@openparachute/hub 0.7.6 → 0.7.7-rc.13

package/src/__tests__/sessions.test.ts

@@ -5,13 +5,15 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   SESSION_COOKIE_NAME,
-  SESSION_MAX_LIFETIME_MS,
+  SESSION_SLIDE_THRESHOLD_MS,
+  SESSION_TTL_MS,
   buildSessionClearCookie,
   buildSessionCookie,
   createSession,
   deleteSession,
   findSession,
   parseSessionCookie,
+  shouldSlideSession,
   touchSession,
 } from "../sessions.ts";
 import { createUser } from "../users.ts";
@@ -57,11 +59,11 @@ describe("createSession + findSession", () => {
     try {
       const epoch = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => epoch });
-      // Past TTL (24h).
-      const later = new Date(epoch.getTime() + 25 * 3600 * 1000);
+      // Past TTL (90 days).
+      const later = new Date(epoch.getTime() + SESSION_TTL_MS + 3600 * 1000);
       expect(findSession(db, s.id, () => later)).toBeNull();
       // Still valid one second before expiry.
-      const justBefore = new Date(epoch.getTime() + 24 * 3600 * 1000 - 1000);
+      const justBefore = new Date(epoch.getTime() + SESSION_TTL_MS - 1000);
       expect(findSession(db, s.id, () => justBefore)?.id).toBe(s.id);
     } finally {
       cleanup();
@@ -78,60 +80,64 @@ describe("touchSession (sliding renewal)", () => {
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      // Original expiry: t0 + 24h.
-      expect(new Date(s.expiresAt).getTime()).toBe(t0.getTime() + DAY);
-      // Touch 1h later → expiry becomes (t0 + 1h) + 24h.
+      // Original expiry: t0 + 90d.
+      expect(new Date(s.expiresAt).getTime()).toBe(t0.getTime() + SESSION_TTL_MS);
+      // Touch 1h later → expiry becomes (t0 + 1h) + 90d.
       const t1 = new Date(t0.getTime() + HOUR);
       touchSession(db, s.id, () => t1);
       const found = findSession(db, s.id, () => t1);
-      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(t1.getTime() + DAY);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(t1.getTime() + SESSION_TTL_MS);
     } finally {
       cleanup();
     }
   });
 
-  test("a touched session outlives the ORIGINAL 24h expiry", async () => {
+  test("a touched session outlives the ORIGINAL 90d expiry", async () => {
     const { db, userId, cleanup } = await makeDb();
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      // Activity at +12h slides expiry to +36h.
-      touchSession(db, s.id, () => new Date(t0.getTime() + 12 * HOUR));
-      // At +30h — PAST the original +24h — the session is still alive.
-      const at30h = new Date(t0.getTime() + 30 * HOUR);
-      expect(findSession(db, s.id, () => at30h)?.id).toBe(s.id);
+      // Activity at +45d slides expiry to +135d.
+      touchSession(db, s.id, () => new Date(t0.getTime() + 45 * DAY));
+      // At +100d — PAST the original +90d — the session is still alive.
+      const at100d = new Date(t0.getTime() + 100 * DAY);
+      expect(findSession(db, s.id, () => at100d)?.id).toBe(s.id);
     } finally {
       cleanup();
     }
   });
 
-  test("an UNtouched session still expires at the original 24h", async () => {
+  test("an UNtouched session still expires at the original 90d", async () => {
     const { db, userId, cleanup } = await makeDb();
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      // No touch — at +25h it's gone (today's absolute-TTL behavior preserved
-      // for idle / closed tabs that stop re-minting).
-      const at25h = new Date(t0.getTime() + 25 * HOUR);
-      expect(findSession(db, s.id, () => at25h)).toBeNull();
+      // No touch — one day past the 90d TTL it's gone (idle / closed tabs
+      // that stop re-minting still lapse at the full TTL).
+      const past = new Date(t0.getTime() + SESSION_TTL_MS + DAY);
+      expect(findSession(db, s.id, () => past)).toBeNull();
     } finally {
       cleanup();
     }
   });
 
-  test("caps at created_at + SESSION_MAX_LIFETIME_MS (sliding can't run forever)", async () => {
+  test("NO ceiling (Q4) — an actively-touched session rolls forward indefinitely", async () => {
+    // The old SESSION_MAX_LIFETIME_MS (30d) absolute cap is gone: repeatedly
+    // touching a session keeps sliding its expiry to now + 90d with no upper
+    // bound, matching cloud's rolling posture (an idle session still lapses
+    // at the TTL; an active one never does).
     const { db, userId, cleanup } = await makeDb();
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      const ceiling = t0.getTime() + SESSION_MAX_LIFETIME_MS;
-      // A touch near the ceiling would slide to now + 24h, but the cap pins it.
-      const nearCeiling = new Date(ceiling - HOUR); // raw slide would be ceiling + 23h
-      touchSession(db, s.id, () => nearCeiling);
-      const found = findSession(db, s.id, () => nearCeiling);
-      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(ceiling);
-      // Past the ceiling the session is dead even though it was just "active".
-      expect(findSession(db, s.id, () => new Date(ceiling + 1000))).toBeNull();
+      // Touch well past where the old 30-day ceiling would have pinned it.
+      const farOut = new Date(t0.getTime() + 200 * DAY);
+      touchSession(db, s.id, () => farOut);
+      const found = findSession(db, s.id, () => farOut);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(farOut.getTime() + SESSION_TTL_MS);
+      // Still alive nearly 90 more days out, right up to the fresh slide's TTL.
+      const stillAlive = new Date(farOut.getTime() + SESSION_TTL_MS - DAY);
+      expect(findSession(db, s.id, () => stillAlive)?.id).toBe(s.id);
     } finally {
       cleanup();
     }
@@ -147,6 +153,47 @@ describe("touchSession (sliding renewal)", () => {
   });
 });
 
+describe("shouldSlideSession (bounded slide, G3 twin)", () => {
+  test("false for a freshly-created session (full TTL remaining)", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      expect(shouldSlideSession(s, () => t0)).toBe(false);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("false just before crossing the slide threshold", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Elapsed just UNDER the threshold (30d) → remaining life still above
+      // (TTL - threshold) → not yet due to slide.
+      const justBefore = new Date(t0.getTime() + SESSION_SLIDE_THRESHOLD_MS - 1000);
+      expect(shouldSlideSession(s, () => justBefore)).toBe(false);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("true once remaining life drops below the slide threshold", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Elapsed just OVER the threshold (30d) → remaining life below
+      // (TTL - threshold) → due to slide.
+      const justAfter = new Date(t0.getTime() + SESSION_SLIDE_THRESHOLD_MS + 1000);
+      expect(shouldSlideSession(s, () => justAfter)).toBe(true);
+    } finally {
+      cleanup();
+    }
+  });
+});
+
 describe("deleteSession", () => {
   test("removes the session row", async () => {
     const { db, userId, cleanup } = await makeDb();

package/src/__tests__/setup-wizard.test.ts

@@ -2066,19 +2066,16 @@ describe("handleSetupVaultPost", () => {
   test("scribe transcribe=local resolves to the host platform's backend (the Linux trap fix)", async () => {
     // The bug: `local` mapped UNCONDITIONALLY to parakeet-mlx (macOS-only),
     // silently broken on every Linux box. After the fix it resolves to the
-    // platform backend. We assert against the actual host so it's correct on
-    // both Mac (parakeet-mlx) and Linux CI (onnx-asr). The RAM gate only kicks
-    // in below 2 GB — CI/dev boxes clear it, so the choice stays `local`.
-    const { platformLocalProvider } = await import("../scribe-config.ts");
-    const expected = platformLocalProvider(process.platform);
+    // platform backend. The expectation uses the same host RAM decision so
+    // constrained CI boxes correctly assert the cloud fallback instead.
+    const { decideLocalProvider, readAvailableRamMib } = await import("../scribe-config.ts");
+    const decision = decideLocalProvider(process.platform, readAvailableRamMib());
     const { response } = await postVaultWithFields(h, { scribe_provider: "local" });
     expect(response.status).toBe(303);
     const cfg = readScribeConfig(h.dir);
-    if (expected !== null) {
-      // On a supported platform with enough RAM, `local` resolves to the
-      // platform backend — NOT a hardcoded parakeet-mlx on Linux.
-      expect(cfg?.transcribe).toEqual({ provider: expected });
-    }
+    expect(cfg?.transcribe).toEqual({
+      provider: decision.ok ? decision.provider : decision.steerTo,
+    });
   });
 });
 

package/src/__tests__/setup.test.ts

@@ -142,7 +142,10 @@ describe("setup", () => {
       // rejects duplicate ports between distinct services (hub#195).
       // parachute-runner rides along as a LEGACY row (runner left the
       // registries 2026-07-01): it must neither block the all-installed exit
-      // nor crash the survey.
+      // nor crash the survey. parachute-app (hub-parity P5, 2026-07-11) is
+      // included so this fixture stays truly "everything installed" — without
+      // it, `app` is a genuinely offered-but-uninstalled service and the
+      // non-tty exit code flips from 0 to 1 (nothing left vs. work-to-offer).
       const seeds: Array<{ name: string; port: number }> = [
         { name: "parachute-vault", port: 1940 },
         { name: "parachute-notes", port: 1942 },
@@ -150,6 +153,7 @@ describe("setup", () => {
         { name: "parachute-agent", port: 1941 },
         { name: "parachute-runner", port: 1945 },
         { name: "parachute-surface", port: 1946 },
+        { name: "parachute-app", port: 1944 },
       ];
       for (const s of seeds) {
         upsertService(
@@ -181,18 +185,14 @@ describe("setup", () => {
     }
   });
 
-  test("fresh box: the offered 'Available to install' list excludes deprecated notes + removed runner", async () => {
+  test("fresh box: the offered list excludes deprecated notes and removed Agent/runner", async () => {
     const h = makeHarness();
     try {
-      // 'all' picks every OFFERED service. With a clean services.json the survey
-      // sees every known short; the offered filter must drop notes (deprecated,
-      // 2026-06-25) while runner never even reaches the survey (registry
-      // removal, 2026-07-01) — keeping vault/scribe/surface/agent. Only vault +
-      // scribe have pre-install follow-up prompts (vault name, scribe provider);
-      // surface + agent have none — so the scripted answers below are complete.
+      // 'all' picks every offered service. The clean-box offer excludes notes
+      // (deprecated) and retired Agent/runner, keeping vault/scribe/surface/app.
       const availability = scriptedAvailability([
-        "all", // pick everything offered
-        "default", // vault name (vault is in the offered set)
+        "all",
+        "default", // vault name
         "1", // scribe provider
       ]);
       const code = await setup({
@@ -206,20 +206,19 @@ describe("setup", () => {
         },
       });
       expect(code).toBe(0);
-      // The "Available to install" banner must NOT list notes / runner.
       const joined = h.logs.join("\n");
       const availableBlock = joined.slice(joined.indexOf("Available to install:"));
       expect(availableBlock).not.toMatch(/\bnotes\b/);
       expect(availableBlock).not.toMatch(/\brunner\b/);
-      // …and `install()` is never invoked for the deprecated shorts.
+      expect(availableBlock).not.toMatch(/\bagent\b/);
       const installedShorts = h.calls.map((c) => c.short);
       expect(installedShorts).not.toContain("notes");
       expect(installedShorts).not.toContain("runner");
-      // The non-deprecated set is still offered + installed.
+      expect(installedShorts).not.toContain("agent");
       expect(installedShorts).toContain("vault");
       expect(installedShorts).toContain("scribe");
       expect(installedShorts).toContain("surface");
-      expect(installedShorts).toContain("agent");
+      expect(installedShorts).toContain("app");
     } finally {
       h.cleanup();
     }

package/src/__tests__/status.test.ts

@@ -225,11 +225,6 @@ describe("status — per-module URL deep-links (manifestRowBase / urlForEntry)",
     expect(out).toMatch(/:5173\/notes/);
   });
 
-  test("channel row prints port + /channel mount", async () => {
-    const out = await urlFor("parachute-channel", 1943, ["/channel"]);
-    expect(out).toMatch(/:1943\/channel/);
-  });
-
   test("unknown third-party service falls back to bare host:port + paths[0]", async () => {
     const { path, configDir, cleanup } = makeTempPath();
     try {

package/src/__tests__/surface-notes-alias.test.ts

@@ -0,0 +1,296 @@
+/**
+ * W2-12 — `/surface/notes` → `/surface/parachute` conditional alias.
+ *
+ * The condition is decided on `uis{}` MOUNT PATHS (the values
+ * `resolveUiMount` routes on), not map keys: fire only when no sub-unit
+ * resolves at/under `/surface/notes` AND one is mounted at exactly
+ * `/surface/parachute`. Unit tests pin the helper's condition + target
+ * shape; the integration tests drive `hubFetch` end-to-end to prove the
+ * dispatch placement (before the generic services proxy) and — the
+ * load-bearing half — that an EXISTING notes-ui install (a `/surface/notes`
+ * uis mount) passes through to its upstream untouched.
+ */
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hubFetch } from "../hub-server.ts";
+import { clearNotesRedirectLogState } from "../notes-redirect.ts";
+import { type ServiceEntry, writeManifest } from "../services-manifest.ts";
+import { isSurfaceNotesPath, maybeRedirectSurfaceNotes } from "../surface-notes-alias.ts";
+
+// ---------------------------------------------------------------------------
+// Manifest fixtures
+// ---------------------------------------------------------------------------
+
+/** A surface-host row carrying the given uis map (or none). */
+function surfaceRow(uis: ServiceEntry["uis"] | undefined, port = 1946): ServiceEntry {
+  const entry: ServiceEntry = {
+    name: "parachute-surface",
+    port,
+    paths: ["/surface"],
+    health: "/surface/healthz",
+    version: "0.4.0",
+  };
+  if (uis !== undefined) entry.uis = uis;
+  return entry;
+}
+
+/** Post-rename install: the app surface registered at /surface/parachute. */
+const PARACHUTE_UIS: ServiceEntry["uis"] = {
+  parachute: { displayName: "Parachute", path: "/surface/parachute", audience: "public" },
+};
+
+/** Existing install: notes-ui still registered at /surface/notes. */
+const NOTES_UIS: ServiceEntry["uis"] = {
+  notes: { displayName: "Notes", path: "/surface/notes", audience: "public" },
+};
+
+// ---------------------------------------------------------------------------
+// isSurfaceNotesPath — boundary shape
+// ---------------------------------------------------------------------------
+
+describe("isSurfaceNotesPath", () => {
+  test("matches the bare mount, trailing slash, and sub-paths", () => {
+    expect(isSurfaceNotesPath("/surface/notes")).toBe(true);
+    expect(isSurfaceNotesPath("/surface/notes/")).toBe(true);
+    expect(isSurfaceNotesPath("/surface/notes/index.html")).toBe(true);
+    expect(isSurfaceNotesPath("/surface/notes/a/b?ignored-not-part-of-path")).toBe(true);
+  });
+
+  test("does NOT match sibling prefixes or other mounts", () => {
+    expect(isSurfaceNotesPath("/surface/notesy")).toBe(false);
+    expect(isSurfaceNotesPath("/surface/notes-archive/")).toBe(false);
+    expect(isSurfaceNotesPath("/surface/parachute")).toBe(false);
+    expect(isSurfaceNotesPath("/notes/")).toBe(false);
+    expect(isSurfaceNotesPath("/surface")).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// maybeRedirectSurfaceNotes — the condition + target shape
+// ---------------------------------------------------------------------------
+
+describe("maybeRedirectSurfaceNotes", () => {
+  test("fires when /surface/parachute is mounted and /surface/notes is not", () => {
+    const services = [surfaceRow(PARACHUTE_UIS)];
+    expect(maybeRedirectSurfaceNotes("/surface/notes", "", services)).toBe("/surface/parachute");
+    expect(maybeRedirectSurfaceNotes("/surface/notes/", "", services)).toBe("/surface/parachute/");
+    expect(maybeRedirectSurfaceNotes("/surface/notes/a/b.html", "", services)).toBe(
+      "/surface/parachute/a/b.html",
+    );
+  });
+
+  test("preserves the query string on the target", () => {
+    const services = [surfaceRow(PARACHUTE_UIS)];
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "?q=1&n=2", services)).toBe(
+      "/surface/parachute/x?q=1&n=2",
+    );
+  });
+
+  test("INERT when a /surface/notes mount exists (existing notes-ui install)", () => {
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(NOTES_UIS)])).toBe(
+      undefined,
+    );
+    // ... even when a parachute mount ALSO exists (transitional both-present
+    // install) — a live legacy mount is never preempted.
+    const both = [surfaceRow({ ...NOTES_UIS, ...PARACHUTE_UIS })];
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", both)).toBe(undefined);
+  });
+
+  test("INERT when no uis{} exist at all (pre-uis surface-host rows — today's live shape)", () => {
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(undefined)])).toBe(
+      undefined,
+    );
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [])).toBe(undefined);
+  });
+
+  test("INERT when the target mount is absent — never redirects into a 404", () => {
+    // A `parachute` KEY whose path was customized elsewhere does not count:
+    // the redirect target is the literal /surface/parachute mount, so its
+    // existence (by path) is part of the condition.
+    const customized: ServiceEntry["uis"] = {
+      parachute: { displayName: "Parachute", path: "/surface/app", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(customized)])).toBe(
+      undefined,
+    );
+  });
+
+  test("fires in the in-place-upgrade caveat: uis KEY still `notes`, PATH flipped to /surface/parachute", () => {
+    // Re-adding the renamed package over the old instance with
+    // `instance_name=notes` and no `mount_path` keeps the map key `notes`
+    // while the mount flips — exactly the orphaned-bookmark scenario this
+    // alias exists for. The path-based condition (not key-based) covers it.
+    const upgraded: ServiceEntry["uis"] = {
+      notes: { displayName: "Parachute", path: "/surface/parachute", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "?a=1", [surfaceRow(upgraded)])).toBe(
+      "/surface/parachute/x?a=1",
+    );
+  });
+
+  test("a sub-unit mounted UNDER /surface/notes counts as the legacy identity resolving", () => {
+    // A deeper mount like /surface/notes/foo still serves real content under
+    // the legacy prefix; redirecting across it would hijack a live route.
+    const deep: ServiceEntry["uis"] = {
+      ...PARACHUTE_UIS,
+      foo: { displayName: "Foo", path: "/surface/notes/foo", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/foo/x", "", [surfaceRow(deep)])).toBe(
+      undefined,
+    );
+  });
+
+  test("non-matching pathnames return undefined regardless of manifest state", () => {
+    const services = [surfaceRow(PARACHUTE_UIS)];
+    expect(maybeRedirectSurfaceNotes("/surface/notesy", "", services)).toBe(undefined);
+    expect(maybeRedirectSurfaceNotes("/surface/parachute/x", "", services)).toBe(undefined);
+    expect(maybeRedirectSurfaceNotes("/notes/x", "", services)).toBe(undefined);
+  });
+
+  test("normalizes trailing slashes on declared uis paths", () => {
+    const slashed: ServiceEntry["uis"] = {
+      parachute: { displayName: "Parachute", path: "/surface/parachute/", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(slashed)])).toBe(
+      "/surface/parachute/x",
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// hubFetch integration — dispatch placement + passthrough
+// ---------------------------------------------------------------------------
+
+interface Harness {
+  dir: string;
+  manifestPath: string;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "pcli-surface-notes-alias-"));
+  return {
+    dir,
+    manifestPath: join(dir, "services.json"),
+    cleanup: () => rmSync(dir, { recursive: true, force: true }),
+  };
+}
+
+function req(path: string): Request {
+  return new Request(`http://127.0.0.1${path}`);
+}
+
+// Loopback peer so the default publicExposure cloak never interferes —
+// same shape audience-gate.test.ts uses.
+const fakeServer = (address: string) => ({ requestIP: () => ({ address }) });
+
+function startEchoUpstream(): { port: number; stop: () => void } {
+  const server = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    fetch: (r) =>
+      new Response(JSON.stringify({ upstream: "notes-ui", path: new URL(r.url).pathname }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+  });
+  return { port: server.port as number, stop: () => server.stop(true) };
+}
+
+describe("hubFetch × surface-notes alias (W2-12)", () => {
+  test("301: /surface/notes/* → /surface/parachute/* when only the parachute mount exists (tail + query preserved)", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [surfaceRow(PARACHUTE_UIS)] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes/some/path?q=1&n=2"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(301);
+      expect(res.headers.get("location")).toBe("/surface/parachute/some/path?q=1&n=2");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("301: bare /surface/notes → /surface/parachute", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [surfaceRow(PARACHUTE_UIS)] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(301);
+      expect(res.headers.get("location")).toBe("/surface/parachute");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("200 passthrough: an existing notes-ui install (notes uis mount) proxies to its upstream untouched", async () => {
+    clearNotesRedirectLogState();
+    const upstream = startEchoUpstream();
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [surfaceRow(NOTES_UIS, upstream.port)] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes/index.html"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { upstream: string; path: string };
+      // The blind proxy forwarded the ORIGINAL path — no rewrite rode along.
+      expect(body.upstream).toBe("notes-ui");
+      expect(body.path).toBe("/surface/notes/index.html");
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
+  test("404: /surface/notesy (sibling prefix) is untouched by the alias", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      // parachute-mount-only manifest, but NO row claims /surface/notesy —
+      // the boundary check keeps the alias out of the way and the dispatch
+      // falls through to the branded 404.
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-app",
+              port: 1944,
+              paths: ["/app"],
+              health: "/app",
+              version: "0.5.0",
+              uis: PARACHUTE_UIS,
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notesy"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(404);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("404 (not 301): no uis at all — today's live shape stays inert end-to-end", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      // A pre-uis surface row would normally proxy /surface/* blind; with no
+      // live upstream the proxy path yields a 502/404-class response — the
+      // assertion here is only that NO 301 fires. Use an empty manifest so
+      // the outcome is a deterministic 404.
+      writeManifest({ services: [] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes/"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(404);
+    } finally {
+      h.cleanup();
+    }
+  });
+});