@serfab/cadre-host 0.9.0 → 0.10.0

package/src/__tests__/orchestrator.test.ts

@@ -14,11 +14,12 @@ import { dirname, join, resolve as resolvePath } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
-import { PortAllocator } from '../orchestrator/port-allocator.js';
+import { allocateNodePorts, PortAllocator } from '../orchestrator/port-allocator.js';
 import { rotateOnDisk } from '../orchestrator/log-rotator.js';
 import { decodeDockerId, encodeDockerId } from '../orchestrator/types.js';
 import { StateStore } from '../orchestrator/state-store.js';
 import { isPidAlive } from '../orchestrator/pid-liveness.js';
+import { loadIdentity } from '../installer/identity.js';
 
 const FAKE_CHILD = `
 import fs from 'node:fs';
@@ -160,6 +161,338 @@ describe('HostProcessOrchestrator.createContainer', () => {
   });
 });
 
+describe('HostProcessOrchestrator re-spawn of the same containerId', () => {
+  // The donated-node respawn path calls createContainer again with the id of a
+  // container the host still holds a (now dead) handle for. Handles are keyed by
+  // the per-spawn dockerId, so without an explicit drop the old one would linger
+  // forever and its four ports would never come back.
+  it('drops the stale handle, releases its ports, and keeps the identity', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+
+    const first = await orch.createContainer(makeRequest('c1'));
+    await waitFor(() => orch.isRunning(first.dockerId));
+    const identityPath = join(rootDir, 'c1', 'identity.key');
+    const peerBefore = loadIdentity(identityPath).peerId;
+
+    // Kill the child the way a crash would — the handle survives, still marked
+    // alive until something notices.
+    const { pid: firstPid } = decodeDockerId(first.dockerId);
+    process.kill(firstPid, 'SIGKILL');
+    await waitFor(() => !isPidAlive(firstPid));
+
+    const second = await orch.createContainer(makeRequest('c1'));
+
+    // Exactly one handle for c1, and it is the new spawn.
+    const handles = new StateStore(rootDir).load().handles.filter((h) => h.containerId === 'c1');
+    expect(handles).toHaveLength(1);
+    expect(handles[0]!.dockerId).toBe(second.dockerId);
+
+    // The allocator hands back the lowest free port, so re-using the first
+    // spawn's exact ports is what proves they were released.
+    expect(second.p2pPort).toBe(first.p2pPort);
+    expect(second.healthEndpoint).toBe(first.healthEndpoint);
+
+    // Same workdir, same key → same peer id. This is what makes a respawn the
+    // same node rather than a new one the borrower's cadre has never approved.
+    expect(loadIdentity(identityPath).peerId).toBe(peerBefore);
+  });
+});
+
+/**
+ * A launch that fails must leave host state exactly as it found it. The drop of
+ * the previous handle happens before the child is launched, so without an
+ * explicit restore a failed re-spawn would leave the donation record naming a
+ * dockerId the orchestrator can no longer resolve — and the node's workdir
+ * (identity key, node-local stores, storage) stranded on disk with nothing able
+ * to delete it.
+ *
+ * Inducing a launch failure portably: replace the workdir's `storage`
+ * directory with a plain file. `mkdirSync(path, { recursive: true })` throws
+ * EEXIST when the path exists as a non-directory on every platform, and it is
+ * the second statement in `launchChild` — after the handle drop, before the
+ * spawn.
+ */
+describe('HostProcessOrchestrator failed launch', () => {
+  /** Replace `<workdir>/storage` with a file so the next launch throws EEXIST. */
+  function sabotageWorkdir(workdir: string): string {
+    const storage = join(workdir, 'storage');
+    rmSync(storage, { recursive: true, force: true });
+    writeFileSync(storage, 'not-a-directory', 'utf8');
+    return storage;
+  }
+
+  it('keeps the prior handle addressable, so a later terminate still reclaims the workdir', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+
+    const first = await orch.createContainer(makeRequest('c1'));
+    await waitFor(() => orch.isRunning(first.dockerId));
+    await orch.stopContainer(first.dockerId);
+
+    const workdir = join(rootDir, 'c1');
+    sabotageWorkdir(workdir);
+
+    await expect(orch.createContainer(makeRequest('c1'))).rejects.toThrow(/EEXIST|exists/i);
+
+    // The record's dockerId still resolves, and no ghost handle was added.
+    expect(orch.getNode('c1')?.dockerId).toBe(first.dockerId);
+    expect(orch.resolveDockerId('c1')).toBe(first.dockerId);
+    expect(orch.listNodes()).toHaveLength(1);
+
+    // Which is the whole point: cleanup can still find and delete the node.
+    await orch.removeContainer(first.dockerId);
+    expect(existsSync(workdir)).toBe(false);
+    expect(orch.listNodes()).toHaveLength(0);
+  });
+
+  it('does not shift the ports a successful retry comes back on', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+
+    const first = await orch.createContainer(makeRequest('c1'));
+    await waitFor(() => orch.isRunning(first.dockerId));
+    await orch.stopContainer(first.dockerId);
+
+    const workdir = join(rootDir, 'c1');
+    const storage = sabotageWorkdir(workdir);
+    await expect(orch.createContainer(makeRequest('c1'))).rejects.toThrow();
+
+    rmSync(storage, { force: true });
+    const second = await orch.createContainer(makeRequest('c1'));
+
+    // The restored handle held its four ports across the failure, and the
+    // allocator hands back the lowest free port — so identical ports prove the
+    // failed attempt neither leaked nor stole them.
+    expect(second.p2pPort).toBe(first.p2pPort);
+    expect(second.healthEndpoint).toBe(first.healthEndpoint);
+    expect(second.metricsEndpoint).toBe(first.metricsEndpoint);
+
+    // And the successful spawn's own drop still stands: exactly one handle.
+    const handles = new StateStore(rootDir).load().handles.filter((h) => h.containerId === 'c1');
+    expect(handles).toHaveLength(1);
+    expect(handles[0]!.dockerId).toBe(second.dockerId);
+  });
+
+  it('releases every port a failed FIRST spawn reserved', async () => {
+    const orch = makeOrchestrator({ portRange: { start: 12000, end: 12100 } });
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+
+    await orch.createContainer(makeRequest('c1'));
+    expect(orch.getNode('c1')!.ports).toEqual({ health: 12000, metrics: 12001, p2p: 12002, admin: 12003 });
+
+    // No prior handle to restore here — the four ports are simply released.
+    mkdirSync(join(rootDir, 'c2'), { recursive: true });
+    writeFileSync(join(rootDir, 'c2', 'storage'), 'not-a-directory', 'utf8');
+    await expect(orch.createContainer(makeRequest('c2'))).rejects.toThrow();
+
+    await orch.createContainer(makeRequest('c3'));
+    // With the leak these would start at 12008.
+    expect(orch.getNode('c3')!.ports).toEqual({ health: 12004, metrics: 12005, p2p: 12006, admin: 12007 });
+  });
+
+  it('leaves the owner node addressable on its original ports', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    const ownerConfig = {
+      identityPath: join(tmpRoot, 'identity.key'),
+      partyId: 'party-owner',
+      libp2pPort: 14001,
+    };
+
+    const owner = await orch.ensureOwnerNode(ownerConfig);
+    await waitFor(() => orch.isRunning(owner.dockerId));
+    const endpointBefore = orch.getOwnerAdminEndpoint();
+
+    // ensureOwnerNode short-circuits on a live child, so kill it first.
+    const { pid } = decodeDockerId(owner.dockerId);
+    process.kill(pid, 'SIGKILL');
+    await waitFor(() => !isPidAlive(pid));
+
+    const storage = sabotageWorkdir(join(rootDir, 'owner'));
+    await expect(orch.ensureOwnerNode()).rejects.toThrow();
+
+    // The admin channel still resolves — a manager that lost this endpoint
+    // could no longer delegate to its own node.
+    expect(orch.getOwnerAdminEndpoint()).toEqual(endpointBefore);
+    expect(orch.listNodes().some((n) => n.dockerId === owner.dockerId)).toBe(true);
+
+    rmSync(storage, { force: true });
+    const respawned = await orch.ensureOwnerNode();
+    expect(respawned.ports).toEqual(owner.ports);
+    expect(orch.listNodes().filter((n) => n.owner)).toHaveLength(1);
+  });
+
+  // The caller's unwind is only correct for failures that happen BEFORE the
+  // child exists. A state.json write failure happens after it — if that were
+  // allowed to propagate, the unwind would release the ports the live child is
+  // bound to and put the replaced handle back beside it.
+  it('does not unwind a launch that already spawned when the state write fails', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    const first = await orch.createContainer(makeRequest('c1'));
+    await waitFor(() => orch.isRunning(first.dockerId));
+    await orch.stopContainer(first.dockerId);
+
+    const stateStore = (orch as unknown as { stateStore: StateStore }).stateStore;
+    const save = stateStore.save.bind(stateStore);
+    stateStore.save = () => { throw new Error('ENOSPC: no space left on device'); };
+    const second = await orch.createContainer(makeRequest('c1'));
+    stateStore.save = save;
+
+    // One handle for the container, and it is the new one.
+    expect(orch.listNodes()).toHaveLength(1);
+    expect(orch.getNode('c1')?.dockerId).toBe(second.dockerId);
+
+    // And the workdir the live child is running in is untouched — a swallowed
+    // persist must not reach the unwind that would delete it.
+    expect(existsSync(join(rootDir, 'c1', 'identity.key'))).toBe(true);
+
+    // Its ports are still held: a fresh container gets four different ones.
+    const other = await orch.createContainer(makeRequest('c2'));
+    expect(other.p2pPort).not.toBe(second.p2pPort);
+    expect(orch.getNode('c2')!.ports).not.toEqual(orch.getNode('c1')!.ports);
+  });
+
+  // A spawn that CREATED the workdir must take it back down on the way out —
+  // the record it was provisioning never got a dockerId, so nothing else can
+  // ever name that directory. The storage-file sabotage above is unusable here:
+  // pre-creating `<workdir>/storage` makes the directory pre-existing, and the
+  // unwind then correctly declines to delete it. Exhausting the port range
+  // fails the very next step instead, with the workdir genuinely fresh.
+  it('discards the workdir a failed first spawn created', async () => {
+    // Exactly four ports — enough for one node and no more.
+    const orch = makeOrchestrator({ portRange: { start: 13000, end: 13003 } });
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+
+    await orch.createContainer(makeRequest('c1'));
+    await expect(orch.createContainer(makeRequest('c2'))).rejects.toThrow(/No available ports/);
+
+    // `ensureNodeIdentity` had already created it and written the key.
+    expect(existsSync(join(rootDir, 'c2'))).toBe(false);
+    // The first node is untouched.
+    expect(existsSync(join(rootDir, 'c1', 'identity.key'))).toBe(true);
+    expect(orch.listNodes()).toHaveLength(1);
+  });
+
+  // The load-bearing case in the other direction: a re-spawn is REUSING the
+  // directory, and the identity key inside it is the whole reason the node
+  // comes back as the same peer the borrower's cadre approved.
+  it('keeps the workdir when a re-spawn launch fails', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+
+    const first = await orch.createContainer(makeRequest('c1'));
+    await waitFor(() => orch.isRunning(first.dockerId));
+    await orch.stopContainer(first.dockerId);
+
+    const workdir = join(rootDir, 'c1');
+    const identityPath = join(workdir, 'identity.key');
+    const peerBefore = loadIdentity(identityPath).peerId;
+
+    const storage = sabotageWorkdir(workdir);
+    await expect(orch.createContainer(makeRequest('c1'))).rejects.toThrow();
+
+    expect(existsSync(workdir)).toBe(true);
+    expect(existsSync(identityPath)).toBe(true);
+
+    // Which is what makes the next attempt the SAME node, not a stranger.
+    rmSync(storage, { force: true });
+    await orch.createContainer(makeRequest('c1'));
+    expect(loadIdentity(identityPath).peerId).toBe(peerBefore);
+  });
+
+  // `ensureNodeIdentity` now runs inside the same `try`, so its own failures
+  // unwind too — and this one must NOT delete anything. The directory was
+  // pre-existing, so the undecodable key is an operator-visible fault to
+  // investigate, not this attempt's mess to clear up.
+  it('keeps a pre-existing workdir whose identity key is undecodable', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    const workdir = join(rootDir, 'c1');
+
+    mkdirSync(workdir, { recursive: true });
+    writeFileSync(join(workdir, 'identity.key'), Buffer.from([0xff, 0xff, 0xff, 0xff]));
+
+    await expect(orch.createContainer(makeRequest('c1'))).rejects.toThrow();
+
+    expect(existsSync(workdir)).toBe(true);
+    expect(existsSync(join(workdir, 'identity.key'))).toBe(true);
+    expect(orch.listNodes()).toHaveLength(0);
+  });
+});
+
+/**
+ * The cleanup of last resort: a donation record that never got a `dockerId`
+ * because the host died mid-spawn. `createContainer`'s own unwind cannot help —
+ * it was never reached — so the reap falls back to reclaiming by container name.
+ */
+describe('HostProcessOrchestrator.reclaimWorkdir', () => {
+  it('removes an orphaned workdir no handle owns', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    const workdir = join(rootDir, 'grn_orphan');
+    mkdirSync(workdir, { recursive: true });
+    writeFileSync(join(workdir, 'identity.key'), 'key-bytes', 'utf8');
+
+    expect(orch.reclaimWorkdir('grn_orphan')).toBe(true);
+    expect(existsSync(workdir)).toBe(false);
+  });
+
+  it('refuses a container a live handle still owns', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    const created = await orch.createContainer(makeRequest('c1'));
+
+    // That directory is the live child's cwd; only `removeContainer`, which
+    // stops the child first, may delete it.
+    expect(orch.reclaimWorkdir('c1')).toBe(false);
+    expect(existsSync(join(rootDir, 'c1'))).toBe(true);
+    expect(orch.resolveDockerId('c1')).toBe(created.dockerId);
+  });
+
+  it('refuses the owner node', async () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    // No owner handle exists, so only the id check can save this directory —
+    // which holds the host's own control-DB storage.
+    const workdir = join(rootDir, 'owner');
+    mkdirSync(workdir, { recursive: true });
+
+    expect(orch.reclaimWorkdir('owner')).toBe(false);
+    expect(existsSync(workdir)).toBe(true);
+  });
+
+  it('reports false for a workdir that is already gone', () => {
+    const orch = makeOrchestrator();
+    expect(orch.reclaimWorkdir('grn_never_existed')).toBe(false);
+  });
+
+  it('refuses an id that names a file rather than a workdir', () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    // `rootDir` is not only container directories — `state.json` is the
+    // orchestrator's own persisted handle map, and `rmSync` would take it.
+    const statePath = join(rootDir, 'state.json');
+    writeFileSync(statePath, '{"handles":[]}', 'utf8');
+
+    expect(orch.reclaimWorkdir('state.json')).toBe(false);
+    expect(existsSync(statePath)).toBe(true);
+  });
+
+  it('refuses an id that would escape rootDir', () => {
+    const orch = makeOrchestrator();
+    const rootDir = (orch as unknown as { rootDir: string }).rootDir;
+    const sibling = join(rootDir, '..', 'sibling');
+    mkdirSync(sibling, { recursive: true });
+
+    // Unreachable with real `grn_<base64url>` ids; the guard is defence for a
+    // future caller that passes something else.
+    expect(orch.reclaimWorkdir('../sibling')).toBe(false);
+    expect(existsSync(sibling)).toBe(true);
+  });
+});
+
 describe('HostProcessOrchestrator.isRunning', () => {
   it('is true after spawn, false after kill, false on tampered token', async () => {
     const orch = makeOrchestrator();
@@ -253,6 +586,16 @@ describe('HostProcessOrchestrator.removeContainer', () => {
   });
 });
 
+/**
+ * `getStats` goes through `pidusage`, which on Windows shells out: modern
+ * builds no longer ship `wmic`, so it falls back to spawning `powershell.exe`
+ * to run `gwmi win32_process` — and the first sample for a fresh pid costs
+ * *two* such spawns, because CPU percent needs a prior baseline. Measured
+ * ~2.8 s idle and ~4.9 s on a loaded machine, so the 5 s default test timeout
+ * is not a real budget for this one. Give it explicit headroom.
+ */
+const STATS_TIMEOUT_MS = 30_000;
+
 describe('HostProcessOrchestrator.getStats', () => {
   it('returns plausible numbers with zero network counters', async () => {
     const orch = makeOrchestrator();
@@ -266,7 +609,7 @@ describe('HostProcessOrchestrator.getStats', () => {
     expect(stats.memoryBytes).toBeGreaterThan(0);
     expect(stats.networkRxBytes).toBe(0);
     expect(stats.networkTxBytes).toBe(0);
-  });
+  }, STATS_TIMEOUT_MS);
 });
 
 describe('HostProcessOrchestrator log rotation at spawn', () => {
@@ -381,6 +724,45 @@ describe('PortAllocator', () => {
   });
 });
 
+describe('allocateNodePorts', () => {
+  it('allocates the four ports in a fixed order', () => {
+    const a = new PortAllocator(10000, 10010);
+    expect(allocateNodePorts(a)).toEqual({ health: 10000, metrics: 10001, p2p: 10002, admin: 10003 });
+  });
+
+  // A partial set left reserved would leak from a bounded range on every failed
+  // provision — the whole reason this helper exists rather than four allocates.
+  it('is all-or-nothing: an exhausted range releases everything it took', () => {
+    const a = new PortAllocator(13000, 13002);
+    expect(() => allocateNodePorts(a)).toThrow(/No available ports/);
+    expect(a.has(13000)).toBe(false);
+    expect(a.has(13001)).toBe(false);
+    expect(a.has(13002)).toBe(false);
+  });
+
+  // The owner node's p2p port is pinned by the NAT mapping, not allocated.
+  it('honours an override and reserves it', () => {
+    const a = new PortAllocator(10000, 10010);
+    expect(allocateNodePorts(a, { p2p: 10005 })).toEqual({
+      health: 10000,
+      metrics: 10001,
+      p2p: 10005,
+      admin: 10002,
+    });
+    // Reserved, so no later allocation can hand it out again.
+    expect(a.has(10005)).toBe(true);
+  });
+
+  // An out-of-range override is the production case for the owner node: its
+  // libp2p port is chosen by NAT config, not by the allocator, so reserving it
+  // is a documented no-op rather than an error.
+  it('accepts an override outside the managed range without reserving it', () => {
+    const a = new PortAllocator(10000, 10010);
+    expect(allocateNodePorts(a, { p2p: 40000 })).toMatchObject({ p2p: 40000, health: 10000 });
+    expect(a.has(40000)).toBe(false);
+  });
+});
+
 describe('Restart recovery (init)', () => {
   it('re-attaches to surviving children and reports dead ones', async () => {
     const rootDir = join(tmpRoot, 'restart');
@@ -402,10 +784,6 @@ describe('Restart recovery (init)', () => {
     expect(await b.isRunning(r1.dockerId)).toBe(true);
     expect(await b.isRunning(r2.dockerId)).toBe(false);
 
-    const dead = b.listDeadHandles();
-    expect(dead.map((d) => d.dockerId)).toContain(r2.dockerId);
-    expect(dead.map((d) => d.dockerId)).not.toContain(r1.dockerId);
-
     // Ports from both should be reserved (no overlapping allocations from `b`)
     // Allocate three more containers via `b` and confirm none collide with
     // c1/c2's existing ports.
@@ -517,6 +895,9 @@ describe('child survives orchestrator exit', () => {
         try { rmSync(handle.workdir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }); } catch { /* ignore */ }
       }
     },
+    // The helper spawn alone budgets 15 s; the surrounding waits add ~0.8 s
+    // more. Under the 5 s default the test could never reach its own timeout.
+    30_000,
   );
 });
 

package/src/auth/__tests__/self-label.test.ts

@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { SELF_LABEL, ensureSelfLabel } from '../self-label.js';
+import { TrustCircleStore } from '../trust-circle-store.js';
+
+let tmpRoot: string;
+let store: TrustCircleStore;
+
+const NOW = new Date('2025-06-01T12:00:00.000Z');
+const now = (): Date => NOW;
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-self-label-'));
+  store = new TrustCircleStore(tmpRoot);
+});
+
+afterEach(() => {
+  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+describe('ensureSelfLabel', () => {
+  it('writes a self-flagged label for the owner peer ID', async () => {
+    const peerId = await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWOwner', now });
+
+    expect(peerId).toBe('12D3KooWOwner');
+    expect(store.getMember('12D3KooWOwner')).toEqual({
+      peerId: '12D3KooWOwner',
+      label: SELF_LABEL,
+      addedAt: NOW.toISOString(),
+      self: true,
+    });
+  });
+
+  it('keeps an admin-renamed label on a second run', async () => {
+    store.addMember({ peerId: '12D3KooWOwner', label: 'Basement PC', addedAt: 't0', self: true });
+
+    await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWOwner', now });
+
+    expect(store.getMember('12D3KooWOwner')).toMatchObject({ label: 'Basement PC', addedAt: 't0', self: true });
+  });
+
+  it('stamps the self flag onto a pre-existing unflagged row', async () => {
+    store.addMember({ peerId: '12D3KooWOwner', label: 'Basement PC', addedAt: 't0' });
+
+    await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWOwner', now });
+
+    expect(store.getMember('12D3KooWOwner')).toEqual({
+      peerId: '12D3KooWOwner',
+      label: 'Basement PC',
+      addedAt: 't0',
+      self: true,
+    });
+  });
+
+  it('drops a stale self label after the node identity changes', async () => {
+    store.addMember({ peerId: '12D3KooWOld', label: SELF_LABEL, addedAt: 't0', self: true });
+    store.addMember({ peerId: '12D3KooWPhone', label: "Mom's phone", addedAt: 't1' });
+
+    await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWNew', now });
+
+    expect(store.getMember('12D3KooWOld')).toBeUndefined();
+    expect(store.getMember('12D3KooWNew')).toMatchObject({ label: SELF_LABEL, self: true });
+    // Non-self labels are untouched.
+    expect(store.getMember('12D3KooWPhone')).toMatchObject({ label: "Mom's phone" });
+  });
+
+  it('writes nothing when the node is not ready yet (empty peer ID)', async () => {
+    const peerId = await ensureSelfLabel({ store, getPeerId: async () => '', now });
+
+    expect(peerId).toBeUndefined();
+    expect(store.listMembers()).toEqual([]);
+  });
+
+  it('propagates a getPeerId failure to the caller', async () => {
+    await expect(ensureSelfLabel({
+      store,
+      getPeerId: async () => { throw new Error('owner node unavailable'); },
+      now,
+    })).rejects.toThrow('owner node unavailable');
+    expect(store.listMembers()).toEqual([]);
+  });
+});