@velum-labs/routekit-eval-setup 1.3.2 → 1.5.0

package/dist/test/repository-vitest-phase.test.js

@@ -0,0 +1,848 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { test } from "node:test";
+import { setTimeout as delay } from "node:timers/promises";
+import { promisify, stripVTControlCharacters } from "node:util";
+import { Effect } from "effect";
+import { parse, stringify } from "yaml";
+import { repositoryCommandTestEvidenceV1 } from "../adapters/repository-command-evidence.js";
+import { makeRepositoryPreparationCacheV1, RepositoryReadOnlyPnpmStore, replayRepositoryCommandsV1 } from "../adapters/repository-command-runner.js";
+import { RepositoryFoundryError } from "../errors.js";
+import { REPOSITORY_RESOURCE_CASES, REPOSITORY_RESOURCE_FILES, RESOURCE_BODY_DELAY_MS, RESOURCE_FRAMEWORK_TIMEOUT_MS, RESOURCE_OUTPUT_CAP_BYTES, RESOURCE_OUTPUT_CHUNK_BYTES, RESOURCE_PARENT_DEADLINE_MS } from "./fixtures/repository-resource-panel.js";
+import { VITEST_BOUNDARY_CASES, VITEST_BOUNDARY_FILES, VITEST_COLLECTION_FAILURE_CASES } from "./fixtures/vitest-boundary-panel.js";
+import { VITEST_PHASE_CASES, VITEST_PHASE_CUSTOM_RUNNER_SOURCE, VITEST_PHASE_READER_SOURCE, VITEST_PHASE_REGISTER_SOURCE, VITEST_PHASE_STOCK_READER_SOURCE, VITEST_PHASE_TIMEOUT_CASES, VITEST_PHASE_VERSIONS_SOURCE } from "./fixtures/vitest-phase-panel.js";
+const exec = promisify(execFile);
+const reportPrefix = "ROUTEKIT_VITEST_PHASE_EVIDENCE_V1 ";
+const controlPrefix = "ROUTEKIT_PHASE_CAUSAL_CONTROL ";
+const stockPrefix = "ROUTEKIT_STOCK_VITEST_CONTROL ";
+function oneFrame(output, prefix) {
+    const frames = stripVTControlCharacters(output).split("\n").filter(line => line.startsWith(prefix));
+    assert.equal(frames.length, 1, `one real ${prefix.trim()} frame is required: ${output}`);
+    return JSON.parse(frames[0].slice(prefix.length));
+}
+function completed(result) {
+    assert.equal(result.stage, "grade");
+    assert.equal(result.gradeExecuted, true, JSON.stringify(result));
+    assert.equal(result.timedOut, false, JSON.stringify(result));
+    assert.equal(result.outputTruncated, false, JSON.stringify(result));
+    assert.notEqual(result.exitCode, null, JSON.stringify(result));
+    const preparation = result.preparation?.sharedResults ?? result.trustedPreparationResults;
+    assert.equal(preparation.length, 1, "the declared offline dependency preparation must execute");
+    for (const item of preparation)
+        assert.equal(item.exitCode, 0, JSON.stringify(item));
+    assert.ok(result.candidateValidationResults.length > 0);
+    for (const item of result.candidateValidationResults)
+        assert.equal(item.exitCode, 0, JSON.stringify(item));
+}
+async function fixture(t, additionalFiles = {}) {
+    // Trap even metadata-only registry requests: pnpm's tarball --offline flag
+    // alone does not keep its lockfile supply-chain verifier off the network.
+    const registryRequests = [];
+    const registry = createServer((request, response) => {
+        registryRequests.push(request.url ?? "");
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end("{}");
+    });
+    await new Promise((resolve, reject) => {
+        registry.once("error", reject);
+        registry.listen(0, "127.0.0.1", resolve);
+    });
+    t.after(async () => {
+        await new Promise((resolve, reject) => registry.close(error => error ? reject(error) : resolve()));
+        assert.deepEqual(registryRequests, [], "offline fixture preparation must never query a registry");
+    });
+    const address = registry.address();
+    assert.ok(address !== null && typeof address !== "string");
+    const root = await realpath(await mkdtemp(join(tmpdir(), "vitest-phase-regression-")));
+    let passed = false;
+    t.after(async () => {
+        if (passed)
+            await rm(root, { recursive: true, force: true });
+        else
+            t.diagnostic(`Retained failed real-Vitest fixture and artifacts: ${root}`);
+    });
+    await mkdir(join(root, "artifacts"));
+    const record = (name, value) => writeFile(join(root, "artifacts", name), `${JSON.stringify(value, null, 2)}\n`);
+    const complete = () => { passed = true; };
+    const runId = randomUUID();
+    const prehydratedStore = await realpath((await exec("corepack", ["pnpm@11.15.1", "store", "path", "--silent"])).stdout.trim());
+    await record("identity.json", { runId, root, node: process.version, platform: process.platform });
+    const workspace = parse(await readFile(new URL("../../../../pnpm-workspace.yaml", import.meta.url), "utf8"));
+    const lock = parse(await readFile(new URL("../../../../pnpm-lock.yaml", import.meta.url), "utf8"));
+    const owner = lock.importers["packages/eval-setup"]?.devDependencies;
+    assert.equal(workspace.catalog.vitest, "3.2.7");
+    assert.equal(workspace.catalog.vite, "7.3.6");
+    assert.ok(owner?.vitest, "Vitest must be declared and installed by this repository, not found in another checkout");
+    assert.ok(owner.vite, "Vite must be declared in the root catalog and eval-setup dev dependencies");
+    assert.equal(owner.vitest.specifier, "catalog:");
+    assert.equal(owner.vite.specifier, "catalog:");
+    // Derive the exact frozen dependency graph from the owning workspace lock.
+    // This avoids a second drift-prone lock and ensures normal root installation
+    // fetches the very package graph later used by this offline regression.
+    const fixtureLock = {
+        ...lock,
+        importers: { ".": { devDependencies: { vite: owner.vite, vitest: owner.vitest } } }
+    };
+    const workspaceConfig = {
+        packages: [],
+        catalog: workspace.catalog,
+        ...(workspace.catalogs === undefined ? {} : { catalogs: workspace.catalogs }),
+        ...(workspace.overrides === undefined ? {} : { overrides: workspace.overrides }),
+        ...(workspace.minimumReleaseAgeExclude === undefined ? {} : {
+            minimumReleaseAgeExclude: workspace.minimumReleaseAgeExclude
+        }),
+        autoInstallPeers: lock.settings.autoInstallPeers,
+        enableGlobalVirtualStore: false,
+        frozenStore: true,
+        registry: `http://127.0.0.1:${address.port}/`,
+        // The root install already checks the repository-owned lock under .npmrc's
+        // supply-chain policy and hydrates its integrity-addressed store. This
+        // test-only fixture reuses exactly those pins, not a candidate's lockfile.
+        // pnpm 11.15.1's verifier ignores --offline and re-fetches registry metadata
+        // in the isolated HOME. Its documented trusted-base option avoids that
+        // second online policy check without disabling frozen-lockfile, frozen-store,
+        // integrity verification, or any production preparation policy.
+        trustLockfile: true
+    };
+    await mkdir(join(root, "test"));
+    await mkdir(join(root, "scripts"));
+    const files = {
+        "package.json": JSON.stringify({ name: "routekit-vitest-phase-regression", private: true, type: "module",
+            packageManager: "pnpm@11.15.1", devDependencies: { vite: "catalog:", vitest: "catalog:" } }),
+        "pnpm-workspace.yaml": stringify(workspaceConfig),
+        // This fixture borrows the root lock, so it must retain the same reviewed
+        // package policies rather than rejecting root-approved fresh dependency pins.
+        ".npmrc": await readFile(new URL("../../../../.npmrc", import.meta.url), "utf8"),
+        "pnpm-lock.yaml": stringify(fixtureLock),
+        ".gitignore": "node_modules/\nphases/\ncustom-runner-imported\nartifacts/\nstock-*.json\n",
+        "identity.json": JSON.stringify({ runId }),
+        "test/register.mjs": VITEST_PHASE_REGISTER_SOURCE,
+        "scripts/read-phases.mjs": VITEST_PHASE_READER_SOURCE,
+        "scripts/read-stock.mjs": VITEST_PHASE_STOCK_READER_SOURCE,
+        "scripts/versions.mjs": VITEST_PHASE_VERSIONS_SOURCE,
+        "custom-runner.mjs": VITEST_PHASE_CUSTOM_RUNNER_SOURCE,
+        "scripts/unsupported-version.mjs": String.raw `
+import assert from "node:assert/strict";
+import { readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { isAbsolute, relative, sep } from "node:path";
+const require = createRequire(import.meta.url);
+const path = await realpath(require.resolve("vitest/package.json"));
+const local = relative(await realpath(process.cwd()), path);
+assert.equal(local === ".." || local.startsWith(".." + sep) || isAbsolute(local), false);
+const manifest = JSON.parse(await readFile(path, "utf8"));
+assert.equal(manifest.version, "3.2.7");
+// Replace the isolated directory entry; never write a potentially shared inode.
+const temporary = path + ".unsupported-probe";
+await writeFile(temporary, JSON.stringify({ ...manifest, version: "0.0.0-phase-unsupported" }), { flag: "wx" });
+await rename(temporary, path);
+console.log("ROUTEKIT_PHASE_ISOLATED_VERSION_CONTROL");
+`
+    };
+    for (const scenario of [...VITEST_PHASE_CASES, ...VITEST_PHASE_TIMEOUT_CASES])
+        files[`test/${scenario.id}.test.mjs`] =
+            `import { register } from "./register.mjs";\nregister(${JSON.stringify(scenario)});\n`;
+    for (const [path, content] of Object.entries(additionalFiles)) {
+        assert.equal(Object.hasOwn(files, path), false, "boundary fixtures cannot replace the original phase fixture files");
+        files[path] = content;
+    }
+    for (const [path, source] of Object.entries(files))
+        await writeFile(join(root, path), source);
+    const git = (...args) => exec("git", ["-C", root, ...args]);
+    await git("init", "-q");
+    await git("add", ".");
+    await git("-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.test", "commit", "-qm", `phase regression ${runId}`);
+    const commit = (await git("rev-parse", "HEAD")).stdout.trim();
+    const preparation = [{ id: "offline-frozen-install", kind: "custom", cwd: ".",
+            executable: "corepack", args: ["pnpm@11.15.1", "install", "--offline", "--frozen-lockfile",
+                "--ignore-pnpmfile", "--ignore-scripts"], timeoutMs: 60000 }];
+    const validation = [{ id: "pinned-runtime-versions", kind: "check", cwd: ".",
+            executable: "node", args: ["scripts/versions.mjs"], timeoutMs: 10000 }];
+    const grade = (id) => {
+        const timeout = VITEST_PHASE_TIMEOUT_CASES.find(scenario => scenario.id === id)?.hookTimeoutMs;
+        return { id: `grade-${id}`, kind: "test", cwd: ".",
+            executable: "corepack", args: ["pnpm@11.15.1", "exec", "vitest", "run", `test/${id}.test.mjs`,
+                "--pool=forks", "--maxWorkers=1", "--minWorkers=1", "--no-file-parallelism",
+                ...(timeout === undefined ? [] : [`--hookTimeout=${timeout}`])], timeoutMs: 60000 };
+    };
+    const control = (id) => ({ id: `control-${id}`, kind: "custom", cwd: ".",
+        executable: "node", args: ["scripts/read-phases.mjs", id], timeoutMs: 10000 });
+    const stock = (id) => {
+        const base = grade(id);
+        return { ...base, id: `stock-${id}`, kind: "custom",
+            // Deliberately not a host-recognized Vitest grade command: this is the
+            // pinned framework's ordinary lifecycle, with its stock JSON reporter.
+            args: [base.args[0], "exec", "node", "node_modules/vitest/vitest.mjs", ...base.args.slice(3),
+                "--api.host=127.0.0.1", "--api.middlewareMode", "--reporter=json", `--outputFile=stock-${id}.json`] };
+    };
+    const stockControl = (id) => ({ ...control(id),
+        id: `stock-control-${id}`, args: ["scripts/read-stock.mjs", id] });
+    await record("fixture.json", { runId, commit, pins: { vitest: workspace.catalog.vitest, vite: workspace.catalog.vite },
+        preparation, validation });
+    return { root, runId, commit, preparation, validation, grade, control, stock, stockControl,
+        record, complete, signal: t.signal, prehydratedStore };
+}
+async function executeRecorded(fixture, name, program) {
+    let effectCause;
+    try {
+        // The root frozen install hydrates this store before the offline test starts.
+        // Explicitly borrow it read-only; production continues to use its private store.
+        const configured = fixture.prehydratedStore === undefined ? program : program.pipe(Effect.provideService(RepositoryReadOnlyPnpmStore, fixture.prehydratedStore));
+        const results = await Effect.runPromise(Effect.onError(configured, cause => Effect.sync(() => {
+            // Effect 4 runPromise squashes the Cause before rejecting. Preserve its
+            // complete structure here without changing the caller's rejection.
+            effectCause = cause;
+        })), { signal: fixture.signal });
+        await fixture.record(`${name}-results.json`, results);
+        return results;
+    }
+    catch (error) {
+        const details = (root) => {
+            const seen = new WeakMap();
+            const encode = (value, path) => {
+                if (value === undefined)
+                    return { $undefined: true };
+                if (typeof value === "bigint")
+                    return { $bigint: String(value) };
+                if (typeof value === "symbol")
+                    return { $symbol: String(value) };
+                if (typeof value === "function")
+                    return { $function: value.name };
+                if (value === null || typeof value !== "object")
+                    return value;
+                const previous = seen.get(value);
+                if (previous !== undefined)
+                    return { $ref: previous };
+                seen.set(value, path);
+                if (Array.isArray(value))
+                    return value.map((item, index) => encode(item, `${path}[${index}]`));
+                if (value instanceof Map)
+                    return { $map: [...value].map(([key, item], index) => [
+                            encode(key, `${path}.keys[${index}]`), encode(item, `${path}.values[${index}]`)
+                        ]) };
+                if (value instanceof Set)
+                    return { $set: [...value].map((item, index) => encode(item, `${path}[${index}]`)) };
+                const result = Object.create(null);
+                if (value instanceof Error) {
+                    result.name = value.name;
+                    result.message = value.message;
+                    result.stack = value.stack;
+                }
+                // Preserve nonenumerable Error.cause and the Effect tagged-error
+                // fields/symbol payloads. Do not invoke arbitrary toJSON methods.
+                for (const key of Reflect.ownKeys(value)) {
+                    if (value instanceof Error && (key === "name" || key === "message" || key === "stack"))
+                        continue;
+                    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                    const name = typeof key === "symbol" ? `[${String(key)}]` : key;
+                    result[name] = "value" in descriptor
+                        ? encode(descriptor.value, `${path}.${name}`)
+                        : { $accessorNotInvoked: true };
+                }
+                return result;
+            };
+            return encode(root, "$");
+        };
+        await fixture.record(`${name}-error.json`, {
+            message: String(error), ...(error instanceof Error ? { stack: error.stack } : {}),
+            rejection: details(error), effectCause: details(effectCause)
+        });
+        throw error;
+    }
+}
+test("recorded replay interruption reaches Effect finalizers", { timeout: 5000 }, async () => {
+    const controller = new AbortController();
+    const records = new Map();
+    let finalized = false;
+    let entered = () => { };
+    const started = new Promise(resolve => { entered = resolve; });
+    const pending = executeRecorded({
+        signal: controller.signal,
+        record: async (name, value) => { records.set(name, JSON.parse(JSON.stringify(value))); }
+    }, "cancelled", Effect.ensuring(Effect.andThen(Effect.sync(entered), Effect.never), Effect.sync(() => { finalized = true; })));
+    const rejected = assert.rejects(pending);
+    await started;
+    controller.abort();
+    await rejected;
+    assert.equal(finalized, true);
+    const record = records.get("cancelled-error.json");
+    assert.ok(record.effectCause.reasons.some(reason => reason._tag === "Interrupt"));
+});
+test("recorded replay failure retains pristine preparation output and nested error causes", async (t) => {
+    const records = new Map();
+    const error = new RepositoryFoundryError({
+        operation: "prepare-checkout", detail: "offline preparation failed",
+        cause: { templateKey: "fixture-template", commit: "fixture-commit",
+            trustedPreparationResults: [{ exitCode: 1, stdout: "complete preparation stdout", stderr: "offline metadata unavailable" }],
+            nested: new Error("nested preparation error", { cause: { stage: "frozen-offline-install" } }) }
+    });
+    await assert.rejects(executeRecorded({
+        signal: t.signal, record: async (name, value) => { records.set(name, JSON.parse(JSON.stringify(value))); }
+    }, "preparation", Effect.fail(error)), rejected => rejected === error);
+    const record = records.get("preparation-error.json");
+    assert.equal(record.rejection.name, "RepositoryFoundryError");
+    assert.equal(record.rejection.message, error.message);
+    assert.equal(record.rejection.operation, error.operation);
+    assert.equal(record.rejection.detail, error.detail);
+    assert.equal(record.rejection.cause.templateKey, "fixture-template");
+    assert.equal(record.rejection.cause.commit, "fixture-commit");
+    assert.deepEqual(record.rejection.cause.trustedPreparationResults, [
+        { exitCode: 1, stdout: "complete preparation stdout", stderr: "offline metadata unavailable" }
+    ]);
+    assert.equal(record.rejection.cause.nested.name, "Error");
+    assert.equal(record.rejection.cause.nested.message, "nested preparation error");
+    assert.ok(record.rejection.cause.nested.stack.includes("nested preparation error"));
+    assert.deepEqual(record.rejection.cause.nested.cause, { stage: "frozen-offline-install" });
+    assert.equal(record.effectCause.reasons[0]?._tag, "Fail");
+    const causeError = record.effectCause.reasons[0]?.error;
+    assert.equal(causeError.name, record.rejection.name);
+    assert.equal(causeError.message, record.rejection.message);
+    assert.equal(causeError.operation, record.rejection.operation);
+    assert.equal(causeError.detail, record.rejection.detail);
+    assert.deepEqual(causeError.cause, record.rejection.cause);
+});
+test("offline pinned preparation fails closed when the prehydrated store is empty", { timeout: 60000 }, async (t) => {
+    const f = await fixture(t);
+    const emptyStore = join(f.root, "empty-store");
+    const emptyProject = join(f.root, "empty-project");
+    await mkdir(emptyProject);
+    await writeFile(join(emptyProject, "package.json"), JSON.stringify({
+        name: "empty-offline-store", private: true, packageManager: "pnpm@11.15.1"
+    }));
+    // Initialize pnpm's real store schema without hydrating any packages. An
+    // absent database would only test SQLite opening, not offline dependency refusal.
+    await exec("corepack", ["pnpm@11.15.1", "install", "--offline", "--ignore-workspace",
+        "--ignore-scripts", "--store-dir", emptyStore], { cwd: emptyProject });
+    const versionedStore = (await exec("corepack", ["pnpm@11.15.1", "store", "path", "--silent",
+        "--store-dir", emptyStore], { cwd: emptyProject })).stdout.trim();
+    const results = await executeRecorded({ ...f, prehydratedStore: versionedStore }, "missing-offline-dependencies", replayRepositoryCommandsV1({
+        repositoryRoot: f.root, commit: f.commit, trustedPreparationRecipes: f.preparation,
+        candidateValidationRecipes: f.validation, recipes: [f.grade("positive")], repetitions: 1
+    }));
+    assert.equal(results.length, 1);
+    const result = results[0];
+    assert.equal(result.stage, "trusted-preparation");
+    assert.equal(result.gradeExecuted, false);
+    assert.equal(result.timedOut, false, JSON.stringify(result));
+    assert.equal(result.candidateValidationResults.length, 0);
+    assert.equal(result.trustedPreparationResults.length, 1);
+    const preparation = result.trustedPreparationResults[0];
+    assert.notEqual(preparation.exitCode, 0);
+    assert.notEqual(preparation.exitCode, null);
+    assert.match(`${preparation.stdout}\n${preparation.stderr}`, /ERR_PNPM_(?:NO_OFFLINE|FROZEN_STORE)/u);
+    f.complete();
+});
+test("real pinned runtime validation refuses missing or redirected fixture-local launchers", { timeout: 120000 }, async (t) => {
+    const f = await fixture(t);
+    for (const { name, kind } of [
+        { name: "vite", kind: "missing" },
+        { name: "vitest", kind: "missing" },
+        { name: "vitest", kind: "redirected" }
+    ]) {
+        const alterLauncher = {
+            id: `${kind}-${name}-launcher`, kind: "check", cwd: ".", executable: "node",
+            args: ["-e", `
+const { rmSync, writeFileSync } = require("node:fs");
+const { join } = require("node:path");
+const launcher = join("node_modules", ".bin", process.argv[1] +
+  (process.platform === "win32" ? ".cmd" : ""));
+rmSync(launcher);
+if (process.argv[2] === "redirected") {
+  writeFileSync("scripts/redirected-runtime.mjs", 'console.log("vitest/3.2.7 fixture");\\n', { flag: "wx" });
+  writeFileSync(launcher, process.platform === "win32"
+    ? "@echo off\\r\\nnode scripts\\\\redirected-runtime.mjs %*\\r\\n"
+    : '#!/bin/sh\\nexec node scripts/redirected-runtime.mjs "$@"\\n', { flag: "wx", mode: 0o700 });
+}
+`, name, kind],
+            timeoutMs: 10000
+        };
+        const results = await executeRecorded(f, `${kind}-${name}-launcher`, replayRepositoryCommandsV1({
+            repositoryRoot: f.root, commit: f.commit, trustedPreparationRecipes: f.preparation,
+            candidateValidationRecipes: [alterLauncher, ...f.validation],
+            recipes: [f.grade("positive")], repetitions: 1
+        }));
+        assert.equal(results.length, 1);
+        const result = results[0];
+        assert.equal(result.stage, "candidate-validation");
+        assert.equal(result.gradeExecuted, false, "an invalid local launcher must fail before any grade runs");
+        assert.equal(result.timedOut, false);
+        assert.equal(result.outputTruncated, false);
+        assert.equal(result.exitCode, 1);
+        assert.equal(result.trustedPreparationResults.length, 1);
+        assert.equal(result.trustedPreparationResults[0].exitCode, 0);
+        assert.equal(result.candidateValidationResults.length, 2);
+        assert.equal(result.candidateValidationResults[0].exitCode, 0, "the frozen install must create the local launcher before this negative control changes it");
+        if (kind === "missing")
+            assert.match(result.stderr, /ENOENT/u);
+        else
+            assert.match(result.stderr, /vitest must execute its checkout-local pinned entrypoint/u, "an executable local shim and matching version text cannot replace actual entrypoint proof");
+        assert.equal(result.stdout.includes("ROUTEKIT_PINNED_VITEST_RUNTIME"), false);
+        assert.equal(`${result.stdout}\n${result.stderr}`.includes(reportPrefix), false);
+    }
+    f.complete();
+});
+test("real pinned Vitest preserves body signal and refuses cleanup or unobserved phases", { timeout: 240000 }, async (t) => {
+    const f = await fixture(t);
+    const results = await executeRecorded(f, "phase-panel", Effect.scoped(Effect.gen(function* () {
+        const cache = process.platform === "darwin" ? yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root, commits: [f.commit], trustedPreparationRecipes: f.preparation
+        }) : undefined;
+        return yield* replayRepositoryCommandsV1({ repositoryRoot: f.root, commit: f.commit,
+            trustedPreparationRecipes: f.preparation, candidateValidationRecipes: f.validation,
+            ...(cache === undefined ? {} : { preparationCache: cache }),
+            recipes: VITEST_PHASE_CASES.flatMap(scenario => [f.grade(scenario.id), f.control(scenario.id)]),
+            repetitions: 2 });
+    })));
+    assert.equal(results.length, VITEST_PHASE_CASES.length * 4, "all real grade and causal-control subprocesses must finish");
+    for (const repetition of [1, 2])
+        for (const scenario of VITEST_PHASE_CASES) {
+            const result = results.find(item => item.repetition === repetition && item.recipeId === f.grade(scenario.id).id);
+            const controlResult = results.find(item => item.repetition === repetition && item.recipeId === f.control(scenario.id).id);
+            assert.ok(result);
+            assert.ok(controlResult);
+            completed(result);
+            completed(controlResult);
+            assert.equal(controlResult.exitCode, 0, JSON.stringify(controlResult));
+            const control = oneFrame(controlResult.stdout, controlPrefix);
+            assert.equal(control.runId, f.runId);
+            assert.equal(control.scenario, scenario.id);
+            assert.equal(control.customRunnerImported, false);
+            assert.deepEqual(control.events.map(event => event.phase), scenario.events, `${scenario.id} repetition ${repetition}`);
+            for (const [sequence, event] of control.events.entries()) {
+                assert.equal(event.sequence, sequence);
+                assert.equal(event.runId, f.runId);
+                assert.equal(event.scenario, scenario.id);
+            }
+            const report = oneFrame(`${result.stdout}\n${result.stderr}`, reportPrefix);
+            assert.equal(report.version, 1);
+            assert.equal(report.complete, true, JSON.stringify(report));
+            assert.equal(report.starts, 1);
+            assert.equal(report.ends, 1);
+            assert.equal(report.eventIntegrity, true);
+            if (scenario.expected === "unknown") {
+                assert.deepEqual(report.unhandledErrors, [{ name: "RouteKitVitestPhaseAttributionError",
+                        code: "ROUTEKIT_VITEST_PHASE_UNATTRIBUTED" }], "unknown must be the intended host attribution refusal, not a missing dependency/import/launch failure");
+            }
+            else
+                assert.deepEqual(report.unhandledErrors, []);
+            assert.equal(result.exitCode, scenario.expected === "pass" ? 0 : 1, JSON.stringify(result));
+            assert.equal(repositoryCommandTestEvidenceV1(result, result.recipeId).outcome, scenario.expected, `${scenario.id} repetition ${repetition}: ${JSON.stringify(result)}`);
+        }
+    f.complete();
+});
+function boundaryControl(result, runId, scenario) {
+    const control = oneFrame(result.stdout, controlPrefix);
+    assert.equal(control.runId, runId);
+    assert.equal(control.scenario, scenario.id);
+    assert.equal(control.customRunnerImported, false);
+    assert.deepEqual(control.events.map(event => event.phase), scenario.events);
+    for (const [sequence, event] of control.events.entries()) {
+        assert.equal(event.sequence, sequence);
+        assert.equal(event.runId, runId);
+        assert.equal(event.scenario, scenario.id);
+        assert.ok(Number.isInteger(event.process.pid) && event.process.pid > 1);
+        assert.equal(typeof event.process.checkout, "string");
+    }
+    return control;
+}
+test("real pinned Vitest preserves direct hooks and native collection-failure identities", { timeout: 240000 }, async (t) => {
+    const f = await fixture(t, VITEST_BOUNDARY_FILES);
+    const replay = (stock) => Effect.scoped(Effect.gen(function* () {
+        const cache = process.platform === "darwin" ? yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root, commits: [f.commit], trustedPreparationRecipes: f.preparation
+        }) : undefined;
+        const scenarios = stock ? VITEST_COLLECTION_FAILURE_CASES : VITEST_BOUNDARY_CASES;
+        return yield* replayRepositoryCommandsV1({ repositoryRoot: f.root, commit: f.commit,
+            trustedPreparationRecipes: f.preparation, candidateValidationRecipes: f.validation,
+            ...(cache === undefined ? {} : { preparationCache: cache }),
+            recipes: scenarios.flatMap(scenario => stock
+                ? [f.stock(scenario.id), f.stockControl(scenario.id)]
+                : [f.grade(scenario.id), f.control(scenario.id)]),
+            repetitions: 2 });
+    }));
+    // Preserve original/stock diagnostics independently before testing the host
+    // adapter. A host crash is not an acceptable substitute for native refusal.
+    const baseline = await executeRecorded(f, "boundary-stock-collection", replay(true));
+    const phased = await executeRecorded(f, "boundary-phase-panel", replay(false));
+    assert.equal(baseline.length, VITEST_COLLECTION_FAILURE_CASES.length * 4);
+    assert.equal(phased.length, VITEST_BOUNDARY_CASES.length * 4);
+    for (const repetition of [1, 2])
+        for (const scenario of VITEST_BOUNDARY_CASES) {
+            const result = phased.find(item => item.repetition === repetition && item.recipeId === f.grade(scenario.id).id);
+            const controlResult = phased.find(item => item.repetition === repetition && item.recipeId === f.control(scenario.id).id);
+            assert.ok(result);
+            assert.ok(controlResult);
+            completed(result);
+            completed(controlResult);
+            assert.equal(controlResult.exitCode, 0);
+            const control = boundaryControl(controlResult, f.runId, scenario);
+            const report = oneFrame(`${result.stdout}\n${result.stderr}`, reportPrefix);
+            assert.equal(report.version, 1);
+            assert.equal(report.complete, true, JSON.stringify(report));
+            assert.equal(report.starts, 1);
+            assert.equal(report.ends, 1);
+            assert.equal(report.eventIntegrity, true);
+            assert.equal(report.modules.length, 1);
+            const module = report.modules[0];
+            assert.equal(module.tests.length, scenario.taskState === "none" ? 0 : 1);
+            // Hook refusal interrupts Vitest before its final throttled task-update
+            // flush. The causal journal and exact refusal below remain authoritative;
+            // the parent task snapshot can still be pending or reflect a passed body.
+            if (scenario.taskState !== "none" && !(scenario.kind === "hooks" && scenario.expected === "unknown")) {
+                assert.equal(module.tests[0].state, scenario.taskState);
+            }
+            if (scenario.kind === "import-error" || scenario.kind === "syntax-error") {
+                const stock = baseline.find(item => item.repetition === repetition && item.recipeId === f.stock(scenario.id).id);
+                const stockControl = baseline.find(item => item.repetition === repetition && item.recipeId === f.stockControl(scenario.id).id);
+                assert.ok(stock);
+                assert.ok(stockControl);
+                completed(stock);
+                completed(stockControl);
+                assert.equal(stock.exitCode, 1);
+                assert.equal(stockControl.exitCode, 0);
+                assert.equal(stock.testReporter, undefined);
+                assert.equal(`${stock.stdout}\n${stock.stderr}`.includes(reportPrefix), false);
+                const original = boundaryControl(stockControl, f.runId, scenario);
+                const stockReport = oneFrame(stockControl.stdout, stockPrefix);
+                assert.equal(stockReport.runId, f.runId);
+                assert.equal(stockReport.scenario, scenario.id);
+                assert.equal(stockReport.report.success, false);
+                assert.equal(stockReport.report.numTotalTests, 0);
+                assert.equal(stockReport.report.testResults.length, 1);
+                assert.equal(stockReport.report.testResults[0].status, "failed");
+                const diagnostics = [original, control].map(value => {
+                    const rejection = value.events.find(event => event.phase === "import-rejected");
+                    assert.ok(rejection?.diagnostic);
+                    const detail = rejection.diagnostic;
+                    if (scenario.kind === "import-error") {
+                        assert.equal(detail.name, "RouteKitFixtureImportError");
+                        assert.equal(detail.code, "ROUTEKIT_FIXTURE_IMPORT_FAILURE");
+                        assert.equal(detail.message, "routekit fixture import failed before test registration");
+                    }
+                    else {
+                        assert.match(detail.message, /Parse failure:|Failed to parse source for import analysis/u);
+                        assert.ok(`${detail.id ?? ""}\n${detail.message}`.includes("edge-import-syntax-bad.mjs"));
+                    }
+                    return { name: detail.name, ...(detail.code === undefined ? {} : { code: detail.code }),
+                        message: detail.message.replaceAll(rejection.process.checkout, "$CHECKOUT") };
+                });
+                assert.deepEqual(diagnostics[1], diagnostics[0], "instrumentation must preserve the native import/syntax diagnostic");
+                const native = diagnostics[0];
+                const nativeIdentity = { name: native.name,
+                    ...(native.code === undefined ? {} : { code: native.code }) };
+                assert.deepEqual(module.errors, [nativeIdentity], "the original collection failure must remain the file error");
+            }
+            assert.deepEqual(report.unhandledErrors, scenario.expected === "unknown" ? [
+                { name: "RouteKitVitestPhaseAttributionError", code: "ROUTEKIT_VITEST_PHASE_UNATTRIBUTED" }
+            ] : [], "a host TypeError or arbitrary crash does not satisfy phase refusal");
+            assert.equal(result.exitCode, scenario.expected === "pass" ? 0 : 1, JSON.stringify(result));
+            assert.equal(repositoryCommandTestEvidenceV1(result, result.recipeId).outcome, scenario.expected);
+        }
+    f.complete();
+});
+function workerDeathIpcDiagnostic(result) {
+    const output = stripVTControlCharacters(`${result.stdout}\n${result.stderr}`);
+    const lines = output.split("\n").map(line => line.trim());
+    const primaryLines = lines.filter(line => /^(?:[A-Za-z_$][\w$]*Error|Error): /u.test(line));
+    assert.deepEqual(primaryLines, ["Error: Channel closed"]);
+    const primary = primaryLines[0].match(/^(Error): (Channel closed)$/u);
+    const serialized = lines.filter(line => line.startsWith("Serialized Error: "));
+    assert.deepEqual(serialized, ["Serialized Error: { code: 'ERR_IPC_CHANNEL_CLOSED' }"]);
+    const code = serialized[0].match(/code: '([^']+)'/u)[1];
+    const index = lines.indexOf(primaryLines[0]);
+    assert.match(lines[index + 1], /target\.send node:internal\/child_process:\d+:\d+$/u);
+    assert.match(lines[index + 2], /ProcessWorker\.send .*tinypool\/dist\/index\.js:\d+:\d+$/u);
+    assert.match(lines[index + 3], /MessagePort\.<anonymous> .*tinypool\/dist\/index\.js:\d+:\d+$/u);
+    assert.match(output, /Unhandled Rejection/u);
+    assert.equal(output.includes(reportPrefix), false, "the demonstrated native fatal IPC path exits before parent run-end reporting");
+    return { name: primary[1], message: primary[2], code };
+}
+async function disposedResourceWorker(control, fixtureRoot, signal) {
+    const entered = control.events.find(event => event.phase === "body-enter");
+    assert.ok(entered, "the actual grading worker must enter the body before the failure boundary");
+    const observed = entered.process;
+    assert.ok(Number.isSafeInteger(observed.pid) && observed.pid > 1);
+    assert.notEqual(observed.pid, process.pid, "only a recorded fresh fixture-owned process may be probed");
+    assert.ok(Number.isSafeInteger(observed.parentPid) && observed.parentPid > 1);
+    assert.notEqual(observed.checkout, fixtureRoot);
+    assert.equal(isAbsolute(observed.checkout), true);
+    const isolationRoot = dirname(observed.checkout);
+    assert.match(basename(isolationRoot), /^routekit-foundry-isolated-/u);
+    assert.equal(observed.checkout, join(isolationRoot, "repository"));
+    assert.equal(observed.home, join(isolationRoot, "home"));
+    assert.equal(observed.temporary, join(isolationRoot, "tmp"));
+    for (const event of control.events)
+        assert.deepEqual(event.process, observed);
+    const paths = [observed.checkout, observed.home, observed.temporary, isolationRoot];
+    // Replay's scope has already resolved. Probe only paths recorded by the
+    // fresh fixture; do not scan temporary directories or add cleanup fallbacks.
+    for (const path of paths)
+        await assert.rejects(lstat(path), error => error instanceof Error && "code" in error && error.code === "ENOENT", `runner scope must dispose ${path}`);
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+        try {
+            process.kill(observed.pid, 0);
+        }
+        catch (error) {
+            assert.ok(error instanceof Error && "code" in error);
+            assert.equal(error.code, "ESRCH", "EPERM or arbitrary signal errors do not prove process disposal");
+            return { pid: observed.pid, paths, processCode: error.code, pathCode: "ENOENT" };
+        }
+        await delay(50, undefined, { signal });
+    }
+    assert.fail(`fresh grading worker ${observed.pid} still exists after its runner scope was disposed`);
+}
+test("real repository execution refuses worker death, parent deadlines and bounded output overflow", { timeout: 180000 }, async (t) => {
+    assert.ok(RESOURCE_PARENT_DEADLINE_MS < RESOURCE_BODY_DELAY_MS);
+    assert.ok(RESOURCE_BODY_DELAY_MS < RESOURCE_FRAMEWORK_TIMEOUT_MS);
+    assert.equal(RESOURCE_OUTPUT_CAP_BYTES, 2 * 1024 * 1024);
+    const f = await fixture(t, REPOSITORY_RESOURCE_FILES);
+    const grade = (scenario) => ({
+        ...(scenario.runner === "vitest" ? f.grade(scenario.id) : {
+            id: `grade-${scenario.id}`, kind: "test", cwd: ".", executable: "node",
+            args: ["--test", `test/${scenario.id}.test.mjs`]
+        }),
+        timeoutMs: scenario.kind === "deadline" ? RESOURCE_PARENT_DEADLINE_MS : 20000
+    });
+    const terminated = REPOSITORY_RESOURCE_CASES.find(scenario => scenario.kind === "termination");
+    const stock = f.stock(terminated.id);
+    const native = {
+        ...stock, id: "native-worker-termination", timeoutMs: 20000,
+        // Preserve native fatal IPC diagnostics after actual worker termination.
+        // It is a causal baseline, not a host-recognized semantic grading recipe.
+        args: stock.args.filter(value => !value.startsWith("--outputFile=")).map(value => value === "--reporter=json" ? "--reporter=default" : value)
+    };
+    const replay = (recipes, continueAfterIncompleteGrade = false) => Effect.scoped(Effect.gen(function* () {
+        const cache = process.platform === "darwin" ? yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root, commits: [f.commit], trustedPreparationRecipes: f.preparation
+        }) : undefined;
+        return yield* replayRepositoryCommandsV1({ repositoryRoot: f.root, commit: f.commit,
+            trustedPreparationRecipes: f.preparation, candidateValidationRecipes: f.validation,
+            ...(cache === undefined ? {} : { preparationCache: cache }), recipes, repetitions: 2,
+            continueAfterIncompleteGrade });
+    }));
+    const baseline = await executeRecorded(f, "resource-native-worker", replay([native, f.control(terminated.id)]));
+    // Unlike qualification, this causal diagnostic must inspect cleanup and run
+    // a healthy control after intentionally killing/timing out a worker.
+    const results = await executeRecorded(f, "resource-panel", replay(REPOSITORY_RESOURCE_CASES.flatMap(scenario => [grade(scenario), f.control(scenario.id)]), true));
+    assert.equal(baseline.length, 4);
+    assert.equal(results.length, REPOSITORY_RESOURCE_CASES.length * 4);
+    const disposals = [];
+    const checkoutByRepetition = new Map();
+    for (const repetition of [1, 2]) {
+        const nativeResult = baseline.find(item => item.repetition === repetition && item.recipeId === native.id);
+        const nativeControl = baseline.find(item => item.repetition === repetition && item.recipeId === f.control(terminated.id).id);
+        assert.ok(nativeResult);
+        assert.ok(nativeControl);
+        completed(nativeResult);
+        completed(nativeControl);
+        assert.equal(nativeResult.exitCode, 1);
+        assert.equal(nativeControl.exitCode, 0);
+        assert.equal(nativeResult.testReporter, undefined);
+        assert.equal(`${nativeResult.stdout}\n${nativeResult.stderr}`.includes(reportPrefix), false);
+        const nativeEvents = boundaryControl(nativeControl, f.runId, terminated);
+        const nativeDiagnostic = workerDeathIpcDiagnostic(nativeResult);
+        disposals.push({ mode: "native", repetition, scenario: terminated.id,
+            ...await disposedResourceWorker(nativeEvents, f.root, t.signal) });
+        for (const scenario of REPOSITORY_RESOURCE_CASES) {
+            const result = results.find(item => item.repetition === repetition && item.recipeId === grade(scenario).id);
+            const controlResult = results.find(item => item.repetition === repetition && item.recipeId === f.control(scenario.id).id);
+            assert.ok(result);
+            assert.ok(controlResult);
+            completed(controlResult);
+            assert.equal(controlResult.exitCode, 0);
+            // Actual preparation, validation and body entry must precede any accepted
+            // refusal. Launch/import failures cannot satisfy these resource controls.
+            assert.equal(result.stage, "grade");
+            assert.equal(result.gradeExecuted, true);
+            const preparation = result.preparation?.sharedResults ?? result.trustedPreparationResults;
+            assert.equal(preparation.length, 1);
+            for (const item of preparation)
+                assert.equal(item.exitCode, 0);
+            assert.ok(result.candidateValidationResults.length > 0);
+            for (const item of result.candidateValidationResults)
+                assert.equal(item.exitCode, 0);
+            assert.equal(result.testReporter, scenario.runner === "vitest" ? "vitest-v1" : undefined);
+            const control = boundaryControl(controlResult, f.runId, scenario);
+            const entered = control.events.find(event => event.phase === "body-enter");
+            assert.ok(entered);
+            const previousCheckout = checkoutByRepetition.get(repetition);
+            if (previousCheckout === undefined)
+                checkoutByRepetition.set(repetition, entered.process.checkout);
+            else
+                assert.equal(entered.process.checkout, previousCheckout);
+            assert.notEqual(entered.process.checkout, nativeEvents.events[0].process.checkout, "stock and host controls must not share causal event files");
+            if (scenario.kind === "deadline") {
+                assert.equal(result.timedOut, true, "the repository parent deadline, not Vitest's body timeout, must fire");
+                assert.equal(result.outputTruncated, false);
+                assert.equal(result.exitCode, null);
+                assert.ok(result.durationMs >= RESOURCE_PARENT_DEADLINE_MS);
+                assert.equal(`${result.stdout}\n${result.stderr}`.includes(reportPrefix), false, "the killed finite body must not report normal framework completion");
+            }
+            else if (scenario.kind === "output" && scenario.expected === "unknown") {
+                assert.equal(result.timedOut, false);
+                assert.equal(result.exitCode, 0, "the bounded real Node test must finish normally despite parent output truncation");
+                assert.equal(result.outputTruncated, true, "the actual capture cap must be crossed, not a fabricated flag");
+                assert.ok(scenario.chunks * RESOURCE_OUTPUT_CHUNK_BYTES > RESOURCE_OUTPUT_CAP_BYTES);
+                assert.equal(Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr), RESOURCE_OUTPUT_CAP_BYTES, "the existing runner must retain exactly its bounded combined ASCII output budget");
+            }
+            else {
+                completed(result);
+                assert.equal(result.exitCode, scenario.expected === "pass" ? 0 : 1);
+            }
+            if (scenario.kind === "termination") {
+                // Pinned Tinypool can send teardown after worker IPC closes. Vitest's
+                // fatal rejection handler then exits before the parent emits a frame.
+                // Require this demonstrated native path, not any arbitrary crash.
+                assert.deepEqual(workerDeathIpcDiagnostic(result), nativeDiagnostic);
+                assert.equal(repositoryCommandTestEvidenceV1(result, result.recipeId).detail, "the host-selected Vitest reporter did not emit complete execution evidence");
+            }
+            if (scenario.kind === "output" && scenario.expected === "pass") {
+                assert.ok(scenario.chunks * RESOURCE_OUTPUT_CHUNK_BYTES < RESOURCE_OUTPUT_CAP_BYTES);
+                assert.ok(Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr) < RESOURCE_OUTPUT_CAP_BYTES);
+            }
+            assert.equal(repositoryCommandTestEvidenceV1(result, result.recipeId).outcome, scenario.expected);
+            disposals.push({ mode: "host", repetition, scenario: scenario.id,
+                ...await disposedResourceWorker(control, f.root, t.signal) });
+        }
+    }
+    assert.notEqual(checkoutByRepetition.get(1), checkoutByRepetition.get(2), "repetitions must use separate runner-owned checkouts");
+    await f.record("resource-disposal-results.json", disposals);
+    f.complete();
+});
+test("real pinned Vitest preserves returned-cleanup timeout and registration-stack semantics", { timeout: 180000 }, async (t) => {
+    const f = await fixture(t);
+    const replay = (instrumented) => Effect.scoped(Effect.gen(function* () {
+        const cache = process.platform === "darwin" ? yield* makeRepositoryPreparationCacheV1({
+            repositoryRoot: f.root, commits: [f.commit], trustedPreparationRecipes: f.preparation
+        }) : undefined;
+        return yield* replayRepositoryCommandsV1({ repositoryRoot: f.root, commit: f.commit,
+            trustedPreparationRecipes: f.preparation, candidateValidationRecipes: f.validation,
+            ...(cache === undefined ? {} : { preparationCache: cache }),
+            recipes: VITEST_PHASE_TIMEOUT_CASES.flatMap(scenario => instrumented
+                ? [f.grade(scenario.id), f.control(scenario.id)]
+                : [f.stock(scenario.id), f.stockControl(scenario.id)]),
+            repetitions: 2 });
+    }));
+    // Separate runner-owned checkouts prevent phase files from the stock run
+    // being mistaken for observations from the instrumented run.
+    const baseline = await executeRecorded(f, "timeout-stock", replay(false));
+    const phased = await executeRecorded(f, "timeout-phased", replay(true));
+    assert.equal(baseline.length, VITEST_PHASE_TIMEOUT_CASES.length * 4);
+    assert.equal(phased.length, VITEST_PHASE_TIMEOUT_CASES.length * 4);
+    for (const repetition of [1, 2])
+        for (const scenario of VITEST_PHASE_TIMEOUT_CASES) {
+            const stock = baseline.find(item => item.repetition === repetition && item.recipeId === f.stock(scenario.id).id);
+            const stockControl = baseline.find(item => item.repetition === repetition && item.recipeId === f.stockControl(scenario.id).id);
+            const result = phased.find(item => item.repetition === repetition && item.recipeId === f.grade(scenario.id).id);
+            const controlResult = phased.find(item => item.repetition === repetition && item.recipeId === f.control(scenario.id).id);
+            assert.ok(stock);
+            assert.ok(stockControl);
+            assert.ok(result);
+            assert.ok(controlResult);
+            for (const item of [stock, stockControl, result, controlResult])
+                completed(item);
+            assert.equal(stockControl.exitCode, 0);
+            assert.equal(controlResult.exitCode, 0);
+            assert.equal(stock.testReporter, undefined, "the baseline must not install the host reporter or adapter");
+            assert.equal(`${stock.stdout}\n${stock.stderr}`.includes(reportPrefix), false);
+            assert.equal(stock.exitCode, scenario.expected === "pass" ? 0 : 1, JSON.stringify(stock));
+            const stockReport = oneFrame(stockControl.stdout, stockPrefix);
+            assert.equal(stockReport.runId, f.runId);
+            assert.equal(stockReport.scenario, scenario.id);
+            assert.equal(stockReport.report.success, scenario.expected === "pass");
+            assert.equal(stockReport.report.numTotalTests, 1);
+            assert.equal(stockReport.report.numPassedTests, scenario.expected === "pass" ? 1 : 0);
+            assert.equal(stockReport.report.numFailedTests, scenario.expected === "pass" ? 0 : 1);
+            assert.equal(stockReport.report.testResults.length, 1);
+            const stockFile = stockReport.report.testResults[0];
+            assert.equal(stockFile.status, scenario.expected === "pass" ? "passed" : "failed");
+            assert.equal(stockFile.assertionResults.length, 1);
+            assert.equal(stockFile.assertionResults[0].status, stockFile.status);
+            assert.equal(stockFile.assertionResults[0].failureMessages.length, scenario.expected === "pass" ? 0 : 1);
+            const controls = [stockControl, controlResult].map(item => oneFrame(item.stdout, controlPrefix));
+            const observations = controls.map(control => {
+                assert.equal(control.runId, f.runId);
+                assert.equal(control.scenario, scenario.id);
+                assert.equal(control.customRunnerImported, false);
+                assert.deepEqual(control.events.map(event => event.phase), scenario.events);
+                for (const [sequence, event] of control.events.entries()) {
+                    assert.equal(event.sequence, sequence);
+                    assert.equal(event.runId, f.runId);
+                    assert.equal(event.scenario, scenario.id);
+                }
+                const aborted = control.events.filter(event => event.phase === "hook-cleanup-abort");
+                assert.equal(aborted.length, scenario.expected === "pass" ? 0 : 1);
+                return {
+                    phases: control.events.map(event => event.phase),
+                    aborts: aborted.map(event => {
+                        assert.ok(event.error);
+                        assert.equal(event.error.name, "Error");
+                        assert.ok(event.error.message.startsWith(`Hook timed out in ${scenario.cleanupTimeoutMs}ms.`));
+                        // Compare the original registration location, not checkout-specific
+                        // absolute paths or human-readable console diagnostics.
+                        const registration = event.error.stack.match(/\/test\/register\.mjs:\d+:\d+/u)?.[0];
+                        assert.ok(registration, "the framework's original cleanup registration stack must survive");
+                        return { name: event.error.name, message: event.error.message, registration };
+                    })
+                };
+            });
+            assert.deepEqual(observations[1], observations[0], "instrumentation must preserve the ordinary cleanup lifecycle");
+            const report = oneFrame(`${result.stdout}\n${result.stderr}`, reportPrefix);
+            assert.equal(report.version, 1);
+            assert.equal(report.complete, true, JSON.stringify(report));
+            assert.equal(report.starts, 1);
+            assert.equal(report.ends, 1);
+            assert.equal(report.eventIntegrity, true);
+            assert.deepEqual(report.unhandledErrors, scenario.expected === "pass" ? [] : [
+                { name: "RouteKitVitestPhaseAttributionError", code: "ROUTEKIT_VITEST_PHASE_UNATTRIBUTED" }
+            ]);
+            assert.equal(result.exitCode, scenario.expected === "pass" ? 0 : 1, JSON.stringify(result));
+            assert.equal(repositoryCommandTestEvidenceV1(result, result.recipeId).outcome, scenario.expected);
+        }
+    f.complete();
+});
+test("resolved custom runners, invalid CLI options and unrecognized runtime versions are refused before any worker runs", { timeout: 180000 }, async (t) => {
+    const f = await fixture(t);
+    const cases = ["config-runner", "cli-runner", "unknown-version"];
+    for (const kind of cases) {
+        const base = f.grade("positive");
+        const grade = kind === "cli-runner" ? { ...base, args: [...base.args, "--runner", "./custom-runner.mjs"] } : base;
+        const results = await executeRecorded(f, kind, replayRepositoryCommandsV1({ repositoryRoot: f.root, commit: f.commit,
+            trustedPreparationRecipes: f.preparation,
+            candidateValidationRecipes: kind === "unknown-version" ? [...f.validation, { id: "isolated-version-control",
+                    kind: "check", cwd: ".", executable: "node", args: ["scripts/unsupported-version.mjs"], timeoutMs: 10000 }] : f.validation,
+            fileOverrides: kind === "config-runner" ? [{ path: "vitest.config.mjs", content: 'export default { test: { runner: "./custom-runner.mjs" } };\n' }] : [],
+            recipes: [grade, f.control("positive")], repetitions: 1 }));
+        assert.equal(results.length, 2, `${kind} must run the extraction control after the refusal`);
+        const [result, controlResult] = results;
+        assert.ok(result);
+        assert.ok(controlResult);
+        completed(result);
+        completed(controlResult);
+        assert.equal(controlResult.exitCode, 0);
+        assert.equal(result.exitCode, 1);
+        if (kind === "cli-runner") {
+            // This pinned Vitest exposes custom runners through configuration, not
+            // a CLI flag. Its native argument parser refuses --runner before the
+            // host reporter loads; that is not a host phase-contract frame.
+            assert.equal(`${result.stdout}\n${result.stderr}`.includes(reportPrefix), false);
+            assert.match(result.stderr, /CACError: Unknown option `--runner`/u);
+        }
+        else {
+            const report = oneFrame(`${result.stdout}\n${result.stderr}`, reportPrefix);
+            assert.equal(report.complete, false);
+            assert.equal(report.error, kind === "unknown-version" ? "unsupported-vitest-phase-runtime" : "unsupported-vitest-custom-runner");
+        }
+        const control = oneFrame(controlResult.stdout, controlPrefix);
+        assert.equal(control.runId, f.runId);
+        assert.equal(control.customRunnerImported, false, "custom runner module must never load");
+        assert.deepEqual(control.events, [], "normal test worker must not execute before contract refusal");
+        assert.equal(repositoryCommandTestEvidenceV1(result, result.recipeId).outcome, "unknown");
+    }
+    f.complete();
+});