@openparachute/hub 0.7.6 → 0.7.7-rc.13

package/src/__tests__/services-manifest.test.ts

@@ -1,7 +1,8 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { RETIRED_MODULES } from "../service-spec.ts";
 import {
   type ServiceEntry,
   ServicesManifestError,
@@ -403,9 +404,9 @@ describe("services-manifest", () => {
             slug: {
               displayName: "S",
               path: "/app/s",
-              // biome-ignore lint/suspicious/noExplicitAny: deliberately
-              // writing the pre-F legacy alias to pin the normalization
-              // boundary; the schema accepts it on read.
+              // Deliberately write the pre-F legacy alias to pin the
+              // normalization boundary; the schema accepts it on read.
+              // biome-ignore lint/suspicious/noExplicitAny: legacy fixture value
               status: "pending-oauth" as any,
             },
           },
@@ -871,20 +872,7 @@ describe("services-manifest", () => {
   });
 });
 
-describe("claw → agent migration", () => {
-  // Paraclaw was renamed to parachute-agent across the ecosystem (npm
-  // package, mount path, short name). The migration was a transitional
-  // read-time rewrite that aliased legacy `name: "claw"` rows to
-  // `name: "agent"` so operators on the old shape kept routing.
-  //
-  // History: parachute-agent (the Claude-in-containers module) was retired
-  // 2026-05-20 (hub#334 added `agent` to RETIRED_MODULES), which briefly made
-  // this a one-step retirement path (claw → agent → GC'd). The 2026-06-17
-  // channel→agent rename RE-ASSIGNED `agent`/`parachute-agent` to the renamed
-  // channel module, so those names left RETIRED_MODULES — `agent` is a live
-  // module again. The claw → agent rewrite still runs; the migrated row now
-  // PERSISTS (it routes to the live agent module). The tests below assert the
-  // rewrite + the persistence.
+describe("historical Agent row retirement", () => {
   const claw: ServiceEntry = {
     name: "claw",
     port: 1944,
@@ -892,70 +880,37 @@ describe("claw → agent migration", () => {
     health: "/claw/health",
     version: "0.1.0",
   };
-  const agent: ServiceEntry = {
-    name: "agent",
-    port: 1944,
-    paths: ["/agent"],
-    health: "/agent/health",
-    version: "0.1.0",
-  };
 
-  test("rewrites name + paths + health when both name=claw and paths[0]=/claw", () => {
+  test("strict reads retire the structural claw row immediately and persist the cleanup", () => {
     const { path, cleanup } = makeTempPath();
     try {
       writeFileSync(path, `${JSON.stringify({ services: [claw] }, null, 2)}\n`);
-      const got = readManifest(path);
-      // Migration ran in this read (claw → agent on raw entries), then
-      // the row was rewritten to disk. Post the 2026-06-17 channel→agent
-      // rename, `agent` is once again a LIVE module (the renamed channel
-      // module), so it is NO LONGER GC'd by RETIRED_MODULES — the migrated
-      // row persists and routes to the live agent module's mount.
-      expect(got.services).toEqual([agent]);
-      const reread = JSON.parse(readFileSync(path, "utf8")) as {
-        services: ServiceEntry[];
-      };
-      expect(reread.services[0]?.name).toBe("agent");
-      expect(reread.services[0]?.paths).toEqual(["/agent"]);
-      expect(reread.services[0]?.health).toBe("/agent/health");
+      expect(readManifest(path).services).toEqual([]);
+      const persisted = JSON.parse(readFileSync(path, "utf8")) as { services: ServiceEntry[] };
+      expect(persisted.services).toEqual([]);
     } finally {
       cleanup();
     }
   });
 
-  test("the migrated agent row PERSISTS on the next read (agent is live again post-rename)", () => {
-    // Pre-rename this was a one-step retirement path (claw → agent → GC'd).
-    // After the channel→agent rename (2026-06-17) `agent`/`parachute-agent`
-    // are re-assigned to the live module, so the row is NOT dropped — a
-    // stale paraclaw row now ends up pointing at the live agent module
-    // (harmless / arguably correct, since paraclaw was the original "agent").
+  test("lenient hot-path reads also hide structural claw and bare channel rows", () => {
     const { path, cleanup } = makeTempPath();
     try {
-      writeFileSync(path, `${JSON.stringify({ services: [claw] }, null, 2)}\n`);
-      const first = readManifest(path);
-      expect(first.services).toEqual([agent]);
-      const second = readManifest(path);
-      expect(second.services).toEqual([agent]);
-    } finally {
-      cleanup();
-    }
-  });
-
-  test("an already-agent entry round-trips unchanged (agent live again post-rename)", () => {
-    // Pre-hub#334 this verified the migration was idempotent; hub#334 made it
-    // GC the agent row (agent was retired). After the channel→agent rename
-    // (2026-06-17) agent is live again, so the row round-trips unchanged —
-    // back to the original idempotent behavior.
-    const { path, cleanup } = makeTempPath();
-    try {
-      writeFileSync(path, `${JSON.stringify({ services: [agent] }, null, 2)}\n`);
-      const got = readManifest(path);
-      expect(got.services).toEqual([agent]);
+      const channel: ServiceEntry = {
+        name: "channel",
+        port: 1941,
+        paths: ["/channel"],
+        health: "/channel/health",
+        version: "0.1.0",
+      };
+      writeFileSync(path, `${JSON.stringify({ services: [claw, channel] }, null, 2)}\n`);
+      expect(readManifestLenient(path, { warn: () => {} }).services).toEqual([]);
     } finally {
       cleanup();
     }
   });
 
-  test("mixed manifest: vault and scribe are untouched, only claw migrates", () => {
+  test("mixed manifests retain supported rows while dropping historical Agent shapes", () => {
     const { path, cleanup } = makeTempPath();
     try {
       const scribe: ServiceEntry = {
@@ -966,38 +921,13 @@ describe("claw → agent migration", () => {
         version: "0.1.0",
       };
       writeFileSync(path, `${JSON.stringify({ services: [vault, claw, scribe] }, null, 2)}\n`);
-      const got = readManifest(path);
-      // First read: claw migrates to agent (retired GC didn't see `claw`
-      // on the way in). Vault + scribe round-trip unchanged.
-      expect(got.services).toHaveLength(3);
-      expect(got.services[0]).toEqual(vault);
-      expect(got.services[1]).toEqual(agent);
-      expect(got.services[2]).toEqual(scribe);
-    } finally {
-      cleanup();
-    }
-  });
-
-  test("preserves nested /claw paths when present (e.g. /claw/api)", () => {
-    const { path, cleanup } = makeTempPath();
-    try {
-      const clawNested: ServiceEntry = {
-        name: "claw",
-        port: 1944,
-        paths: ["/claw", "/claw/api"],
-        health: "/claw/api/health",
-        version: "0.1.0",
-      };
-      writeFileSync(path, `${JSON.stringify({ services: [clawNested] }, null, 2)}\n`);
-      const got = readManifest(path);
-      expect(got.services[0]?.paths).toEqual(["/agent", "/agent/api"]);
-      expect(got.services[0]?.health).toBe("/agent/api/health");
+      expect(readManifest(path).services).toEqual([vault, scribe]);
     } finally {
       cleanup();
     }
   });
 
-  test("leaves a row alone if name is claw but mount is something else (deliberate third-party reuse)", () => {
+  test("leaves a row alone if name is claw but mount is something else", () => {
     const { path, cleanup } = makeTempPath();
     try {
       const oddClaw: ServiceEntry = {
@@ -1009,6 +939,7 @@ describe("claw → agent migration", () => {
       };
       writeFileSync(path, `${JSON.stringify({ services: [oddClaw] }, null, 2)}\n`);
       expect(readManifest(path).services).toEqual([oddClaw]);
+      expect(readManifestLenient(path, { warn: () => {} }).services).toEqual([oddClaw]);
     } finally {
       cleanup();
     }
@@ -1024,6 +955,14 @@ describe("claw → agent migration", () => {
 // file so the next read is clean.
 describe("legacy short-name row de-dupe (parachute-app#13 / runner#4)", () => {
   test("drops the short-name row when a same-port manifestName row exists", () => {
+    // Fixture uses `surface` (the ACTUAL short-name twin of `parachute-surface`
+    // per the structural rule: b.name === `parachute-${a.name}`) rather than
+    // `app`. Pre-hub-parity-P5 this test used `app` here, but that only
+    // passed because `app` was ALSO in RETIRED_MODULES at the time — the
+    // unconditional retired-module GC (not this structural short-name rule)
+    // was doing the dropping. Now that `app`/`parachute-app` are un-retired
+    // (hub-parity P5, a new unrelated module claims them), this fixture is
+    // corrected to actually exercise `dropLegacyShortNameRows`.
     const { path, cleanup } = makeTempPath();
     try {
       writeFileSync(
@@ -1038,7 +977,7 @@ describe("legacy short-name row de-dupe (parachute-app#13 / runner#4)", () => {
               version: "0.2.0",
             },
             {
-              name: "app",
+              name: "surface",
               port: 1946,
               paths: ["/surface"],
               health: "/surface/healthz",
@@ -1195,6 +1134,9 @@ describe("legacy short-name row de-dupe (parachute-app#13 / runner#4)", () => {
   });
 
   test("idempotent — second read leaves the cleaned file alone", () => {
+    // See the fixture note on the first test in this describe block — `app`
+    // is renamed to `surface` here for the same reason (un-retired 2026-07-11,
+    // hub-parity P5).
     const { path, cleanup } = makeTempPath();
     try {
       writeFileSync(
@@ -1209,7 +1151,7 @@ describe("legacy short-name row de-dupe (parachute-app#13 / runner#4)", () => {
               version: "0.2.0",
             },
             {
-              name: "app",
+              name: "surface",
               port: 1946,
               paths: ["/surface"],
               health: "/surface/healthz",
@@ -1232,21 +1174,37 @@ describe("legacy short-name row de-dupe (parachute-app#13 / runner#4)", () => {
 
 // Retired-module row cleanup (hub#334 — Aaron's actual reproducer on
 // 2026-05-22). His services.json originally carried a stale `agent` row at
-// 1946 colliding with `parachute-app`'s canonical slot. NOTE: post the
-// 2026-06-17 channel→agent rename, `agent` is a LIVE module again, so these
-// fixtures use the still-retired `app` (parachute-app) name to exercise the
-// same GC. The legacy-short-name de-dupe doesn't help — a retired short
-// isn't the short-name twin of the colliding row. The retired-module GC
-// fires unconditionally on rows whose name appears in `RETIRED_MODULES`,
-// regardless of port collision.
+// 1946 colliding with `parachute-app`'s canonical slot. The legacy-short-name
+// de-dupe doesn't help — a retired short isn't the short-name twin of the
+// colliding row. The retired-module GC fires unconditionally on rows whose
+// name appears in `RETIRED_MODULES`, regardless of port collision.
+//
+// NOTE (2026-07-11, hub-parity P5): the original fixtures used `agent` —
+// which was a RETIRED_MODULES entry until the 2026-06-17 channel→agent
+// rename re-assigned that name to the live (renamed-from-channel) module —
+// and were later updated to use `app` (parachute-app, retired 2026-05-27).
+// `app`/`parachute-app` are now THEMSELVES un-retired (a new, unrelated
+// module — the real parachute-app super-surface — claims the name for
+// real; see service-spec.ts's RETIRED_MODULES comment). So these tests now
+// inject a throwaway synthetic retired entry via a describe-scoped
+// beforeEach/afterEach rather than depending on production RETIRED_MODULES
+// having a spare non-live name to spend on test fixtures — this mechanism
+// has now been renamed out from under these tests twice.
 describe("retired-module row de-dupe (hub#334)", () => {
-  // NOTE: the original fixtures used `agent` — which was a RETIRED_MODULES
-  // entry until the 2026-06-17 channel→agent rename re-assigned that name to
-  // the live (renamed-from-channel) module. These tests now use `app`
-  // (parachute-app, retired 2026-05-27 — still in RETIRED_MODULES) so they
-  // keep exercising the retired-module GC mechanism on a name that is still
-  // genuinely retired.
-  test("drops a row whose name is in RETIRED_MODULES (app)", () => {
+  const RETIRED_FIXTURE_NAME = "legacy-test-retired-module";
+
+  beforeEach(() => {
+    RETIRED_MODULES[RETIRED_FIXTURE_NAME] = {
+      retiredAt: "2020-01-01",
+      replacement: "n/a — test-only fixture, not a real retirement",
+    };
+  });
+
+  afterEach(() => {
+    delete RETIRED_MODULES[RETIRED_FIXTURE_NAME];
+  });
+
+  test("drops a row whose name is in RETIRED_MODULES", () => {
     const { path, cleanup } = makeTempPath();
     try {
       writeFileSync(
@@ -1254,10 +1212,10 @@ describe("retired-module row de-dupe (hub#334)", () => {
         JSON.stringify({
           services: [
             {
-              name: "app",
+              name: RETIRED_FIXTURE_NAME,
               port: 1946,
-              paths: ["/app"],
-              health: "/app/health",
+              paths: ["/legacy"],
+              health: "/legacy/health",
               version: "0.1.4",
             },
           ],
@@ -1275,7 +1233,7 @@ describe("retired-module row de-dupe (hub#334)", () => {
 
   test("retirement is unconditional — no other rows required", () => {
     // Verifies dropRetiredModuleRows doesn't depend on a collision
-    // partner (unlike dropLegacyShortNameRows). An app row sitting
+    // partner (unlike dropLegacyShortNameRows). A retired row sitting
     // alone is still stale.
     const { path, cleanup } = makeTempPath();
     try {
@@ -1284,10 +1242,10 @@ describe("retired-module row de-dupe (hub#334)", () => {
         JSON.stringify({
           services: [
             {
-              name: "app",
+              name: RETIRED_FIXTURE_NAME,
               port: 9999,
-              paths: ["/app"],
-              health: "/app/health",
+              paths: ["/legacy"],
+              health: "/legacy/health",
               version: "0.1.4",
             },
           ],
@@ -1329,10 +1287,9 @@ describe("retired-module row de-dupe (hub#334)", () => {
   });
 
   test("Aaron's reproducer — retired row + parachute-surface at same port resolves cleanly", () => {
-    // The motivating bug for hub#334 (originally an `agent` row; `agent` is
-    // a live module again post-rename, so this uses the still-retired `app`).
-    // With dropRetiredModuleRows running before validateManifest, the stale
-    // retired row is GC'd and the duplicate-port gate doesn't trip downstream.
+    // The motivating bug for hub#334. With dropRetiredModuleRows running
+    // before validateManifest, the stale retired row is GC'd and the
+    // duplicate-port gate doesn't trip downstream.
     const { path, cleanup } = makeTempPath();
     try {
       writeFileSync(
@@ -1340,10 +1297,10 @@ describe("retired-module row de-dupe (hub#334)", () => {
         JSON.stringify({
           services: [
             {
-              name: "app",
+              name: RETIRED_FIXTURE_NAME,
               port: 1946,
-              paths: ["/app"],
-              health: "/app/health",
+              paths: ["/legacy"],
+              health: "/legacy/health",
               version: "0.1.4",
             },
             {
@@ -1366,12 +1323,11 @@ describe("retired-module row de-dupe (hub#334)", () => {
 
   test("interaction — retired row + legacy short-name pair both cleaned, correct order", () => {
     // Drop order matters: retired-module cleanup runs first, then
-    // legacy-short-name cleanup. This test ensures both passes
-    // compose correctly on a services.json that exercises both
-    // shapes simultaneously. The `app` row is unconditional retire
-    // (the original `agent` fixture is a live module again post-rename);
-    // the parachute-runner + runner pair triggers legacy-short-name
-    // dedup at port 1945.
+    // legacy-short-name cleanup. This test ensures both passes compose
+    // correctly on a services.json that exercises both shapes
+    // simultaneously. The retired-fixture row is unconditional retire; the
+    // parachute-runner + runner pair triggers legacy-short-name dedup at
+    // port 1945.
     const { path, cleanup } = makeTempPath();
     try {
       writeFileSync(
@@ -1379,10 +1335,10 @@ describe("retired-module row de-dupe (hub#334)", () => {
         JSON.stringify({
           services: [
             {
-              name: "app",
+              name: RETIRED_FIXTURE_NAME,
               port: 1946,
-              paths: ["/app"],
-              health: "/app/health",
+              paths: ["/legacy"],
+              health: "/legacy/health",
               version: "0.1.4",
             },
             {
@@ -1411,6 +1367,290 @@ describe("retired-module row de-dupe (hub#334)", () => {
   });
 });
 
+// Stale OLD-UI-host `app`/`parachute-app` row heal (hub-parity P5, B1). The
+// name `parachute-app` used to belong to the UI-host that renamed to
+// `parachute-surface` 2026-05-27; hub-parity P5 reuses the name for the NEW
+// super-surface app (mount /app, port 1944), so the RETIRED_MODULES entry that
+// used to GC the old row was removed. `healStaleUiHostAppRows` is its
+// shape-gated replacement for operators upgrading DIRECTLY from a pre-rename
+// release who still carry the stale `/surface`/1946 row. The load-bearing
+// assertion: a stale old-app row does NOT survive to spawn a crash-looping
+// unit, while the NEW app row (paths:["/app"], port 1944) is left intact.
+describe("stale OLD-UI-host app row heal (hub-parity P5, B1)", () => {
+  test("heals (drops) a stale `parachute-app` row with the old /surface + 1946 shape", () => {
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "parachute-app",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.1.4",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      // The stale row is gone — it never survives to spawn a crash-looping
+      // `--package @openparachute/parachute-app` unit the operator never
+      // installed.
+      expect(m.services).toHaveLength(0);
+      // Rewritten clean on disk too.
+      const onDisk = JSON.parse(readFileSync(path, "utf8"));
+      expect(onDisk.services).toHaveLength(0);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("heals a bare-short `app` row with the old shape (the pre-rename self-register name)", () => {
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "app",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.1.4",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      expect(m.services).toHaveLength(0);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("heals on port 1946 even if the stale row's paths got mangled (port discriminant)", () => {
+    // Corroborating OR-clause: a stale row squatting the old canonical 1946
+    // is healed even if paths[0] isn't /surface-rooted anymore.
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "parachute-app",
+              port: 1946,
+              paths: ["/whatever"],
+              health: "/whatever/health",
+              version: "0.1.4",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      expect(m.services).toHaveLength(0);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("leaves the NEW app row (paths:['/app'], port 1944) intact — structurally disjoint", () => {
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "parachute-app",
+              port: 1944,
+              paths: ["/app"],
+              health: "/app/health",
+              version: "0.4.0",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      expect(m.services).toHaveLength(1);
+      expect(m.services[0]?.name).toBe("parachute-app");
+      expect(m.services[0]?.port).toBe(1944);
+      expect(m.services[0]?.paths).toEqual(["/app"]);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("never heals a /app-mounted app row, whatever its port (new-app protection)", () => {
+    // Defensive: even if a new-app row somehow drifted onto a weird port, its
+    // `/app` mount alone protects it from the heal.
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "app",
+              port: 1946,
+              paths: ["/app"],
+              health: "/app/health",
+              version: "0.4.0",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      expect(m.services).toHaveLength(1);
+      expect(m.services[0]?.paths).toEqual(["/app"]);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("coexistence — stale old-app + real parachute-surface both at 1946: stale healed, surface keeps /surface", () => {
+    // The load-bearing coexistence case. Without the heal, the two rows collide
+    // on port 1946 and trip the duplicate-port gate (or the stale row hijacks
+    // /surface). With the heal running first, the stale row is dropped by shape
+    // and surface survives clean.
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "parachute-app",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.1.4",
+            },
+            {
+              name: "parachute-surface",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.2.0",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      expect(m.services).toHaveLength(1);
+      expect(m.services[0]?.name).toBe("parachute-surface");
+      expect(m.services[0]?.paths).toEqual(["/surface"]);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("double-write reproducer — stale `parachute-app` + `app` both at 1946/'/surface' → both healed", () => {
+    // A pre-rename operator hit by the 2026-05-22 double-write carries BOTH
+    // rows. The heal drops both by shape (running ahead of dropLegacyShortNameRows,
+    // which would otherwise keep the `parachute-app` half — still stale).
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "parachute-app",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.1.4",
+            },
+            {
+              name: "app",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.1.4",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      expect(m.services).toHaveLength(0);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("coexistence — NEW app (/app, 1944) + real surface (/surface, 1946): both survive", () => {
+    // The steady-state post-P5 world: the new app and surface installed side by
+    // side. Neither is healed; both route on their own mounts.
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "parachute-app",
+              port: 1944,
+              paths: ["/app"],
+              health: "/app/health",
+              version: "0.4.0",
+            },
+            {
+              name: "parachute-surface",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.2.0",
+            },
+          ],
+        }),
+      );
+      const m = readManifest(path);
+      const names = m.services.map((s) => s.name).sort();
+      expect(names).toEqual(["parachute-app", "parachute-surface"]);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("readManifestLenient heals the same stale old-app shape", () => {
+    // The lenient reader shares the same raw-JSON heal pipeline — verify the
+    // crash-loop row is dropped there too (the supervisor's boot path reads
+    // lenient).
+    const { path, cleanup } = makeTempPath();
+    try {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          services: [
+            {
+              name: "parachute-app",
+              port: 1946,
+              paths: ["/surface"],
+              health: "/surface/healthz",
+              version: "0.1.4",
+            },
+            {
+              name: "parachute-vault",
+              port: 1940,
+              paths: ["/vault/default"],
+              health: "/vault/default/health",
+              version: "0.4.8",
+            },
+          ],
+        }),
+      );
+      const m = readManifestLenient(path, { warn: () => {} });
+      expect(m.services.map((s) => s.name)).toEqual(["parachute-vault"]);
+    } finally {
+      cleanup();
+    }
+  });
+});
+
 describe("readManifestLenient — skips bad entries instead of throwing (hub#406)", () => {
   test("returns the healthy entries when one row has port=0 (the rc.4 app bug)", () => {
     // Reproduces what hub saw 2026-05-26: a fresh deploy installed