0, 'runDaemon exists');
-    assert.ok(ownershipAt > runDaemonAt, 'runDaemon claims ownership');
-    assert.equal(source.slice(runDaemonAt, ownershipAt).includes('await '), false, 'ownership is claimed before startup can await');
-    assert.ok(ownershipAt < profileAt, 'ownership precedes raw profile migration');
-    assert.ok(profileAt < migrateAt, 'profile migration precedes SQL migration');
-    assert.ok(migrateAt < restrictionAt, 'SQL migration precedes restriction state');
-    assert.ok(restrictionAt < pidfileAt && pidfileAt < serverAt, 'restriction precedes repair listener binding');
-    assert.ok(serverAt < activationAt, 'repair listener precedes on-disk activation');
-});
-// Regression for the cold-guest recreate blocker: the production startup window
-// must tolerate a slower cold start than the old 500ms bound.
-test('verifyDaemonStartup default window tolerates a slower cold start', async () => {
-    let now = 0;
-    let pidfileReady = false;
-    let pidAliveReady = false;
-    const existingPid = await verifyDaemonStartup(42, undefined, {
-        now: () => now,
-        readPidfile: () => (pidfileReady ? 42 : null),
-        isPidAlive: () => pidAliveReady,
-        isDaemonServing: async () => pidAliveReady,
-        sleepMs: (ms) => {
-            now += ms;
-            if (now >= 600)
-                pidfileReady = true;
-            if (now >= 700)
-                pidAliveReady = true;
-        },
-    });
-    assert.equal(existingPid, null, 'the production startup window must allow a cold guest to settle');
-});
-test('startup verification waits for delayed activation inside the shared window', async () => {
-    let now = 0;
-    let activationComplete = false;
-    const existingPid = await verifyDaemonStartup(42, undefined, {
-        now: () => now,
-        readPidfile: () => (activationComplete ? 42 : null),
-        isPidAlive: () => activationComplete,
-        isDaemonServing: async () => activationComplete,
-        sleepMs: (ms) => {
-            now += ms;
-            if (now >= 25_000)
-                activationComplete = true;
-        },
-    });
-    assert.equal(existingPid, null, 'activation beyond the old 20s bound still reaches readiness');
-    assert.equal(activationComplete, true, 'readiness follows activation completion');
-});
-// A concurrent start race is success when another live daemon already owns the
-// pidfile; the loser must return that existing pid instead of timing out.
-test('verifyDaemonStartup returns the existing live daemon when another pid won the startup race', async () => {
-    let now = 0;
-    let slept = 0;
-    const existingPid = await verifyDaemonStartup(42, 50, {
-        now: () => now,
-        readPidfile: () => 7,
-        isPidAlive: (pid) => pid === 7,
-        isDaemonServing: async () => true,
-        sleepMs: (ms) => {
-            slept += ms;
-            now += ms;
-        },
-    });
-    assert.equal(existingPid, 7, 'the live pidfile owner must be reported back');
-    assert.equal(slept, 0, 'no polling is needed once another live daemon is visible');
-});
-// A stop acknowledgement is the synchronization point for a following start:
-// it waits for both the old process and its pidfile ownership to disappear.
-test('waitForDaemonExit holds stop→start until the old pid is dead and the pidfile is released', async () => {
-    let now = 0;
-    let pidAlive = true;
-    let pidfileOwner = 42;
-    await waitForDaemonExit(42, 50, {
-        now: () => now,
-        isPidAlive: () => pidAlive,
-        readPidfile: () => pidfileOwner,
-        sleepMs: (ms) => {
-            now += ms;
-            if (now >= 10)
-                pidfileOwner = null;
-            if (now >= 20)
-                pidAlive = false;
-        },
-    });
-    assert.equal(now, 20, 'stop does not acknowledge while the signaled process is still alive');
-    assert.equal(pidfileOwner, null, 'a following start sees no owner in the pidfile');
-});
-// The guard stays bounded: if the daemon never becomes ready, it throws instead
-// of claiming "started" forever.
-test('verifyDaemonStartup throws after its tiny startup window expires', async () => {
-    let now = 0;
-    await assert.rejects(async () => verifyDaemonStartup(99, 25, {
-        now: () => now,
-        readPidfile: () => null,
-        isPidAlive: () => false,
-        isDaemonServing: async () => false,
-        sleepMs: (ms) => {
-            now += ms;
-        },
-    }), /has no live pidfile owner/);
-});
-// REGRESSION (bug #102): the verifier polls with a real async sleep, NOT a
-// synchronous Atomics.wait, so the event loop stays free to dispatch the spawned
-// child's `exit` event. We spawn a REAL child that exits immediately and let the
-// real wall clock + real setTimeout sleep drive the loop: the exit event fires
-// mid-wait, childExited() flips non-null, and the verifier fails fast with the
-// exit reason — well inside the 2s window. If the loop blocked the event loop
-// (the old bug), the exit event would never fire and this would time out with the
-// generic message instead.
-test('verifyDaemonStartup throws when the spawned daemon exits before it can become ready', async () => {
-    let exited = null;
-    const child = spawn(process.execPath, ['-e', 'process.exit(1)'], { stdio: 'ignore' });
-    child.once('exit', (code, signal) => {
-        exited = { code, signal };
-    });
-    const started = Date.now();
-    await assert.rejects(async () => verifyDaemonStartup(77, 2_000, {
-        readPidfile: () => null,
-        isPidAlive: () => false,
-        isDaemonServing: async () => false,
-        childExited: () => exited,
-    }), /exited before becoming ready \(with exit code 1\)/);
-    assert.ok(Date.now() - started < 1_500, 'must fail fast on the real child exit, not run out the window');
-});
-test('the daemon honours an explicit CRTR_PIDFILE override', () => {
-    const home = mkdtempSync(join(tmpdir(), 'crtr-pidfile-home-'));
-    const pidfile = join(home, 'crtrd.pid');
-    const prevHome = process.env['CRTR_HOME'];
-    const prevPidfile = process.env['CRTR_PIDFILE'];
-    process.env['CRTR_HOME'] = mkdtempSync(join(tmpdir(), 'crtr-home-'));
-    process.env['CRTR_PIDFILE'] = pidfile;
-    writeFileSync(pidfile, '321');
-    try {
-        assert.equal(readPidfile(), 321, 'the daemon must read its pidfile from CRTR_PIDFILE, not CRTR_HOME');
-    }
-    finally {
-        if (prevHome === undefined)
-            delete process.env['CRTR_HOME'];
-        else
-            process.env['CRTR_HOME'] = prevHome;
-        if (prevPidfile === undefined)
-            delete process.env['CRTR_PIDFILE'];
-        else
-            process.env['CRTR_PIDFILE'] = prevPidfile;
-    }
-});
-// REGRESSION (bug #102 follow-up): with NO exit promise, the readiness loop must
-// still observe a real `connect`. A buggy `?? Promise.resolve('retry')` race lost
-// to the probe instantly, so live-broker callers (focus on an already-alive node,
-// surface tmux-spread) could never return true and stalled the full 30s deadline.
-test('waitForBrokerViewSocket returns true on a live socket when given no exit promise', async () => {
-    // A short /tmp CRTR_HOME keeps the AF_UNIX path under macOS's 104-byte
-    // sun_path limit (listen EINVAL) — the suite's default temp home is too long.
-    const shortHome = mkdtempSync('/tmp/crtr-sock-');
-    const prevHome = process.env['CRTR_HOME'];
-    process.env['CRTR_HOME'] = shortHome;
-    const nodeId = 'lb';
-    const sockPath = viewSocketPath(nodeId);
-    mkdirSync(dirname(sockPath), { recursive: true });
-    const server = createServer();
-    await new Promise((resolve) => server.listen(sockPath, () => resolve()));
-    try {
-        const started = Date.now();
-        const ready = await waitForBrokerViewSocket(nodeId);
-        assert.equal(ready, true, 'a live accepting socket must report ready even without an exit promise');
-        assert.ok(Date.now() - started < 1_000, 'readiness must resolve promptly, not stall the full deadline');
-    }
-    finally {
-        await new Promise((resolve) => server.close(() => resolve()));
-        if (prevHome === undefined)
-            delete process.env['CRTR_HOME'];
-        else
-            process.env['CRTR_HOME'] = prevHome;
-        rmSync(shortHome, { recursive: true, force: true });
-    }
-});
-test('waitForBrokerViewSocket returns false as soon as the real broker process exits', async () => {
-    const child = spawn(process.execPath, ['-e', 'process.exit(1)'], { stdio: 'ignore' });
-    const exited = new Promise((resolve) => {
-        child.once('exit', (code, signal) => {
-            resolve({ code, signal });
-        });
-    });
-    const started = Date.now();
-    const ready = await waitForBrokerViewSocket('dead-broker-for-readiness-test', exited);
-    assert.equal(ready, false, 'an exited broker must fail readiness');
-    assert.ok(Date.now() - started < 1000, 'the readiness guard must fail fast instead of waiting for the socket deadline');
-});

package/dist/core/__tests__/daemon-wedge.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/daemon-wedge.test.js

@@ -1,106 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/daemon-wedge.test.ts
-//
-// Issue #110 — pid-alive WEDGED node detection. The pure decision core:
-// wedgeVerdict(busy, quietForMs, cpuPercent, hasDescendants). No wall-clock sleeps, no ps
-// shell-outs, no fake pids — every input is injected directly, mirroring the
-// yieldStallVerdict truth-table suite in refresh-stall-recycle.test.ts.
-//
-// LOCKS: (1) a routine long-running turn with a CPU-active subprocess must
-// never verdict 'wedged' — false positives are the failure mode this feature
-// exists to avoid. (2) a childless busy broker that is quiet past grace is
-// wedged even when its own CPU is high. (3) a null/failed CPU sample never
-// fires on its own (fails toward 'pending', not 'wedged').
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { wedgeVerdict, WEDGE_QUIET_MS, WEDGE_CPU_MAX_PERCENT, sumTreeCpu, treeHasDescendants, } from '../../daemon/reconcilers/broker-supervision.js';
-test('wedgeVerdict: a node whose turn already ended is never wedged, regardless of the other signals', () => {
-    assert.equal(wedgeVerdict({ busy: false, quietForMs: null, cpuPercent: null, hasDescendants: null }), 'leave');
-    assert.equal(wedgeVerdict({ busy: false, quietForMs: 10 * 60 * 60_000, cpuPercent: 0, hasDescendants: null }), 'leave');
-});
-test('wedgeVerdict: a busy node with an unreadable heartbeat is left alone (not enough evidence)', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: null, cpuPercent: null, hasDescendants: null }), 'leave');
-});
-test('wedgeVerdict: routine turns — even long ones — never trip before the grace elapses', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: 0, cpuPercent: 0, hasDescendants: null }), 'leave', 'just started');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: 5 * 60_000, cpuPercent: 0, hasDescendants: null }), 'leave', 'a routine multi-minute tool call');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS - 1, cpuPercent: 0, hasDescendants: null }), 'leave', 'just under the grace, even with 0% cpu');
-});
-test('wedgeVerdict: past the grace with NO cpu corroboration only pends — never fires on time alone', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: null, hasDescendants: null }), 'pending', 'cpu sample failed/unavailable — never treated as confirmation');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 10, cpuPercent: null, hasDescendants: null }), 'pending', 'no amount of extra quiet time substitutes for the corroborating signal');
-});
-test('wedgeVerdict: high CPU exonerates a broker with descendants but not a childless stalled engine', () => {
-    assert.equal(wedgeVerdict({
-        busy: true,
-        quietForMs: WEDGE_QUIET_MS * 3,
-        cpuPercent: WEDGE_CPU_MAX_PERCENT + 0.1,
-        hasDescendants: true,
-    }), 'pending', 'cpu just above the ceiling — a genuinely churning long build — must not fire');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: 40, hasDescendants: true }), 'pending', 'clearly-active child cpu never fires regardless of how quiet the heartbeat looks');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: 40, hasDescendants: false }), 'wedged', 'a childless broker spinning in-process is itself stalled');
-});
-test('wedgeVerdict: fires when busy + quiet-past-grace + near-zero cpu all corroborate', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: 0, hasDescendants: true }), 'wedged');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS + 60_000, cpuPercent: WEDGE_CPU_MAX_PERCENT, hasDescendants: true }), 'wedged', 'at the cpu ceiling (inclusive)');
-});
-// sumTreeCpu (pure) — process-tree CPU sampling. Review fix for issue #110:
-// sampling only the broker pid false-fired on a broker awaiting a busy CHILD
-// subprocess. These lock the tree-sum behavior directly, independent of any
-// `ps` shell-out.
-test('sumTreeCpu: a busy CHILD subprocess exonerates an idle broker (the false-positive this fixes)', () => {
-    const ps = [
-        '  100     1  0.0', // broker, idle
-        '  200   100 85.0', // child of the broker, busy
-    ].join('\n');
-    assert.equal(sumTreeCpu(ps, 100), 85.0);
-});
-test('sumTreeCpu: broker + all descendants idle sums to ~0 (the real wedge is still detected)', () => {
-    const ps = [
-        '  100     1  0.0',
-        '  200   100  0.0',
-        '  201   100  0.0',
-    ].join('\n');
-    assert.equal(sumTreeCpu(ps, 100), 0);
-});
-test('sumTreeCpu: sums across multiple generations (grandchild busy)', () => {
-    const ps = [
-        '  100     1  0.0', // broker
-        '  200   100  0.0', // child, idle
-        '  300   200 40.0', // grandchild, busy
-    ].join('\n');
-    assert.equal(sumTreeCpu(ps, 100), 40.0);
-});
-test('sumTreeCpu: root pid absent from the ps output returns null (can\'t measure)', () => {
-    const ps = [
-        '  200     1  0.0',
-        '  300   200 10.0',
-    ].join('\n');
-    assert.equal(sumTreeCpu(ps, 100), null);
-});
-test('sumTreeCpu: malformed/blank lines are skipped; empty output returns null', () => {
-    const ps = [
-        '',
-        '   ',
-        'garbage line not ps shaped',
-        '  100     1  5.0',
-        '  bad   100  1.0',
-    ].join('\n');
-    assert.equal(sumTreeCpu(ps, 100), 5.0);
-    assert.equal(sumTreeCpu('', 100), null);
-    assert.equal(sumTreeCpu('   \n  \n', 100), null);
-});
-// treeHasDescendants (pure) — issue #119: the broker-alone case has no
-// subprocess to kill, so remediation must branch on this instead of assuming
-// a runaway child always exists.
-test('treeHasDescendants: broker alone in its own tree — nothing to kill', () => {
-    const ps = ['  100     1  0.0'].join('\n');
-    assert.equal(treeHasDescendants(ps, 100), false);
-});
-test('treeHasDescendants: a child present — a subprocess to kill', () => {
-    const ps = ['  100     1  0.0', '  200   100  0.0'].join('\n');
-    assert.equal(treeHasDescendants(ps, 100), true);
-});
-test('treeHasDescendants: root pid absent from the ps output returns null (can\'t tell)', () => {
-    const ps = ['  200     1  0.0'].join('\n');
-    assert.equal(treeHasDescendants(ps, 100), null);
-});

package/dist/core/__tests__/dead-node-policy-table.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/dead-node-policy-table.test.js

@@ -1,77 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/dead-node-policy-table.test.ts
-//
-// The invariant-5 policy table (design flow B): `classifyDeadNode` is the ONE
-// pure function mapping a known-dead node's durable row state to its recovery
-// action, used by the exit-policy job and the row-driven supervision tick.
-// This file pins every table row directly.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { classifyDeadNode, retryResumeMode } from '../../daemon/fleet.js';
-/** A table-row fixture: an active, booted-or-not node in the named state. */
-function row(over = {}) {
-    return {
-        status: 'active',
-        intent: null,
-        pi_session_id: null,
-        cycle_pending: null,
-        fork_from: null,
-        lifecycle: 'terminal',
-        ...over,
-    };
-}
-// The eight table rows, in evaluation order (design flow B).
-test('row 1: a deleted row (orphan of a pruned/closed node) is forgotten', () => {
-    assert.equal(classifyDeadNode(null, false), 'forget');
-    assert.equal(classifyDeadNode(null, true), 'forget', 'a stale busy marker cannot resurrect a deleted row');
-});
-test('row 2: settled terminal exits (done/canceled/dead) are forgotten — fanouts already happened at the transition site', () => {
-    assert.equal(classifyDeadNode(row({ status: 'done' }), false), 'forget');
-    assert.equal(classifyDeadNode(row({ status: 'canceled' }), false), 'forget');
-    assert.equal(classifyDeadNode(row({ status: 'dead' }), false), 'forget');
-    assert.equal(classifyDeadNode(row({ status: 'done' }), true), 'forget', 'terminal status outranks a leftover busy marker');
-});
-test('row 3: intent=refresh (yield/refresh exit) respawns fresh — no grace, no capacity check', () => {
-    assert.equal(classifyDeadNode(row({ intent: 'refresh' }), false), 'respawn-fresh');
-    assert.equal(classifyDeadNode(row({ intent: 'refresh', pi_session_id: 'sess' }), true), 'respawn-fresh', 'refresh outranks the crash rows below it — the exit was deliberate');
-});
-test('row 4: intent=idle-release (chosen dormancy) takes no action — pass-2 inbox wake owns the next revive', () => {
-    assert.equal(classifyDeadNode(row({ intent: 'idle-release' }), false), 'dormant');
-    assert.equal(classifyDeadNode(row({ intent: 'idle-release', pi_session_id: 'sess' }), false), 'dormant', 'a saved session does not turn chosen dormancy into a crash');
-});
-// Row 4b is why a canvas of parked conversations does not stampede its host at
-// boot: a daemon restart classifies every one of them at once, and resuming an
-// engine that has nothing to come back to is pure cost.
-test('row 4b: a resident that died between turns with nothing to wake it is released, not resumed', () => {
-    const resident = row({ lifecycle: 'resident', pi_session_id: 'sess' });
-    assert.equal(classifyDeadNode(resident, false, false), 'release-idle');
-    assert.equal(classifyDeadNode(resident, false), 'respawn-resume', 'an uninformed caller keeps the conservative respawn');
-    assert.equal(classifyDeadNode(resident, false, true), 'respawn-resume', 'unseen mail, a live obligation, or an attached human brings it back');
-    assert.equal(classifyDeadNode(resident, true, false), 'respawn-resume', 'an interrupted turn outranks it — the continuation still owes that turn');
-    assert.equal(classifyDeadNode(row({ lifecycle: 'terminal', pi_session_id: 'sess' }), false, false), 'respawn-resume', 'a terminal node with nothing live has STALLED; coming back to be reprompted is the point');
-    assert.equal(classifyDeadNode(row({ lifecycle: 'resident' }), false, false), 'boot-failure', 'no saved session means it never booted — releasing would hide a boot failure');
-});
-test('row 5: every saved session resumes strictly unless its own pending cycle must be retried', () => {
-    assert.equal(classifyDeadNode(row({ pi_session_id: 'sess' }), false), 'respawn-resume');
-    assert.equal(classifyDeadNode(row({ pi_session_id: 'sess' }), true), 'respawn-resume', 'a dirty interrupted turn resumes in place; the respawn continuation re-drives it');
-    assert.equal(classifyDeadNode(row({ pi_session_id: 'sess', cycle_pending: false }), true), 'respawn-resume');
-    assert.equal(classifyDeadNode(row({ pi_session_id: 'sess', cycle_pending: true }), true), 'respawn-cycle', 'an interrupted unconfirmed cycling attempt still retries AS that cycle');
-});
-test('row 6: a sessionless node that died mid-turn relaunches fresh instead of becoming a boot failure', () => {
-    assert.equal(classifyDeadNode(row(), true), 'respawn-fresh');
-});
-test('row 7: an ordinary fork dead before binding its child session retries the immutable fork birth', () => {
-    assert.equal(classifyDeadNode(row({ fork_from: '/reviews/branch-point.jsonl' }), false), 'respawn-fresh');
-});
-test('row 8: sessionless with no fork claim — a fresh launch died before session_start — is a boot failure', () => {
-    assert.equal(classifyDeadNode(row(), false), 'boot-failure');
-});
-// retryResumeMode (pure): only an unconfirmed cycling launch must cycle again.
-// An interrupted ordinary turn resumes strictly; `#respawn` adds the runtime
-// continuation that re-drives the stopped work in the same conversation.
-test('retryResumeMode: pending cycles recover as cycles; every confirmed saved session resumes strictly', () => {
-    assert.equal(retryResumeMode({ cycle_pending: true }), false, 'a pending cycling attempt retries AS a cycle');
-    assert.equal(retryResumeMode({ cycle_pending: false }), true, 'an ordinary saved session resumes strictly');
-    assert.equal(retryResumeMode({ cycle_pending: null }), true, 'cycle_pending=null resumes strictly');
-    assert.equal(retryResumeMode({}), true, 'cycle_pending undefined resumes strictly');
-    assert.equal(retryResumeMode(null), true, 'no pending cycle resumes strictly');
-});

package/dist/core/__tests__/events-contract.test.d.ts

@@ -1 +0,0 @@
-export {};