@zerwiz/ymir 0.1.3 → 0.1.5

package/.agents/tests/fm-test-fixture-cleanup.test.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+# Behavior tests for tests/lib.sh's shared fixture-tempdir helper
+# (fm_test_tmproot / fm_test_cleanup / fm_test_reap_orphans).
+#
+# The near-universal call pattern across this suite is
+# `TMP_ROOT=$(fm_test_tmproot prefix)`, which forks a subshell to capture the
+# function's stdout. These tests spawn real, separate bash processes that use
+# that exact pattern and assert the fixture root is actually gone once the
+# owning process's guarded teardown has run - on a normal exit and on a
+# terminating signal - plus that a stale marked fixture from a killed prior
+# run gets reaped on the next source. Nothing here inspects tests/lib.sh's
+# source text; it only observes filesystem state around the real helper.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+LIB="$ROOT/tests/lib.sh"
+
+test_fixture_root_gone_after_normal_exit() {
+  local child_out child_dir
+  child_out=$(bash -c '
+    # shellcheck source=tests/lib.sh
+    . "'"$LIB"'"
+    d=$(fm_test_tmproot fm-test-cleanup-exit)
+    printf "%s\n" "$d"
+    if [ -d "$d" ]; then printf "mid:present\n"; else printf "mid:missing\n"; fi
+  ')
+  child_dir=$(printf '%s\n' "$child_out" | sed -n '1p')
+  assert_contains "$child_out" "mid:present" \
+    "the fixture root was not present while its owning process was still alive"
+  assert_absent "$child_dir" \
+    "fm_test_tmproot's fixture root survived its owning process's normal exit"
+  pass "fm_test_tmproot cleans up its fixture root on normal exit"
+}
+
+test_fixture_root_gone_after_sigterm() {
+  local harness dirfile child_dir pid tries
+  harness=$(fm_test_tmproot fm-test-cleanup-sigterm-harness)
+  dirfile="$harness/child-dir"
+  bash -c '
+    # shellcheck source=tests/lib.sh
+    . "'"$LIB"'"
+    d=$(fm_test_tmproot fm-test-cleanup-term)
+    printf "%s\n" "$d" > "'"$dirfile"'"
+    while :; do sleep 0.1; done
+  ' &
+  pid=$!
+  tries=0
+  while [ "$tries" -lt 100 ]; do
+    [ -s "$dirfile" ] && break
+    sleep 0.05
+    tries=$((tries + 1))
+  done
+  [ -s "$dirfile" ] || fail "the child never published its fixture root before the wait timed out"
+  child_dir=$(cat "$dirfile")
+  assert_present "$child_dir" "the child's fixture root did not exist before it was signaled"
+  kill -TERM "$pid"
+  wait "$pid" 2>/dev/null
+  assert_absent "$child_dir" \
+    "fm_test_tmproot's fixture root survived SIGTERM to its owning process"
+  pass "fm_test_tmproot cleans up its fixture root on SIGTERM"
+}
+
+test_cleanup_registry_resists_precreation() {
+  local harness shared_tmp victim
+  harness=$(fm_test_tmproot fm-test-cleanup-registry-harness)
+  shared_tmp="$harness/shared-tmp"
+  victim="$harness/victim"
+  mkdir -p "$shared_tmp" "$victim"
+
+  TMPDIR="$shared_tmp" bash -c '
+    printf "%s\n" "$1" > "$TMPDIR/.fm-test-cleanup.$$"
+    . "$2"
+  ' _ "$victim" "$LIB"
+
+  assert_present "$victim" \
+    "a precreated predictable cleanup registry injected an arbitrary deletion target"
+  pass "the cleanup registry cannot be injected through path precreation"
+}
+
+test_fixture_registration_failure_rolls_back_root() {
+  local harness failure_tmp registry_dir output leaked_root
+  harness=$(fm_test_tmproot fm-test-cleanup-registration-harness)
+  failure_tmp="$harness/tmp"
+  registry_dir="$harness/registry-dir"
+  mkdir -p "$failure_tmp" "$registry_dir"
+
+  if output=$(TMPDIR="$failure_tmp" FM_TEST_CLEANUP_REGISTRY="$registry_dir" \
+    fm_test_tmproot fm-test-cleanup-registration-failure 2>/dev/null); then
+    fail "fm_test_tmproot succeeded after its cleanup registry rejected registration"
+  fi
+  [ -z "$output" ] || fail "fm_test_tmproot published an unregistered fixture root"
+  for leaked_root in "$failure_tmp"/fm-test-cleanup-registration-failure.*; do
+    [ ! -e "$leaked_root" ] || fail "fm_test_tmproot leaked a root after registration failed"
+  done
+  pass "failed fixture registration rolls back the new root"
+}
+
+test_orphan_sweep_respects_fixture_ownership() {
+  local harness dirfile active_dir stale_dir fresh_dir pid tries
+  harness=$(fm_test_tmproot fm-test-cleanup-orphan-harness)
+  dirfile="$harness/active-dir"
+  bash -c '
+    # shellcheck source=tests/lib.sh
+    . "'"$LIB"'"
+    d=$(fm_test_tmproot fm-test-cleanup-active)
+    printf "%s\n" "$d" > "'"$dirfile"'"
+    while :; do sleep 0.1; done
+  ' &
+  pid=$!
+  tries=0
+  while [ "$tries" -lt 100 ]; do
+    [ -s "$dirfile" ] && break
+    sleep 0.05
+    tries=$((tries + 1))
+  done
+  [ -s "$dirfile" ] || fail "the active child never published its fixture root before the wait timed out"
+  active_dir=$(cat "$dirfile")
+  touch -t 202001010000 "$active_dir/.fm-test-fixture"
+
+  stale_dir=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-cleanup-stale.XXXXXX")
+  printf '%s\n%s\n' "$$" reused-process-identity > "$stale_dir/.fm-test-fixture"
+  touch -t 202001010000 "$stale_dir/.fm-test-fixture"
+  fresh_dir=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-cleanup-fresh.XXXXXX")
+  : > "$fresh_dir/.fm-test-fixture"
+
+  bash -c '
+    # shellcheck source=tests/lib.sh
+    . "'"$LIB"'"
+  '
+
+  assert_absent "$stale_dir" \
+    "a stale fixture root whose PID was reused by another process was not reaped"
+  assert_present "$active_dir" \
+    "the orphan reaper removed an old fixture root whose owning process was still alive"
+  assert_present "$fresh_dir" \
+    "the orphan reaper removed a fresh marked fixture root it does not own yet"
+  kill -TERM "$pid"
+  wait "$pid" 2>/dev/null
+  assert_absent "$active_dir" \
+    "the active fixture root survived its owning process's teardown"
+  rm -rf "$fresh_dir"
+  pass "the orphan sweep reaps only old fixtures without a live owner"
+}
+
+test_orphan_sweep_reaps_read_only_package_tree() {
+  local stale_dir package_dir
+  stale_dir=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-cleanup-read-only.XXXXXX")
+  package_dir="$stale_dir/packages/extension"
+  mkdir -p "$package_dir"
+  printf '%s\n%s\n' "$$" reused-process-identity > "$stale_dir/.fm-test-fixture"
+  printf 'installed package\n' > "$package_dir/entrypoint.py"
+  chmod -R a-w "$stale_dir/packages"
+  touch -t 202001010000 "$stale_dir/.fm-test-fixture"
+
+  bash -c '
+    # shellcheck source=tests/lib.sh
+    . "$1"
+  ' _ "$LIB"
+
+  assert_absent "$stale_dir" \
+    "the orphan reaper left a stale fixture containing a read-only package tree"
+  pass "the orphan sweep reaps read-only package fixtures"
+}
+
+test_fixture_root_gone_after_normal_exit
+test_fixture_root_gone_after_sigterm
+test_cleanup_registry_resists_precreation
+test_fixture_registration_failure_rolls_back_root
+test_orphan_sweep_respects_fixture_ownership
+test_orphan_sweep_reaps_read_only_package_tree

package/.agents/tests/fm-test-fixtures.test.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+# Behavior tests for tests/fixtures.sh fake-toolchain and spawn-world builders.
+#
+# These cases drive the builders as a test would: they write stubs into a
+# fakebin and exec those stubs. Assertions are on the binaries' observable
+# output, exit status, and files they create - never on fixtures.sh source
+# text. Migrated spawn suites cover fm_test_run_spawn through the real
+# fm-spawn.sh; this file pins the stubs those suites now share.
+set -u
+
+# shellcheck source=tests/fixtures.sh
+. "$(dirname "${BASH_SOURCE[0]}")/fixtures.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-test-fixtures)
+
+test_no_mistakes_version_constant() {
+  local fakebin out
+  fakebin=$(fm_fakebin "$TMP_ROOT/nm")
+  fm_test_fake_no_mistakes "$fakebin"
+  out=$("$fakebin/no-mistakes" --version)
+  [ "$out" = "$FM_TEST_NO_MISTAKES_FAKE_VERSION" ] || \
+    fail "fake no-mistakes --version should be the shared constant, got '$out'"
+  out=$(FM_FAKE_NO_MISTAKES_VERSION="$FM_TEST_NO_MISTAKES_FAKE_VERSION_TS" \
+    "$fakebin/no-mistakes" --version)
+  [ "$out" = "$FM_TEST_NO_MISTAKES_FAKE_VERSION_TS" ] || \
+    fail "timestamped banner override should round-trip, got '$out'"
+  case "$out" in
+    "$FM_TEST_NO_MISTAKES_FAKE_VERSION "*) ;;
+    *) fail "timestamped banner '$out' is not the shared constant plus a suffix" ;;
+  esac
+  out=$(FM_FAKE_NO_MISTAKES_VERSION='no-mistakes version v9.9.9 (fake)' \
+    "$fakebin/no-mistakes" --version)
+  [ "$out" = 'no-mistakes version v9.9.9 (fake)' ] || \
+    fail "FM_FAKE_NO_MISTAKES_VERSION should override the default banner, got '$out'"
+  "$fakebin/no-mistakes" doctor
+  expect_code 0 $? "fake no-mistakes non-version verbs should exit 0"
+  pass "fake no-mistakes --version is the shared constant and overridable"
+}
+
+test_no_mistakes_init_doctor_markers() {
+  local fakebin dir rc
+  dir="$TMP_ROOT/nm-init"
+  mkdir -p "$dir"
+  fakebin=$(fm_fakebin "$dir")
+  fm_test_fake_no_mistakes_init_doctor "$fakebin"
+  ( cd "$dir" && "$fakebin/no-mistakes" init )
+  assert_present "$dir/.no-mistakes-init" "init did not touch the marker"
+  ( cd "$dir" && "$fakebin/no-mistakes" doctor )
+  assert_present "$dir/.no-mistakes-doctor" "doctor did not touch the marker"
+  rc=0
+  ( cd "$dir" && "$fakebin/no-mistakes" axi ) || rc=$?
+  expect_code 2 "$rc" "unknown no-mistakes verb should exit 2"
+  pass "init/doctor no-mistakes stub touches markers and refuses other verbs"
+}
+
+test_fake_gh_and_gh_axi() {
+  local fakebin out
+  fakebin=$(fm_fakebin "$TMP_ROOT/gh")
+  fm_test_fake_gh "$fakebin"
+  fm_test_fake_gh_axi "$fakebin"
+  "$fakebin/gh" auth status
+  expect_code 0 $? "fake gh auth status should succeed"
+  "$fakebin/gh" pr list
+  expect_code 0 $? "fake gh other verbs should exit 0"
+  out=$("$fakebin/gh-axi" --version)
+  [ "$out" = "$FM_TEST_GH_AXI_VERSION" ] || \
+    fail "fake gh-axi --version should be $FM_TEST_GH_AXI_VERSION, got '$out'"
+  out=$(FM_FAKE_GH_AXI_VERSION=0.9.9 "$fakebin/gh-axi" --version)
+  [ "$out" = 0.9.9 ] || fail "FM_FAKE_GH_AXI_VERSION should override, got '$out'"
+  pass "fake gh authenticates and fake gh-axi reports the shared version"
+}
+
+test_spawn_tmux_and_fakebin() {
+  local fakebin out log
+  fakebin=$(make_spawn_fakebin "$TMP_ROOT/spawn" gh-axi)
+  log="$TMP_ROOT/spawn/launch.log"
+  : > "$log"
+  out=$(FM_FAKE_PANE_PATH=/tmp/wt "$fakebin/tmux" display-message -p '#{pane_current_path}')
+  [ "$out" = /tmp/wt ] || fail "spawn tmux pane path should be FM_FAKE_PANE_PATH, got '$out'"
+  out=$(unset FM_FAKE_PANE_PATH; "$fakebin/tmux" display-message -p '#{pane_current_path}')
+  [ -z "$out" ] || fail "spawn tmux pane path should default to empty, got '$out'"
+  out=$("$fakebin/tmux" display-message -p '#S')
+  [ "$out" = firstmate ] || fail "spawn tmux session name should be firstmate, got '$out'"
+  FM_FAKE_LAUNCH_LOG="$log" "$fakebin/tmux" send-keys -t @w -l 'codex --yolo'
+  assert_grep 'codex --yolo' "$log" "send-keys -l payload was not logged"
+  [ -x "$fakebin/treehouse" ] || fail "spawn fakebin should include treehouse"
+  [ -x "$fakebin/gh-axi" ] || fail "extra exit-0 tools should land in the spawn fakebin"
+  "$fakebin/treehouse" get
+  expect_code 0 $? "fake treehouse should exit 0"
+  pass "spawn fakebin answers pane path, logs -l payloads, and installs extra tools"
+}
+
+test_send_stubs_and_ssh() {
+  local fakebin log ssh_log out
+  fakebin=$(make_stubs "$TMP_ROOT/send")
+  log="$TMP_ROOT/send/send.log"
+  ssh_log="$TMP_ROOT/send/ssh.log"
+  : > "$log"
+  fm_test_fake_ssh "$fakebin"
+  FM_SEND_LOG="$log" "$fakebin/tmux" send-keys -t sess:w -l 'hello steer'
+  assert_grep 'hello steer' "$log" "send stubs did not log the -l payload"
+  out=$("$fakebin/tmux" display-message -p '#{cursor_y}')
+  [ "$out" = 1 ] || fail "send tmux cursor_y should be 1, got '$out'"
+  out=$("$fakebin/tmux" capture-pane -p)
+  case "$out" in
+    *'╭────╮'*) ;;
+    *) fail "send tmux capture-pane should render an empty composer, got '$out'" ;;
+  esac
+  printf 'ignored\n' | FM_SSH_LOG="$ssh_log" "$fakebin/fake-ssh" host -- cmd
+  assert_grep 'host -- cmd' "$ssh_log" "fake ssh did not record argv"
+  FM_FAKE_SSH_RC=7 "$fakebin/fake-ssh" x < /dev/null
+  expect_code 7 $? "fake ssh should honor FM_FAKE_SSH_RC"
+  pass "send stubs log typed text and fake ssh records argv with a controllable exit"
+}
+
+test_spawn_home_layout() {
+  local home="$TMP_ROOT/home"
+  fm_test_spawn_home "$home" claude
+  fm_test_spawn_brief "$home" t1 'do the thing'
+  assert_present "$home/data" "spawn home missing data/"
+  assert_present "$home/state/.last-watcher-beat" "spawn home missing watcher beat"
+  assert_grep claude "$home/config/crew-harness" "crew-harness was not pinned"
+  assert_grep 'do the thing' "$home/data/t1/brief.md" "brief text was not written"
+  pass "spawn-home layout writes harness pin, beat, and brief"
+}
+
+test_no_mistakes_version_constant
+test_no_mistakes_init_doctor_markers
+test_fake_gh_and_gh_axi
+test_spawn_tmux_and_fakebin
+test_send_stubs_and_ssh
+test_spawn_home_layout

package/.agents/tests/fm-test-isolation-proof.test.sh

@@ -0,0 +1,278 @@
+#!/usr/bin/env bash
+# Behavioral tests for the isolation-proof and test-run public interfaces.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+PROOF="$ROOT/bin/fm-test-isolation-proof.sh"
+RUNNER="$ROOT/bin/fm-test-run.sh"
+
+assert_present "$PROOF" "bin/fm-test-isolation-proof.sh is missing"
+[ -x "$PROOF" ] || fail "bin/fm-test-isolation-proof.sh must be executable"
+
+test_unknown_pool_is_refused() {
+  local tmp rc
+  tmp=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-isolation-proof-pool.XXXXXX")
+  set +e
+  "$PROOF" --pool unknown-family --list >"$tmp/out" 2>"$tmp/err"
+  rc=$?
+  set -e
+  [ "$rc" -eq 2 ] || fail "unknown --pool must be refused with exit 2, got $rc"
+  [ ! -s "$tmp/out" ] || fail "unknown --pool unexpectedly listed candidates: $(cat "$tmp/out")"
+  rm -rf "$tmp"
+  pass "unknown candidate pools are refused"
+}
+
+test_family_pool_json_identifies_admission() {
+  local tmp repo proof json admitted_json capped_json skipped_json rc
+  tmp=$(mktemp -d "${TMPDIR:-/tmp}/fm-test-isolation-proof-json.XXXXXX")
+  repo="$tmp/repo"
+  proof="$repo/bin/fm-test-isolation-proof.sh"
+  json="$tmp/proof.json"
+  admitted_json="$tmp/admitted-proof.json"
+  capped_json="$tmp/capped-proof.json"
+  skipped_json="$tmp/skipped-proof.json"
+  mkdir -p "$repo/bin" "$repo/tests"
+  cp "$PROOF" "$proof"
+  cat >"$repo/bin/fm-test-run.sh" <<'SH'
+#!/usr/bin/env bash
+if { [ "$1" = --list ] || [ "$1" = --list-scheduled ]; } && [ "$2" = --family ]; then
+  case "$3" in
+    fixture-family)
+      printf '%s\n' tests/fm-proof-fixture-a.test.sh tests/fm-proof-fixture-b.test.sh
+      exit 0
+      ;;
+    admitted-family)
+      printf '%s\n' tests/fm-proof-slow.test.sh tests/fm-proof-fast.test.sh tests/fm-proof-replacement.test.sh
+      exit 0
+      ;;
+    skipped-family)
+      printf '%s\n' tests/fm-proof-skipped.test.sh
+      exit 0
+      ;;
+  esac
+fi
+if [ "$1" = --list-concurrent-safe-families ]; then
+  printf '%s\n' admitted-family skipped-family
+  exit 0
+fi
+if [ "$1" = --concurrent-safe-family-jobs-max ]; then
+  case "$2" in
+    admitted-family|skipped-family)
+      printf '2\n'
+      exit 0
+      ;;
+  esac
+fi
+exit 2
+SH
+  for fixture in fm-proof-fixture-a.test.sh fm-proof-fixture-b.test.sh; do
+    cat >"$repo/tests/$fixture" <<'SH'
+#!/usr/bin/env bash
+echo "ok - proof fixture"
+SH
+    chmod +x "$repo/tests/$fixture"
+  done
+  cat >"$repo/tests/fm-proof-slow.test.sh" <<'SH'
+#!/usr/bin/env bash
+waited=0
+while [ ! -e "$PROOF_SCHED_EVIDENCE/replacement-started" ] && [ "$waited" -lt 200 ]; do
+  sleep 0.05
+  waited=$((waited + 1))
+done
+touch "$PROOF_SCHED_EVIDENCE/slow-done"
+echo "ok - slow proof fixture"
+SH
+  cat >"$repo/tests/fm-proof-fast.test.sh" <<'SH'
+#!/usr/bin/env bash
+echo "ok - fast proof fixture"
+SH
+  cat >"$repo/tests/fm-proof-replacement.test.sh" <<'SH'
+#!/usr/bin/env bash
+if [ -e "$PROOF_SCHED_EVIDENCE/slow-done" ]; then
+  echo "not ok - proof scheduler waited for oldest worker"
+  exit 1
+fi
+touch "$PROOF_SCHED_EVIDENCE/replacement-started"
+echo "ok - replacement proof fixture"
+SH
+  cat >"$repo/tests/fm-proof-skipped.test.sh" <<'SH'
+#!/usr/bin/env bash
+echo
+echo "skip: herdr not found"
+SH
+  chmod +x "$proof" "$repo/bin/fm-test-run.sh" "$repo/tests/fm-proof-"*.test.sh
+  set +e
+  "$proof" --pool fixture-family --jobs 1 --json "$json" >"$tmp/out" 2>"$tmp/err"
+  rc=$?
+  set -e
+  [ "$rc" -eq 0 ] || fail "family pool proof fixture failed: $(cat "$tmp/out") $(cat "$tmp/err")"
+  python3 -c '
+import json, sys
+artifact = json.load(open(sys.argv[1], encoding="utf-8"))
+assert artifact["kind"] == "isolation-proof"
+assert artifact["pool"] == "fixture-family"
+assert artifact["fm_test_run_jobs_enabled"] is False
+assert artifact["production_sharding_enabled"] is False
+assert artifact["summary"]["total"] == 2
+assert artifact["summary"]["failed"] == 0
+' "$json" || fail "serial family pool artifact metadata is incorrect"
+  set +e
+  PROOF_SCHED_EVIDENCE="$tmp" "$proof" --pool admitted-family --jobs 2 --json "$admitted_json" >"$tmp/admitted.out" 2>"$tmp/admitted.err"
+  rc=$?
+  set -e
+  [ "$rc" -eq 0 ] || fail "admitted family proof fixture failed: $(cat "$tmp/admitted.out") $(cat "$tmp/admitted.err")"
+  python3 -c '
+import json, sys
+artifact = json.load(open(sys.argv[1], encoding="utf-8"))
+assert artifact["pool"] == "admitted-family"
+assert artifact["concurrency"] == 2
+assert artifact["fm_test_run_jobs_enabled"] is True
+assert artifact["summary"]["total"] == 3
+assert artifact["summary"]["failed"] == 0
+' "$admitted_json" || fail "admitted family pool artifact metadata is incorrect"
+  mkdir "$tmp/capped-evidence"
+  set +e
+  PROOF_SCHED_EVIDENCE="$tmp/capped-evidence" "$proof" --pool admitted-family --jobs 3 --json "$capped_json" >"$tmp/capped.out" 2>"$tmp/capped.err"
+  rc=$?
+  set -e
+  [ "$rc" -eq 0 ] || fail "over-cap family proof fixture failed: $(cat "$tmp/capped.out") $(cat "$tmp/capped.err")"
+  python3 -c '
+import json, sys
+artifact = json.load(open(sys.argv[1], encoding="utf-8"))
+assert artifact["pool"] == "admitted-family"
+assert artifact["concurrency"] == 3
+assert artifact["fm_test_run_jobs_enabled"] is False
+assert artifact["summary"]["failed"] == 0
+' "$capped_json" || fail "over-cap family pool artifact metadata is incorrect"
+  set +e
+  "$proof" --pool skipped-family --jobs 2 --json "$skipped_json" >"$tmp/skipped.out" 2>"$tmp/skipped.err"
+  rc=$?
+  set -e
+  [ "$rc" -eq 1 ] || fail "gate-skipped family proof must fail, got $rc"
+  grep -Fq 'pool skipped-family candidate gate-skipped' "$tmp/skipped.err" \
+    || fail "gate-skipped proof did not name its pool: $(cat "$tmp/skipped.err")"
+  grep -Fq 'tests/fm-proof-skipped.test.sh: skip: herdr not found' "$tmp/skipped.err" \
+    || fail "gate-skipped proof did not name its candidate and prerequisite: $(cat "$tmp/skipped.err")"
+  python3 -c '
+import json, sys
+artifact = json.load(open(sys.argv[1], encoding="utf-8"))
+assert artifact["pool"] == "skipped-family"
+assert artifact["fm_test_run_jobs_enabled"] is False
+assert artifact["summary"]["total"] == 1
+assert artifact["summary"]["failed"] == 1
+assert artifact["scripts"][0]["exit"] == 1
+' "$skipped_json" || fail "gate-skipped family artifact was admitted"
+  rm -rf "$tmp"
+  pass "family pool JSON scopes jobs admission to proven concurrency"
+}
+
+test_list_candidates_nonempty_and_stable() {
+  local listed count sorted
+  listed=$("$PROOF" --list)
+  [ -n "$listed" ] || fail "--list printed nothing"
+  count=$(printf '%s\n' "$listed" | wc -l | tr -d ' ')
+  [ "$count" -ge 10 ] || fail "expected a bounded non-trivial candidate set, got $count"
+  sorted=$(printf '%s\n' "$listed" | LC_ALL=C sort)
+  [ "$listed" = "$sorted" ] || fail "--list must be sorted for a stable matrix"
+  [ "$(printf '%s\n' "$listed" | uniq | wc -l | tr -d ' ')" = "$count" ] \
+    || fail "--list must not duplicate candidates"
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    case "$line" in
+      tests/*.test.sh) [ -f "$ROOT/$line" ] || fail "listed missing script: $line" ;;
+      *) fail "non-test candidate path: $line" ;;
+    esac
+  done <<<"$listed"
+  pass "candidate --list is non-empty, sorted, unique, and real"
+}
+
+test_candidates_exclude_serial_classes() {
+  local listed
+  listed=$("$PROOF" --list)
+  for banned in \
+    tests/fm-test-isolation-proof.test.sh \
+    tests/fm-backend-tmux-smoke.test.sh \
+    tests/fm-watcher-lock.test.sh \
+    tests/fm-wake-queue.test.sh \
+    tests/fm-backend-herdr-smoke.test.sh \
+    tests/fm-afk-inject-e2e.test.sh \
+    tests/fm-pi-primary-live-e2e.test.sh \
+    tests/fm-pr-check-security.test.sh \
+    tests/fm-backend-cmux-smoke.test.sh; do
+    printf '%s\n' "$listed" | grep -Fxq "$banned" \
+      && fail "serial-class script must not be a parallel candidate: $banned"
+  done
+  pass "serial classes remain excluded from the parallel candidate set"
+}
+
+test_extra_hermetic_candidates_present() {
+  local listed
+  listed=$("$PROOF" --list)
+  for want in \
+    tests/fm-backend-herdr.test.sh \
+    tests/fm-send-strict.test.sh \
+    tests/fm-spawn-batch.test.sh \
+    tests/fm-pr-merge.test.sh \
+    tests/fm-review-diff.test.sh \
+    tests/fm-x-mode.test.sh; do
+    printf '%s\n' "$listed" | grep -Fxq "$want" \
+      || fail "extra hermetic candidate missing: $want"
+  done
+  pass "audited fake-backend and stub-network extras are candidates"
+}
+
+test_list_exclusions_documents_reasons() {
+  local out
+  out=$("$PROOF" --list-exclusions)
+  [ -n "$out" ] || fail "--list-exclusions printed nothing"
+  printf '%s\n' "$out" | grep -Fq 'fm-watcher-lock.test.sh' \
+    || fail "exclusions must document watcher-lock serial reason"
+  printf '%s\n' "$out" | grep -Fq 'fm-backend-herdr-smoke.test.sh' \
+    || fail "exclusions must document real-herdr serial reason"
+  pass "exclusion list documents serial reasons"
+}
+
+test_family_map_labels_this_contract() {
+  local fam safe safe_max scheduled_first
+  fam=$("$RUNNER" --list --family pure-contract-unit)
+  printf '%s\n' "$fam" | grep -Fq 'tests/fm-test-isolation-proof.test.sh' \
+    || fail "fm-test-isolation-proof.test.sh must map to pure-contract-unit"
+  safe=$("$RUNNER" --list-concurrent-safe-families)
+  printf '%s\n' "$safe" | grep -Fxq watcher-wake-lock \
+    || fail "runner must expose the admitted watcher concurrent-safe family"
+  printf '%s\n' "$safe" | grep -Fxq pure-contract-unit \
+    || fail "runner must expose the admitted contract-unit concurrent-safe family"
+  safe_max=$("$RUNNER" --concurrent-safe-family-jobs-max watcher-wake-lock)
+  [ "$safe_max" -eq 4 ] || fail "runner exposed the wrong watcher family worker cap: $safe_max"
+  safe_max=$("$RUNNER" --concurrent-safe-family-jobs-max pure-contract-unit)
+  [ "$safe_max" -eq 4 ] || fail "runner exposed the wrong contract-unit family worker cap: $safe_max"
+  scheduled_first=$("$RUNNER" --list-scheduled --family watcher-wake-lock | head -n 1)
+  [ "$scheduled_first" = tests/fm-watch-triage.test.sh ] \
+    || fail "runner scheduled the watcher family out of longest-hint order: $scheduled_first"
+  pass "isolation-proof contract test is family-mapped"
+}
+
+test_parallel_shards_consume_the_proven_set() {
+  local proven shards
+  proven=$("$PROOF" --list | LC_ALL=C sort -u)
+  shards=$(
+    {
+      "$RUNNER" --list --lane portable-parallel-1
+      "$RUNNER" --list --lane portable-parallel-2
+    } | LC_ALL=C sort -u
+  )
+  [ "$proven" = "$shards" ] \
+    || fail "portable parallel shards must equal isolation-proof --list exactly"
+  pass "parallel shards consume the proven-isolated set only"
+}
+
+test_unknown_pool_is_refused
+test_family_pool_json_identifies_admission
+test_list_candidates_nonempty_and_stable
+test_candidates_exclude_serial_classes
+test_extra_hermetic_candidates_present
+test_list_exclusions_documents_reasons
+test_family_map_labels_this_contract
+test_parallel_shards_consume_the_proven_set