@serfab/cadre-host 0.11.0 → 0.13.0

package/src/donation/__tests__/fake-orchestrator.test.ts

@@ -1,168 +1,168 @@
-/**
- * Contract tests for `FakeOrchestrator` itself — the handle lifecycle it borrows
- * from `HostProcessOrchestrator`. The donation suites lean on these semantics to
- * express races that only exist because the real class drops and rejects
- * handles, so this file exists to stop a later relaxation of the fake from
- * quietly turning one of those tests green. Each case names the real behaviour
- * it mirrors.
- */
-
-import { describe, expect, it } from 'vitest';
-
-import type { OrchestratorCreateRequest } from '@serfab/cadre-provider';
-
-import { FakeOrchestrator } from './fake-orchestrator.js';
-
-const request = (containerId: string): OrchestratorCreateRequest => ({
-  containerId,
-  partyId: 'party-P',
-  bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
-  profile: 'storage',
-});
-
-describe('FakeOrchestrator handle lifecycle', () => {
-  it('drops the prior handle when a re-spawn succeeds (mirrors dropStaleHandle)', async () => {
-    const orch = new FakeOrchestrator();
-    const first = await orch.createContainer(request('grn_1'));
-    const second = await orch.createContainer(request('grn_1'));
-
-    await expect(orch.stopContainer(first.dockerId)).rejects.toThrow(
-      `Container not found: ${first.dockerId}`,
-    );
-    // The rejected call left no trace: `stopped` records handles acted on, not
-    // calls attempted.
-    expect(orch.stopped).toEqual([]);
-    // …and the container now resolves only to the new spawn.
-    expect(orch.resolveDockerId('grn_1')).toBe(second.dockerId);
-
-    await orch.stopContainer(second.dockerId);
-    expect(orch.stopped).toEqual([second.dockerId]);
-  });
-
-  it('drops only the re-spawned container, leaving another container untouched', async () => {
-    const orch = new FakeOrchestrator();
-    const other = await orch.createContainer(request('grn_2'));
-    await orch.createContainer(request('grn_1'));
-    await orch.createContainer(request('grn_1'));
-
-    // The real drop filters on containerId; a fake that cleared the whole map
-    // would still pass every same-container case above.
-    await expect(orch.stopContainer(other.dockerId)).resolves.toBeUndefined();
-    expect(orch.resolveDockerId('grn_2')).toBe(other.dockerId);
-  });
-
-  it('keeps the prior handle live across the whole pre-drop await window', async () => {
-    const orch = new FakeOrchestrator();
-    const first = await orch.createContainer(request('grn_1'));
-
-    // The invariant the donation race tests rest on: a concurrent stop started
-    // from `onCreate` still finds the old handle. Deferring it onto a microtask
-    // puts it strictly after `onCreate` returns and strictly before the
-    // `createDelayMs` timer, so this one case pins the drop behind BOTH — with
-    // no dependence on wall-clock timing. The outcome is captured rather than
-    // rethrown so a regression fails this assertion instead of surfacing as an
-    // unhandled rejection.
-    orch.createDelayMs = 1;
-    let outcome: Promise<string> | undefined;
-    orch.onCreate = () => {
-      outcome ??= Promise.resolve()
-        .then(() => orch.stopContainer(first.dockerId))
-        .then(() => 'stopped', (err: Error) => `rejected: ${err.message}`);
-    };
-
-    const second = await orch.createContainer(request('grn_1'));
-
-    expect(await outcome).toBe('stopped');
-    expect(orch.stopped).toEqual([first.dockerId]);
-    expect(orch.resolveDockerId('grn_1')).toBe(second.dockerId);
-  });
-
-  it('leaves the prior handle in place when the re-spawn fails (mirrors restoreDroppedHandles)', async () => {
-    const orch = new FakeOrchestrator();
-    const first = await orch.createContainer(request('grn_1'));
-
-    orch.failCreate = true;
-    await expect(orch.createContainer(request('grn_1'))).rejects.toThrow('spawn boom');
-
-    // Host state is exactly as the failed attempt found it — which is what lets
-    // `DonationSupervisor.giveUp` still stop the child it knows about.
-    await expect(orch.stopContainer(first.dockerId)).resolves.toBeUndefined();
-    expect(orch.stopped).toEqual([first.dockerId]);
-    expect(orch.resolveDockerId('grn_1')).toBe(first.dockerId);
-  });
-
-  it('rejects a never-issued dockerId (mirrors requireHandle)', async () => {
-    const orch = new FakeOrchestrator();
-
-    await expect(orch.removeContainer('dock_nope')).rejects.toThrow(
-      'Container not found: dock_nope',
-    );
-    expect(orch.removed).toEqual([]);
-  });
-
-  it('rejects a second call once a handle has been removed (mirrors removeContainer deleting it)', async () => {
-    const orch = new FakeOrchestrator();
-    const { dockerId } = await orch.createContainer(request('grn_1'));
-
-    await orch.removeContainer(dockerId);
-    expect(orch.removed).toEqual([dockerId]);
-
-    await expect(orch.stopContainer(dockerId)).rejects.toThrow(
-      `Container not found: ${dockerId}`,
-    );
-    expect(orch.stopped).toEqual([]);
-  });
-
-  it('fires onStop for a rejected stop, so a test can still observe the attempt', async () => {
-    const orch = new FakeOrchestrator();
-    const attempted: string[] = [];
-    orch.onStop = (id) => { attempted.push(id); };
-
-    await expect(orch.stopContainer('dock_nope')).rejects.toThrow('Container not found');
-    expect(attempted).toEqual(['dock_nope']);
-    expect(orch.stopped).toEqual([]);
-  });
-
-  it('refuses to reclaim the workdir of a container that still resolves (mirrors the live-handle guard)', async () => {
-    const orch = new FakeOrchestrator();
-    await orch.createContainer(request('grn_1'));
-
-    // A live handle owns that directory; only `removeContainer` — which stops
-    // the child first — may delete it.
-    expect(orch.reclaimWorkdir('grn_1')).toBe(false);
-    expect(orch.reclaimedWorkdirs).toEqual([]);
-  });
-
-  it('reclaims the workdir of a container no handle owns', async () => {
-    const orch = new FakeOrchestrator();
-
-    // Never spawned — the stuck-`provisioning` record whose host died before a
-    // handle ever existed.
-    expect(orch.reclaimWorkdir('grn_orphan')).toBe(true);
-    expect(orch.reclaimedWorkdirs).toEqual(['grn_orphan']);
-
-    // …and once the container's own handle is removed, its id becomes
-    // reclaimable too.
-    const { dockerId } = await orch.createContainer(request('grn_1'));
-    expect(orch.reclaimWorkdir('grn_1')).toBe(false);
-    await orch.removeContainer(dockerId);
-    expect(orch.reclaimWorkdir('grn_1')).toBe(true);
-    expect(orch.reclaimedWorkdirs).toEqual(['grn_orphan', 'grn_1']);
-  });
-
-  it('fires onSpawned after the drop, with the new handle live and the old one gone', async () => {
-    const orch = new FakeOrchestrator();
-    const first = await orch.createContainer(request('grn_1'));
-
-    let observed: { spawned: string; resolves: string | undefined } | undefined;
-    orch.onSpawned = (dockerId) => {
-      observed = { spawned: dockerId, resolves: orch.resolveDockerId('grn_1') };
-    };
-    const second = await orch.createContainer(request('grn_1'));
-
-    // The post-drop world: the container already resolves to the new handle, so
-    // work driven from here sees what `abandonRespawn`'s caller would see.
-    expect(observed).toEqual({ spawned: second.dockerId, resolves: second.dockerId });
-    expect(second.dockerId).not.toBe(first.dockerId);
-  });
-});
+/**
+ * Contract tests for `FakeOrchestrator` itself — the handle lifecycle it borrows
+ * from `HostProcessOrchestrator`. The donation suites lean on these semantics to
+ * express races that only exist because the real class drops and rejects
+ * handles, so this file exists to stop a later relaxation of the fake from
+ * quietly turning one of those tests green. Each case names the real behaviour
+ * it mirrors.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import type { OrchestratorCreateRequest } from '@serfab/cadre-provider';
+
+import { FakeOrchestrator } from './fake-orchestrator.js';
+
+const request = (containerId: string): OrchestratorCreateRequest => ({
+  containerId,
+  partyId: 'party-P',
+  bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
+  profile: 'storage',
+});
+
+describe('FakeOrchestrator handle lifecycle', () => {
+  it('drops the prior handle when a re-spawn succeeds (mirrors dropStaleHandle)', async () => {
+    const orch = new FakeOrchestrator();
+    const first = await orch.createContainer(request('grn_1'));
+    const second = await orch.createContainer(request('grn_1'));
+
+    await expect(orch.stopContainer(first.dockerId)).rejects.toThrow(
+      `Container not found: ${first.dockerId}`,
+    );
+    // The rejected call left no trace: `stopped` records handles acted on, not
+    // calls attempted.
+    expect(orch.stopped).toEqual([]);
+    // …and the container now resolves only to the new spawn.
+    expect(orch.resolveDockerId('grn_1')).toBe(second.dockerId);
+
+    await orch.stopContainer(second.dockerId);
+    expect(orch.stopped).toEqual([second.dockerId]);
+  });
+
+  it('drops only the re-spawned container, leaving another container untouched', async () => {
+    const orch = new FakeOrchestrator();
+    const other = await orch.createContainer(request('grn_2'));
+    await orch.createContainer(request('grn_1'));
+    await orch.createContainer(request('grn_1'));
+
+    // The real drop filters on containerId; a fake that cleared the whole map
+    // would still pass every same-container case above.
+    await expect(orch.stopContainer(other.dockerId)).resolves.toBeUndefined();
+    expect(orch.resolveDockerId('grn_2')).toBe(other.dockerId);
+  });
+
+  it('keeps the prior handle live across the whole pre-drop await window', async () => {
+    const orch = new FakeOrchestrator();
+    const first = await orch.createContainer(request('grn_1'));
+
+    // The invariant the donation race tests rest on: a concurrent stop started
+    // from `onCreate` still finds the old handle. Deferring it onto a microtask
+    // puts it strictly after `onCreate` returns and strictly before the
+    // `createDelayMs` timer, so this one case pins the drop behind BOTH — with
+    // no dependence on wall-clock timing. The outcome is captured rather than
+    // rethrown so a regression fails this assertion instead of surfacing as an
+    // unhandled rejection.
+    orch.createDelayMs = 1;
+    let outcome: Promise<string> | undefined;
+    orch.onCreate = () => {
+      outcome ??= Promise.resolve()
+        .then(() => orch.stopContainer(first.dockerId))
+        .then(() => 'stopped', (err: Error) => `rejected: ${err.message}`);
+    };
+
+    const second = await orch.createContainer(request('grn_1'));
+
+    expect(await outcome).toBe('stopped');
+    expect(orch.stopped).toEqual([first.dockerId]);
+    expect(orch.resolveDockerId('grn_1')).toBe(second.dockerId);
+  });
+
+  it('leaves the prior handle in place when the re-spawn fails (mirrors restoreDroppedHandles)', async () => {
+    const orch = new FakeOrchestrator();
+    const first = await orch.createContainer(request('grn_1'));
+
+    orch.failCreate = true;
+    await expect(orch.createContainer(request('grn_1'))).rejects.toThrow('spawn boom');
+
+    // Host state is exactly as the failed attempt found it — which is what lets
+    // `DonationSupervisor.giveUp` still stop the child it knows about.
+    await expect(orch.stopContainer(first.dockerId)).resolves.toBeUndefined();
+    expect(orch.stopped).toEqual([first.dockerId]);
+    expect(orch.resolveDockerId('grn_1')).toBe(first.dockerId);
+  });
+
+  it('rejects a never-issued dockerId (mirrors requireHandle)', async () => {
+    const orch = new FakeOrchestrator();
+
+    await expect(orch.removeContainer('dock_nope')).rejects.toThrow(
+      'Container not found: dock_nope',
+    );
+    expect(orch.removed).toEqual([]);
+  });
+
+  it('rejects a second call once a handle has been removed (mirrors removeContainer deleting it)', async () => {
+    const orch = new FakeOrchestrator();
+    const { dockerId } = await orch.createContainer(request('grn_1'));
+
+    await orch.removeContainer(dockerId);
+    expect(orch.removed).toEqual([dockerId]);
+
+    await expect(orch.stopContainer(dockerId)).rejects.toThrow(
+      `Container not found: ${dockerId}`,
+    );
+    expect(orch.stopped).toEqual([]);
+  });
+
+  it('fires onStop for a rejected stop, so a test can still observe the attempt', async () => {
+    const orch = new FakeOrchestrator();
+    const attempted: string[] = [];
+    orch.onStop = (id) => { attempted.push(id); };
+
+    await expect(orch.stopContainer('dock_nope')).rejects.toThrow('Container not found');
+    expect(attempted).toEqual(['dock_nope']);
+    expect(orch.stopped).toEqual([]);
+  });
+
+  it('refuses to reclaim the workdir of a container that still resolves (mirrors the live-handle guard)', async () => {
+    const orch = new FakeOrchestrator();
+    await orch.createContainer(request('grn_1'));
+
+    // A live handle owns that directory; only `removeContainer` — which stops
+    // the child first — may delete it.
+    expect(orch.reclaimWorkdir('grn_1')).toBe(false);
+    expect(orch.reclaimedWorkdirs).toEqual([]);
+  });
+
+  it('reclaims the workdir of a container no handle owns', async () => {
+    const orch = new FakeOrchestrator();
+
+    // Never spawned — the stuck-`provisioning` record whose host died before a
+    // handle ever existed.
+    expect(orch.reclaimWorkdir('grn_orphan')).toBe(true);
+    expect(orch.reclaimedWorkdirs).toEqual(['grn_orphan']);
+
+    // …and once the container's own handle is removed, its id becomes
+    // reclaimable too.
+    const { dockerId } = await orch.createContainer(request('grn_1'));
+    expect(orch.reclaimWorkdir('grn_1')).toBe(false);
+    await orch.removeContainer(dockerId);
+    expect(orch.reclaimWorkdir('grn_1')).toBe(true);
+    expect(orch.reclaimedWorkdirs).toEqual(['grn_orphan', 'grn_1']);
+  });
+
+  it('fires onSpawned after the drop, with the new handle live and the old one gone', async () => {
+    const orch = new FakeOrchestrator();
+    const first = await orch.createContainer(request('grn_1'));
+
+    let observed: { spawned: string; resolves: string | undefined } | undefined;
+    orch.onSpawned = (dockerId) => {
+      observed = { spawned: dockerId, resolves: orch.resolveDockerId('grn_1') };
+    };
+    const second = await orch.createContainer(request('grn_1'));
+
+    // The post-drop world: the container already resolves to the new handle, so
+    // work driven from here sees what `abandonRespawn`'s caller would see.
+    expect(observed).toEqual({ spawned: second.dockerId, resolves: second.dockerId });
+    expect(second.dockerId).not.toBe(first.dockerId);
+  });
+});

package/src/installer/__tests__/config.test.ts

@@ -1,112 +1,134 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { readHostConfig, writeHostConfig, hostOwnsCadre, type HostConfigFile } from '../config.js';
-
-describe('host.config.json round-trip', () => {
-  let tmp: string;
-
-  beforeEach(() => {
-    tmp = mkdtempSync(join(tmpdir(), 'cadre-host-cfg-'));
-  });
-
-  afterEach(() => {
-    rmSync(tmp, { recursive: true, force: true });
-  });
-
-  function makeCfg(overrides: Partial<HostConfigFile> = {}): HostConfigFile {
-    return {
-      version: 2,
-      installId: 'abc123',
-      uiPort: 8765,
-      libp2pPort: 4001,
-      dataDir: tmp,
-      identityPath: join(tmp, 'identity.key'),
-      upnpEnabled: true,
-      installedAt: '2026-01-01T00:00:00.000Z',
-      installerVersion: '0.6.0',
-      updates: { autoApply: false },
-      ...overrides,
-    };
-  }
-
-  it('writes and reads the same shape', () => {
-    const cfg = makeCfg();
-    const path = join(tmp, 'host.config.json');
-    writeHostConfig(path, cfg);
-    expect(readHostConfig(path)).toEqual(cfg);
-  });
-
-  it('upgrades v1 files in place on read', () => {
-    const path = join(tmp, 'host.config.json');
-    const v1 = {
-      version: 1,
-      installId: 'abc123',
-      uiPort: 8765,
-      libp2pPort: 4001,
-      dataDir: tmp,
-      identityPath: join(tmp, 'identity.key'),
-      upnpEnabled: true,
-      installedAt: '2026-01-01T00:00:00.000Z',
-      installerVersion: '0.6.0',
-    };
-    writeFileSync(path, JSON.stringify(v1));
-    const upgraded = readHostConfig(path);
-    expect(upgraded.version).toBe(2);
-    expect(upgraded.updates).toEqual({ autoApply: false });
-    // Reading again should be idempotent and stay v2.
-    const reRead = readHostConfig(path);
-    expect(reRead.version).toBe(2);
-  });
-
-  it('rejects unknown versions', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, JSON.stringify({ ...makeCfg(), version: 99 }));
-    expect(() => readHostConfig(path)).toThrow(/unsupported version=99/);
-  });
-
-  it('rejects malformed JSON', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, 'not json');
-    expect(() => readHostConfig(path)).toThrow(/Failed to parse/);
-  });
-
-  it('rejects missing required fields', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, JSON.stringify({ version: 2, uiPort: 1234 }));
-    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
-  });
-
-  it('refuses to write the wrong version', () => {
-    const path = join(tmp, 'host.config.json');
-    expect(() => writeHostConfig(path, { ...makeCfg(), version: 3 as never })).toThrow(/version=3/);
-  });
-
-  it('round-trips ownCadre and hostOwnsCadre reflects it', () => {
-    const path = join(tmp, 'host.config.json');
-    const cfg = makeCfg({ ownCadre: { enabled: true } });
-    writeHostConfig(path, cfg);
-    const read = readHostConfig(path);
-    expect(read.ownCadre).toEqual({ enabled: true });
-    expect(hostOwnsCadre(read)).toBe(true);
-  });
-
-  it('treats an absent ownCadre as donor-only (hostOwnsCadre false)', () => {
-    // A pre-ownCadre v2 config (field absent) must read back cleanly and be
-    // donor-only — no migration, field stays absent.
-    const path = join(tmp, 'host.config.json');
-    const cfg = makeCfg();
-    writeHostConfig(path, cfg);
-    const read = readHostConfig(path);
-    expect(read.ownCadre).toBeUndefined();
-    expect(hostOwnsCadre(read)).toBe(false);
-  });
-
-  it('rejects a malformed ownCadre shape', () => {
-    const path = join(tmp, 'host.config.json');
-    writeFileSync(path, JSON.stringify({ ...makeCfg(), ownCadre: { enabled: 'yes' } }));
-    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
-  });
-});
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { readHostConfig, updateHostConfig, writeHostConfig, hostOwnsCadre, type HostConfigFile } from '../config.js';
+
+describe('host.config.json round-trip', () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), 'cadre-host-cfg-'));
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  function makeCfg(overrides: Partial<HostConfigFile> = {}): HostConfigFile {
+    return {
+      version: 2,
+      installId: 'abc123',
+      uiPort: 8765,
+      libp2pPort: 4001,
+      dataDir: tmp,
+      identityPath: join(tmp, 'identity.key'),
+      upnpEnabled: true,
+      installedAt: '2026-01-01T00:00:00.000Z',
+      installerVersion: '0.6.0',
+      updates: { autoApply: false },
+      ...overrides,
+    };
+  }
+
+  it('writes and reads the same shape', () => {
+    const cfg = makeCfg();
+    const path = join(tmp, 'host.config.json');
+    writeHostConfig(path, cfg);
+    expect(readHostConfig(path)).toEqual(cfg);
+  });
+
+  it('rejects v1 files without rewriting them', () => {
+    const path = join(tmp, 'host.config.json');
+    const v1 = {
+      version: 1,
+      installId: 'abc123',
+      uiPort: 8765,
+      libp2pPort: 4001,
+      dataDir: tmp,
+      identityPath: join(tmp, 'identity.key'),
+      upnpEnabled: true,
+      installedAt: '2026-01-01T00:00:00.000Z',
+      installerVersion: '0.6.0',
+    };
+    const raw = JSON.stringify(v1);
+    writeFileSync(path, raw);
+    expect(() => readHostConfig(path)).toThrow(/unsupported version=1/);
+    expect(readFileSync(path, 'utf8')).toBe(raw);
+  });
+
+  it('rejects unknown versions', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify({ ...makeCfg(), version: 99 }));
+    expect(() => readHostConfig(path)).toThrow(/unsupported version=99/);
+  });
+
+  it('rejects a file with no version field', () => {
+    const { version: _version, ...noVersion } = makeCfg();
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify(noVersion));
+    expect(() => readHostConfig(path)).toThrow(/unsupported version=undefined/);
+  });
+
+  it('rejects malformed JSON', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, 'not json');
+    expect(() => readHostConfig(path)).toThrow(/Failed to parse/);
+  });
+
+  it('rejects missing required fields', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify({ version: 2, uiPort: 1234 }));
+    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
+  });
+
+  it('refuses to write the wrong version', () => {
+    const path = join(tmp, 'host.config.json');
+    expect(() => writeHostConfig(path, { ...makeCfg(), version: 3 as never })).toThrow(/version=3/);
+  });
+
+  it('update patches fields and re-stamps the current version', () => {
+    const path = join(tmp, 'host.config.json');
+    writeHostConfig(path, makeCfg());
+    const next = updateHostConfig(path, { updates: { autoApply: true } });
+    expect(next.version).toBe(2);
+    expect(next.updates).toEqual({ autoApply: true });
+    expect(next.installId).toBe('abc123');
+    expect(readHostConfig(path)).toEqual(next);
+  });
+
+  it('update never lets a patch downgrade the version', () => {
+    const path = join(tmp, 'host.config.json');
+    writeHostConfig(path, makeCfg());
+    const patch = { version: 1 } as unknown as Partial<Omit<HostConfigFile, 'version'>>;
+    expect(updateHostConfig(path, patch).version).toBe(2);
+    expect(readHostConfig(path).version).toBe(2);
+  });
+
+  it('round-trips ownCadre and hostOwnsCadre reflects it', () => {
+    const path = join(tmp, 'host.config.json');
+    const cfg = makeCfg({ ownCadre: { enabled: true } });
+    writeHostConfig(path, cfg);
+    const read = readHostConfig(path);
+    expect(read.ownCadre).toEqual({ enabled: true });
+    expect(hostOwnsCadre(read)).toBe(true);
+  });
+
+  it('treats an absent ownCadre as donor-only (hostOwnsCadre false)', () => {
+    // A pre-ownCadre v2 config (field absent) must read back cleanly and be
+    // donor-only — no migration, field stays absent.
+    const path = join(tmp, 'host.config.json');
+    const cfg = makeCfg();
+    writeHostConfig(path, cfg);
+    const read = readHostConfig(path);
+    expect(read.ownCadre).toBeUndefined();
+    expect(hostOwnsCadre(read)).toBe(false);
+  });
+
+  it('rejects a malformed ownCadre shape', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify({ ...makeCfg(), ownCadre: { enabled: 'yes' } }));
+    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
+  });
+});