@north-light/crouter 0.3.318 → 0.3.320

package/dist/core/__tests__/boot-fault-attempt.test.js

@@ -1,105 +0,0 @@
-// beginBootFaultAttempt: the launch/revive paths' one mechanism for scoping a
-// boot-failure diagnostic to the attempt that is actually failing, never a
-// stale marker left by an earlier one.
-import { test, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createNode } from '../canvas/canvas.js';
-import { closeDb, migrate, openDb } from '../canvas/db.js';
-import { beginBootFaultAttempt, recordFault } from '../canvas/recovery.js';
-let home;
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-boot-fault-attempt-'));
-    process.env['CRTR_HOME'] = home;
-});
-beforeEach(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    migrate(openDb());
-});
-after(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-});
-function node(nodeId) {
-    return {
-        node_id: nodeId,
-        name: nodeId,
-        created: new Date().toISOString(),
-        cwd: home,
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-    };
-}
-test('a fatal crtr→pi fault recorded after the snapshot is surfaced', { timeout: 1_000 }, () => {
-    createNode(node('node-a'));
-    const attempt = beginBootFaultAttempt('node-a');
-    recordFault('node-a', {
-        link: 'crtr→pi',
-        op: 'model resolution at launch',
-        kind: 'model-not-found',
-        retry: { disposition: 'fatal' },
-        message: "model 'bogus' has no 'provider/id' form and cannot be resolved",
-    });
-    assert.equal(attempt.explanation(), "model resolution at launch: model 'bogus' has no 'provider/id' form and cannot be resolved");
-});
-test('a stale fault already present at snapshot time is never surfaced, even if a matching-shape fault is written afterward (fail closed)', { timeout: 1_000 }, () => {
-    createNode(node('node-b'));
-    // A prior attempt's fault survives clearFault's best-effort removal (its own
-    // errors are swallowed and unchecked by callers) — the exact failure mode
-    // the diagnostic must not be fooled by.
-    recordFault('node-b', {
-        link: 'crtr→pi',
-        op: 'model resolution at launch',
-        kind: 'model-not-found',
-        retry: { disposition: 'fatal' },
-        message: 'stale cause from an earlier boot',
-    });
-    const attempt = beginBootFaultAttempt('node-b');
-    // This attempt's OWN broker also fatal-crashes with the SAME link+kind —
-    // recordFault's since-preserving merge for a repeated link+kind marker means
-    // the on-disk `since` can still read as the STALE incident's start, so a
-    // naive timestamp check would misattribute this. The snapshot taken above
-    // (before this write) is what actually gates it.
-    recordFault('node-b', {
-        link: 'crtr→pi',
-        op: 'model resolution at launch',
-        kind: 'model-not-found',
-        retry: { disposition: 'fatal' },
-        message: 'a fresh cause from this attempt',
-    });
-    assert.equal(attempt.explanation(), null, 'a fault present before this attempt began must fail closed, not surface any cause');
-});
-test('no fault recorded at all yields no explanation', { timeout: 1_000 }, () => {
-    createNode(node('node-c'));
-    const attempt = beginBootFaultAttempt('node-c');
-    assert.equal(attempt.explanation(), null);
-});
-test('an unrelated fault (wrong link, or non-fatal) is never surfaced as a boot cause', { timeout: 1_000 }, () => {
-    createNode(node('node-d'));
-    const attempt = beginBootFaultAttempt('node-d');
-    recordFault('node-d', {
-        link: 'viewer↔broker',
-        op: 'connect',
-        kind: 'connection',
-        retry: { disposition: 'manual' },
-        message: 'a viewer failed to connect, unrelated to launch',
-    });
-    assert.equal(attempt.explanation(), null);
-});
-test('a fault with an empty operation or message falls back to null rather than an empty diagnosis', { timeout: 1_000 }, () => {
-    createNode(node('node-e'));
-    const attempt = beginBootFaultAttempt('node-e');
-    recordFault('node-e', {
-        link: 'crtr→pi',
-        op: '',
-        kind: 'model-not-found',
-        retry: { disposition: 'fatal' },
-        message: '',
-    });
-    assert.equal(attempt.explanation(), null);
-});

package/dist/core/__tests__/boot.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/boot.test.js

@@ -1,274 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/boot.test.ts
-//
-// BUG LOCKED (a sandbox/VM destroy+recreate, or a host
-// reboot, leaves stale `pi_pid` values in the durable canvas.db; a pid-reuse
-// collision on the fresh boot can fool `isPidAlive` into reading a dead
-// broker as alive, wedging the node forever). reconcileBootLiveness is the
-// fix: detect the boot change and clear every stale pid BEFORE any liveness
-// check trusts it.
-//
-// Exercises the pure decision core (bootChanged) and the impure, single-writer
-// sweep (reconcileBootLiveness) against a real isolated CRTR_HOME + canvas.db —
-// no real reboot, no real uptime: both take an injected BootIdentity (kernel
-// boot_id + wall-clock epoch) so a boot change is simulated by handing a
-// different identity between calls.
-import { test, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createNode, getRow } from '../canvas/canvas.js';
-import { closeDb, migrate, openDb } from '../canvas/db.js';
-import { beginExecution, migrateLegacyExecutionIdentities, recordExecutionPid } from '../canvas/executions.js';
-import { bootChanged, bootProvenSame, reconcileBootLiveness, reconcileAndMigrateBoot, } from '../canvas/boot.js';
-let home;
-/** Build a BootIdentity for injection. `bootId` null models the non-Linux
- *  fallback (wall-clock window); a string models the exact kernel boot_id. */
-function ident(bootId, bootEpochMs) {
-    return { bootId, bootEpochMs };
-}
-const BOOT_A = '4b0c1d2e-3f40-4152-8637-a1b2c3d4e5f6';
-/** Create a running execution with a controlled legacy identity. */
-function setPidIdentity(id, pid, identity) {
-    const executionId = beginExecution(id, { daemonEpoch: 'test' });
-    recordExecutionPid(executionId, id, pid);
-    openDb().prepare('UPDATE executions SET process_identity = ? WHERE execution_id = ?').run(identity, executionId);
-    return executionId;
-}
-function recordExecution(id, pid) {
-    const executionId = beginExecution(id, { daemonEpoch: 'test' });
-    recordExecutionPid(executionId, id, pid);
-}
-function node(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: '/tmp/work',
-        kind: 'developer',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-boot-'));
-    process.env['CRTR_HOME'] = home;
-});
-beforeEach(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    migrate(openDb());
-});
-after(() => {
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-});
-// bootChanged — pure core
-test('bootChanged: no persisted history is never a change (never clears a genuinely live pid)', () => {
-    assert.equal(bootChanged(ident('boot-A', 1_000_000), null), false);
-});
-test('bootChanged: same kernel boot_id is the SAME boot (daemon restart, no reboot)', () => {
-    assert.equal(bootChanged(ident('boot-A', 1_000_000 + 5_000), ident('boot-A', 1_000_000)), false, 'identical boot_id — same boot regardless of epoch');
-});
-test('bootChanged: a DIFFERENT boot_id under 60s wall-delta is still detected', () => {
-    // A genuinely fast reboot/recreate: boot B starts only 42s after boot A
-    // (a measured real-world recreate window), well inside the 60s wall tolerance.
-    // The exact kernel boot_id catches it with NO reliance on the wall-clock
-    // window — boot_id is the primary signal, not wall time.
-    assert.equal(bootChanged(ident('boot-B', 1_000_000 + 42_000), ident('boot-A', 1_000_000)), true, 'distinct boot_id 42s apart — a real quick recreate, detected');
-});
-test('bootChanged: same boot_id with a huge epoch jump is NOT a boot change (NTP step within a boot)', () => {
-    assert.equal(bootChanged(ident('boot-A', 1_000_000 + 10 * 60_000), ident('boot-A', 1_000_000)), false, 'boot_id trumps the wall clock — an NTP correction mid-boot never false-positives');
-});
-test('bootChanged: wall-clock fallback (no boot_id) — epochs within tolerance are the SAME boot', () => {
-    assert.equal(bootChanged(ident(null, 1_000_000 + 5_000), ident(null, 1_000_000)), false, '5s drift — same boot');
-});
-test('bootChanged: wall-clock fallback (no boot_id) — epochs far apart are a DIFFERENT boot', () => {
-    assert.equal(bootChanged(ident(null, 1_000_000 + 10 * 60_000), ident(null, 1_000_000)), true, '10min apart — different boot');
-});
-// reconcileBootLiveness — the impure sweep against a real canvas.db
-// migrateLegacyPidIdentities — one-time in-place format migration at startup
-test('migrateLegacyPidIdentities: a live legacy lstart#ticks broker is re-recorded to <bootId>#<ticks>', () => {
-    createNode(node('n1'));
-    const executionId = setPidIdentity('n1', 111, 'Sat Jul 11 17:51:45 2026#53459'); // legacy baseline
-    // The pid still names the same live process; its CURRENT identity on this
-    // (now boot_id-capable) platform reads bootId#ticks with the SAME ticks.
-    const result = migrateLegacyExecutionIdentities((pid) => (pid === 111 ? `${BOOT_A}#53459` : undefined));
-    assert.deepEqual(result.migrated, [executionId]);
-    assert.equal(getRow('n1')?.pi_pid_identity, `${BOOT_A}#53459`, 'legacy row completed to boot-scoped format');
-    assert.equal(getRow('n1')?.pi_pid, 111, 'the pid itself is untouched');
-});
-test('migrateLegacyPidIdentities: a legacy row whose pid is GONE is left to normal liveness handling', () => {
-    createNode(node('n1'));
-    setPidIdentity('n1', 111, 'Sat Jul 11 17:51:45 2026#53459');
-    const result = migrateLegacyExecutionIdentities(() => undefined); // pid gone / probe failed
-    assert.deepEqual(result.migrated, []);
-    assert.equal(getRow('n1')?.pi_pid_identity, 'Sat Jul 11 17:51:45 2026#53459', 'untouched — liveness handles it');
-});
-test('migrateLegacyPidIdentities: a REUSED pid (different ticks) is NOT re-recorded', () => {
-    createNode(node('n1'));
-    setPidIdentity('n1', 111, 'Sat Jul 11 17:51:45 2026#53459');
-    // The pid now names a DIFFERENT process (different jiffies) — no match.
-    const result = migrateLegacyExecutionIdentities(() => `${BOOT_A}#99999`);
-    assert.deepEqual(result.migrated, []);
-    assert.equal(getRow('n1')?.pi_pid_identity, 'Sat Jul 11 17:51:45 2026#53459', 'reused pid left for liveness to clear');
-});
-test('migrateLegacyPidIdentities: an already boot-scoped row is skipped (not legacy)', () => {
-    createNode(node('n1'));
-    setPidIdentity('n1', 111, `${BOOT_A}#53459`); // already new-format
-    let captured = false;
-    const result = migrateLegacyExecutionIdentities(() => {
-        captured = true;
-        return `${BOOT_A}#53459`;
-    });
-    assert.deepEqual(result.migrated, []);
-    assert.equal(captured, false, 'a non-legacy row is filtered out before any ps probe');
-});
-test('migrateLegacyPidIdentities: no readable boot_id (current identity still legacy) leaves the row untouched', () => {
-    createNode(node('n1'));
-    setPidIdentity('n1', 111, 'Sat Jul 11 17:51:45 2026#53459');
-    // Platform still composes legacy-shaped identities (no boot_id) — nothing to
-    // upgrade to; the legacy compare lane legitimately stays in play.
-    const result = migrateLegacyExecutionIdentities(() => 'Sun Jul 12 09:00:00 2026#53459');
-    assert.deepEqual(result.migrated, []);
-    assert.equal(getRow('n1')?.pi_pid_identity, 'Sat Jul 11 17:51:45 2026#53459', 'no boot_id → not migrated');
-});
-test('reconcileBootLiveness: first-ever call seeds the marker and clears nothing', () => {
-    const m = node('n1');
-    createNode(m);
-    recordExecution('n1', 12345);
-    const result = reconcileBootLiveness(ident('boot-A', 1_000_000));
-    assert.deepEqual(result, { changed: false, cleared: [], sameBootProven: false });
-    assert.equal(getRow('n1')?.pi_pid, 12345, 'a first-ever run never clears an existing pid');
-});
-test('reconcileBootLiveness: same boot (same boot_id) leaves pids untouched — MUST NOT weaken the normal daemon-restart case', () => {
-    const m = node('n1');
-    createNode(m);
-    recordExecution('n1', 12345);
-    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed
-    const result = reconcileBootLiveness(ident('boot-A', 1_000_000 + 3_000)); // 3s later, same boot
-    assert.deepEqual(result, { changed: false, cleared: [], sameBootProven: true });
-    assert.equal(getRow('n1')?.pi_pid, 12345, 'a live pid on the same boot is never cleared');
-});
-test('reconcileBootLiveness: a boot change clears every recorded pid, regardless of status', () => {
-    const active = node('active-1', { status: 'active' });
-    const idle = node('idle-1', { status: 'idle' });
-    const dead = node('dead-1', { status: 'dead' }); // the guard reads pi_pid unconditionally
-    const noPid = node('no-pid-1', { status: 'active' });
-    for (const m of [active, idle, dead, noPid])
-        createNode(m);
-    recordExecution('active-1', 111);
-    recordExecution('idle-1', 222);
-    recordExecution('dead-1', 333);
-    // no-pid-1 deliberately left without a recorded pid.
-    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed boot A
-    const result = reconcileBootLiveness(ident('boot-B', 1_000_000 + 60 * 60_000)); // boot B
-    assert.equal(result.changed, true);
-    assert.deepEqual(result.cleared.sort(), ['active-1', 'dead-1', 'idle-1']);
-    assert.equal(getRow('active-1')?.pi_pid, null);
-    assert.equal(getRow('idle-1')?.pi_pid, null);
-    assert.equal(getRow('dead-1')?.pi_pid, null, 'cleared even though status is dead — the double-launch guard reads pi_pid unconditionally');
-    assert.equal(getRow('no-pid-1')?.pi_pid, null, 'already null — no-op, not an error');
-});
-test('reconcileBootLiveness: a fast recreate (distinct boot_id, 42s wall) still sweeps (Major-2 regression)', () => {
-    const m = node('n1');
-    createNode(m);
-    recordExecution('n1', 111);
-    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed boot A
-    const result = reconcileBootLiveness(ident('boot-B', 1_000_000 + 42_000)); // 42s later — inside the wall window, but new boot_id
-    assert.equal(result.changed, true, 'distinct boot_id detected even 42s apart');
-    assert.deepEqual(result.cleared, ['n1']);
-    assert.equal(getRow('n1')?.pi_pid, null);
-});
-test('reconcileBootLiveness: after reconciling, the SAME boot no longer re-triggers (idempotent)', () => {
-    const m = node('n1');
-    createNode(m);
-    recordExecution('n1', 111);
-    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed boot A
-    reconcileBootLiveness(ident('boot-B', 1_000_000 + 60 * 60_000)); // boot change → clears + persists boot B
-    recordExecution('n1', 999); // a fresh broker re-records its pid post-revive
-    const result = reconcileBootLiveness(ident('boot-B', 1_000_000 + 60 * 60_000 + 2_000)); // still boot B, 2s later
-    assert.deepEqual(result, { changed: false, cleared: [], sameBootProven: true });
-    assert.equal(getRow('n1')?.pi_pid, 999, 'a pid recorded AFTER reconciliation, within the same boot, is never touched');
-});
-// bootProvenSame + the daemon migration gate (Major-1 regression)
-//
-// The legacy identity migration blesses a recorded pid as a current-boot
-// process on a bare ticks match, so it may run ONLY when same-boot provenance
-// is POSITIVELY proven (exact boot_id equal on both sides). `!bootChanged` is
-// NOT that proof — it is also true with no/malformed marker or the wall-clock
-// epoch fallback, where an unrelated cross-boot process can collide on
-// pid+ticks and be permanently baptized.
-test('bootProvenSame: exact equal boot_id on both sides is proof', () => {
-    assert.equal(bootProvenSame(ident('boot-A', 2_000), ident('boot-A', 1_000)), true);
-});
-test('bootProvenSame: no history is NOT proof (absent/malformed marker)', () => {
-    assert.equal(bootProvenSame(ident('boot-A', 1_000), null), false);
-});
-test('bootProvenSame: a missing boot_id on EITHER side is NOT proof (epoch fallback)', () => {
-    assert.equal(bootProvenSame(ident(null, 1_000), ident('boot-A', 1_000)), false, 'current lacks boot_id');
-    assert.equal(bootProvenSame(ident('boot-A', 1_000), ident(null, 1_000)), false, 'known lacks boot_id');
-    assert.equal(bootProvenSame(ident(null, 1_000), ident(null, 1_000)), false, 'both lack boot_id');
-});
-test('bootProvenSame: a different boot_id is not proof (it is a change)', () => {
-    assert.equal(bootProvenSame(ident('boot-B', 1_000), ident('boot-A', 1_000)), false);
-});
-// Drive the ACTUAL production startup composition (reconcile, then gate the
-// migration on proven same-boot provenance) rather than a test-side copy, so a
-// revert that inverts/drops the gate or reorders migration ahead of
-// reconciliation is caught here. `runDaemon` calls this same helper.
-function daemonBootStartup(current, captureIdentity) {
-    return reconcileAndMigrateBoot(migrateLegacyExecutionIdentities, current, captureIdentity);
-}
-const LEGACY = 'Sat Jul 11 17:51:45 2026#53459';
-test('migration gate: a cross-boot equal-ticks legacy row is NOT migrated when the marker is ABSENT (first-ever startup)', () => {
-    createNode(node('n1'));
-    setPidIdentity('n1', 111, LEGACY);
-    // No marker yet. A current-boot stranger process happens to hold pid 111 with
-    // the same ticks — an equal-ticks collision that would falsely migrate if the
-    // sweep ran. It must NOT: provenance is unproven.
-    const result = daemonBootStartup(ident(BOOT_A, 1_000_000), () => `${BOOT_A}#53459`);
-    assert.deepEqual(result.migrated, [], 'no marker → unproven → migration skipped');
-    assert.equal(getRow('n1')?.pi_pid_identity, LEGACY, 'the stranger is NOT baptized as the recorded process');
-});
-test('migration gate: a cross-boot equal-ticks legacy row is NOT migrated under the epoch fallback (no boot_id)', () => {
-    createNode(node('n1'));
-    setPidIdentity('n1', 111, LEGACY);
-    reconcileBootLiveness(ident(null, 1_000_000)); // seed a no-boot_id marker
-    // A transient current boot_id read failure: reconcile sees null on both sides,
-    // the epochs are within tolerance so no change is DETECTED, but same-boot is
-    // NOT PROVEN. A cross-boot pid+ticks collision must not be migrated.
-    const result = daemonBootStartup(ident(null, 1_000_000 + 5_000), () => `${BOOT_A}#53459`);
-    assert.deepEqual(result.migrated, [], 'epoch fallback → unproven → migration skipped');
-    assert.equal(getRow('n1')?.pi_pid_identity, LEGACY, 'not migrated on an unproven boot');
-});
-test('migration gate: a legacy row IS migrated when same-boot provenance is PROVEN (exact boot_id match)', () => {
-    createNode(node('n1'));
-    const executionId = setPidIdentity('n1', 111, LEGACY);
-    reconcileBootLiveness(ident(BOOT_A, 1_000_000)); // seed an exact-boot_id marker
-    // Same boot proven (boot_id equal on both sides); pid 111 still names the same
-    // live process (matching ticks) — the in-place upgrade completes.
-    const result = daemonBootStartup(ident(BOOT_A, 1_000_000 + 3_000), (pid) => pid === 111 ? `${BOOT_A}#53459` : undefined);
-    assert.deepEqual(result.migrated, [executionId]);
-    assert.equal(getRow('n1')?.pi_pid_identity, `${BOOT_A}#53459`, 'proven same boot → migrated in place');
-});
-test('migrateLegacyPidIdentities CAS: a concurrent re-record between probe and update is not clobbered', () => {
-    createNode(node('n1'));
-    setPidIdentity('n1', 111, LEGACY);
-    // The capture models the old broker still probing as its live legacy self,
-    // but a concurrent revive atomically re-records a FRESH (pid, identity) pair
-    // before the sweep's compare-and-swap update lands.
-    const result = migrateLegacyExecutionIdentities((pid) => {
-        if (pid === 111) {
-            setPidIdentity('n1', 222, `${BOOT_A}#77777`); // concurrent revive wins the row
-            return `${BOOT_A}#53459`; // stale probe result for the OLD pid
-        }
-        return undefined;
-    });
-    assert.deepEqual(result.migrated, [], 'CAS matched zero rows — no migration counted');
-    assert.equal(getRow('n1')?.pi_pid, 222, 'the concurrent revive pid stands');
-    assert.equal(getRow('n1')?.pi_pid_identity, `${BOOT_A}#77777`, 'the fresh identity is NOT overwritten by the stale one');
-});

package/dist/core/__tests__/branded-host-concurrency.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/branded-host-concurrency.test.js

@@ -1,72 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync, existsSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { spawn, spawnSync } from 'node:child_process';
-function reconcileInChild(home, moduleUrl) {
-    const script = `
-    const host = await import(${JSON.stringify(moduleUrl)});
-    const path = host.ensureBrandedHost();
-    process.stdout.write(JSON.stringify({ path, healthy: host.brandedHostWorks(path) }));
-  `;
-    return new Promise((resolve, reject) => {
-        const child = spawn(process.execPath, ['--import', 'tsx', '--input-type=module', '-e', script], {
-            cwd: process.cwd(),
-            env: { ...process.env, HOME: home },
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        let stdout = '';
-        let stderr = '';
-        child.stdout.setEncoding('utf8').on('data', (chunk) => { stdout += chunk; });
-        child.stderr.setEncoding('utf8').on('data', (chunk) => { stderr += chunk; });
-        child.once('error', reject);
-        child.once('close', (code) => resolve({ code, stdout, stderr }));
-    });
-}
-test('concurrent processes reconcile one coherent branded host tuple', async () => {
-    const home = mkdtempSync(join(tmpdir(), 'crtr-branded-host-race-'));
-    const hostDir = join(home, '.crouter', 'host');
-    mkdirSync(hostDir, { recursive: true });
-    writeFileSync(join(hostDir, '.source.json'), JSON.stringify({ version: 2, source: '/stale/node', libnode: 'libnode.stale.dylib' }));
-    writeFileSync(join(hostDir, 'libnode.stale.dylib'), 'stale');
-    const deadOwner = spawnSync(process.execPath, ['-e', '']).pid;
-    assert.ok(deadOwner !== undefined);
-    const abandonedLock = join(home, '.crouter', 'host.lock');
-    mkdirSync(abandonedLock);
-    writeFileSync(join(abandonedLock, `owner.${deadOwner}.abandoned`), '');
-    try {
-        const moduleUrl = pathToFileURL(join(process.cwd(), 'src/core/runtime/branded-host.ts')).href;
-        const results = await Promise.all(Array.from({ length: 4 }, () => reconcileInChild(home, moduleUrl)));
-        const expectedPath = join(hostDir, 'crouter');
-        for (const result of results) {
-            assert.equal(result.code, 0, result.stderr);
-            assert.doesNotMatch(result.stderr, /codesign failed|permission denied|no such file or directory/i);
-            assert.deepEqual(JSON.parse(result.stdout), { path: expectedPath, healthy: true });
-        }
-        const marker = JSON.parse(readFileSync(join(hostDir, '.source.json'), 'utf8'));
-        assert.deepEqual(marker, {
-            version: 2,
-            source: realpathSync(process.execPath),
-            libnode: marker.libnode,
-        });
-        assert.equal(existsSync(expectedPath), true);
-        assert.equal(marker.libnode === null || existsSync(join(hostDir, marker.libnode)), true);
-        assert.equal(existsSync(join(hostDir, 'libnode.stale.dylib')), false);
-        assert.equal(existsSync(abandonedLock), false, 'the completed owner releases the reclaimed lock');
-        const health = spawnSync(expectedPath, ['-e', ''], { stdio: 'ignore', timeout: 2_000 });
-        assert.equal(health.status, 0, 'the published host and its matching libnode launch together');
-        if (process.platform === 'darwin') {
-            for (const path of [expectedPath, marker.libnode === null ? null : join(hostDir, marker.libnode)]) {
-                if (path === null)
-                    continue;
-                const verified = spawnSync('codesign', ['--verify', '--deep', '--strict', path], { encoding: 'utf8' });
-                assert.equal(verified.status, 0, verified.stderr);
-            }
-        }
-    }
-    finally {
-        rmSync(home, { recursive: true, force: true });
-    }
-});

package/dist/core/__tests__/broker-extension-canvas-db-boundary.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/broker-extension-canvas-db-boundary.test.js

@@ -1,75 +0,0 @@
-// The shipped Pi extensions execute in broker processes, which must never load
-// canvas.db code. This walks each shipped extension's local static import graph
-// and rejects any reach to the single DB accessor module.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { dirname, join, normalize, resolve } from 'node:path';
-import ts from 'typescript';
-import { CANVAS_EXTENSION_NAMES } from '../canvas/extensions.js';
-const SOURCE_ROOT = resolve(process.cwd(), 'src');
-const DB_MODULE = normalize(join(SOURCE_ROOT, 'core/canvas/db.ts'));
-// The builtin pi-crtr-extensions package loads into the SAME broker process
-// as the shipped pi-extensions/ roots below (its own package.json declares
-// `pi.extensions: ["extensions/*.ts", "extensions/*/index.ts"]`), so it must
-// clear the identical canvas.db-free bar. Read the glob's two shapes directly
-// off disk rather than hardcoding a name list, so a future extension added to
-// the package is covered automatically.
-function builtinPiCrtrExtensionRoots() {
-    const extDir = join(SOURCE_ROOT, 'builtin-pi-packages/pi-crtr-extensions/extensions');
-    const roots = [];
-    for (const entry of readdirSync(extDir, { withFileTypes: true })) {
-        if (entry.isFile() && entry.name.endsWith('.ts') && !entry.name.includes('.test.')) {
-            roots.push(join(extDir, entry.name));
-        }
-        else if (entry.isDirectory()) {
-            const indexFile = join(extDir, entry.name, 'index.ts');
-            if (existsSync(indexFile))
-                roots.push(indexFile);
-        }
-    }
-    return roots;
-}
-function resolveLocalImport(from, specifier) {
-    if (!specifier.startsWith('.'))
-        return null;
-    const stem = resolve(dirname(from), specifier).replace(/\.js$/, '');
-    for (const candidate of [`${stem}.ts`, join(stem, 'index.ts')]) {
-        if (existsSync(candidate))
-            return normalize(candidate);
-    }
-    return null;
-}
-function importsOf(file) {
-    const source = readFileSync(file, 'utf8');
-    return ts.preProcessFile(source, true, true).importedFiles
-        .map((reference) => resolveLocalImport(file, reference.fileName))
-        .filter((target) => target !== null);
-}
-function dbReach(root) {
-    const pending = [{ file: root, path: [root] }];
-    const seen = new Set([root]);
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (current.file === DB_MODULE)
-            return current.path;
-        for (const imported of importsOf(current.file)) {
-            if (seen.has(imported))
-                continue;
-            seen.add(imported);
-            pending.push({ file: imported, path: [...current.path, imported] });
-        }
-    }
-    return null;
-}
-test('every shipped broker extension and the prospective preflight are transitively canvas.db-free', () => {
-    const roots = [
-        ...CANVAS_EXTENSION_NAMES.map((name) => join(SOURCE_ROOT, 'pi-extensions', `${name}.ts`)),
-        join(SOURCE_ROOT, 'core/runtime/prospective-inventory-cli.ts'),
-        ...builtinPiCrtrExtensionRoots(),
-    ];
-    for (const root of roots) {
-        const reach = dbReach(root);
-        assert.equal(reach, null, `${root} reaches canvas.db through:\n${reach?.join('\n')}`);
-    }
-});

package/dist/core/__tests__/broker-launch-candidates.test.d.ts

@@ -1 +0,0 @@
-export {};