cabloy 5.1.230 → 5.1.232

package/.cabloy-version

@@ -1 +1 @@
-5.1.230
+5.1.232

package/.github/workflows/playwright-e2e.yml

@@ -98,7 +98,8 @@ jobs:
         if: runner.os != 'Linux'
         run: npx playwright install chromium
       - name: run focused managed E2E regression gate
-        run: node --test zova/packages-utils/zova-vite/test/configUtils.test.ts scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/generateOpenapiIsolated.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts scripts/testBrowserGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/processWorker.test.ts vona/src/suite-vendor/a-vona/modules/a-static/test/middlewareSystem.static.test.ts vona/src/suite-vendor/a-vona/modules/a-metrics/test/middlewareSystem.health.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/test/middlewareSystem.httpLog.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/src/lib/redactIsolatedReadyHeader.test.ts repo-e2e/scripts/managedTest.test.ts repo-e2e/scripts/managedTestImports.test.ts repo-e2e/scripts/e2e.test.ts repo-e2e/scripts/runE2eArgs.test.ts repo-e2e/scripts/runE2e.test.ts
+        # Bound concurrent PowerShell/Add-Type cold starts on Windows runners.
+        run: node --test ${{ runner.os == 'Windows' && '--test-concurrency=2' || '' }} zova/packages-utils/zova-vite/test/configUtils.test.ts scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/generateOpenapiIsolated.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts scripts/testBrowserGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/processWorker.test.ts vona/src/suite-vendor/a-vona/modules/a-static/test/middlewareSystem.static.test.ts vona/src/suite-vendor/a-vona/modules/a-metrics/test/middlewareSystem.health.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/test/middlewareSystem.httpLog.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/src/lib/redactIsolatedReadyHeader.test.ts repo-e2e/scripts/managedTest.test.ts repo-e2e/scripts/managedTestImports.test.ts repo-e2e/scripts/e2e.test.ts repo-e2e/scripts/runE2eArgs.test.ts repo-e2e/scripts/runE2e.test.ts
       - name: run Basic E2E baseline
         run: npm run test:e2e -- cabloy-basic home-user-account
       - name: upload Playwright artifacts
@@ -206,7 +207,8 @@ jobs:
         if: runner.os != 'Linux'
         run: npx playwright install chromium
       - name: run focused managed E2E regression gate
-        run: node --test zova/packages-utils/zova-vite/test/configUtils.test.ts scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/generateOpenapiIsolated.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts scripts/testBrowserGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/processWorker.test.ts vona/src/suite-vendor/a-vona/modules/a-static/test/middlewareSystem.static.test.ts vona/src/suite-vendor/a-vona/modules/a-metrics/test/middlewareSystem.health.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/test/middlewareSystem.httpLog.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/src/lib/redactIsolatedReadyHeader.test.ts repo-e2e/scripts/managedTest.test.ts repo-e2e/scripts/managedTestImports.test.ts repo-e2e/scripts/e2e.test.ts repo-e2e/scripts/runE2eArgs.test.ts repo-e2e/scripts/runE2e.test.ts
+        # Bound concurrent PowerShell/Add-Type cold starts on Windows runners.
+        run: node --test ${{ runner.os == 'Windows' && '--test-concurrency=2' || '' }} zova/packages-utils/zova-vite/test/configUtils.test.ts scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/generateOpenapiIsolated.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts scripts/testBrowserGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/processWorker.test.ts vona/src/suite-vendor/a-vona/modules/a-static/test/middlewareSystem.static.test.ts vona/src/suite-vendor/a-vona/modules/a-metrics/test/middlewareSystem.health.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/test/middlewareSystem.httpLog.test.ts vona/src/suite-vendor/a-vona/modules/a-logger/src/lib/redactIsolatedReadyHeader.test.ts repo-e2e/scripts/managedTest.test.ts repo-e2e/scripts/managedTestImports.test.ts repo-e2e/scripts/e2e.test.ts repo-e2e/scripts/runE2eArgs.test.ts repo-e2e/scripts/runE2e.test.ts
       - name: run Commerce cart model regression
         run: node --test zova/src/suite/a-commerce/modules/commerce-trade/test/lib/cartModel.test.ts
       - name: build Commerce Zova artifacts

package/.github/workflows/vona-test-sqlite3.yml

@@ -93,7 +93,8 @@ jobs:
       - name: init
         run: npm run init
       - name: run isolated test infrastructure gate
-        run: node --test scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts vona/packages-cli/cli-set-api/test/binTestPatterns.test.ts
+        # Bound concurrent PowerShell/Add-Type cold starts on Windows runners.
+        run: node --test ${{ runner.os == 'Windows' && '--test-concurrency=2' || '' }} scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts vona/packages-cli/cli-set-api/test/binTestPatterns.test.ts
       - name: run A-Pay focused gate
         run: npm run test -- test-pay/test/paymentSession.test.ts test-pay/test/payMock.test.ts test-pay/test/paypalProvider.test.ts test-pay/test/paypalLifecycle.test.ts test-pay/test/stripeProvider.test.ts test-pay/test/stripeLifecycle.test.ts test-pay/test/outbox.test.ts test-pay/test/webhook.test.ts
         working-directory: vona

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 5.1.232
+
+### Improvements
+
+- Refresh the Zova lockfile after preparing the compensation rerun.
+- Update the Vona zova-core patch for v5.1.94.
+
+## 5.1.231
+
+### Features
+
+- Add commerce functionality.
+- Add formatting support.
+- Apply feature updates.
+
+### Bug Fixes
+
+- Fix Windows tests.
+- Patch Zod integration.
+
+### Improvements
+
+- Update the controller implementation.
+
 ## 5.1.230
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.230",
+  "version": "5.1.232",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-docs/backend/model-guide.md

@@ -29,6 +29,7 @@ Representative pattern:
 
 ```typescript
 import { BeanModelBase, Model } from 'vona-module-a-orm';
+
 import { EntityStudent } from '../entity/student.ts';
 
 @Model({ entity: EntityStudent })

package/repo-docs/backend/websocket-usage-guide.md

@@ -63,6 +63,7 @@ Representative structure:
 
 ```typescript
 import type { IDecoratorSocketNamespaceOptions } from 'vona-module-a-socket';
+
 import { BeanSocketNamespaceBase, SocketNamespace } from 'vona-module-a-socket';
 
 declare module 'vona-module-a-socket' {
@@ -242,6 +243,7 @@ import type {
   ISocketConnectionExecute,
 } from 'vona-module-a-socket';
 import type { WebSocket } from 'ws';
+
 import { BeanBase } from 'vona';
 import { SocketConnection } from 'vona-module-a-socket';
 
@@ -284,6 +286,7 @@ Representative generated shape:
 import type { Next } from 'vona';
 import type { IDecoratorSocketPacketOptions, ISocketPacketExecute } from 'vona-module-a-socket';
 import type { WebSocket } from 'ws';
+
 import { BeanBase } from 'vona';
 import { SocketPacket } from 'vona-module-a-socket';
 

package/repo-docs/frontend/controller-boundary-guide.md

@@ -88,8 +88,8 @@ static $componentOptions: IComponentOptions = {
 Application configuration supplies the shared renderer contract:
 
 ```ts
-import type { ZovaContext } from 'zova';
 import type { VNodeChild } from 'vue';
+import type { ZovaContext } from 'zova';
 
 config.boundary = {
   loading: {

package/repo-docs/frontend/ioc-and-beans.md

@@ -138,9 +138,10 @@ In practice, Zova can still preserve the ergonomic class-based development exper
 Use a getter when injection arguments must be prepared dynamically. The getter must explicitly identify the target bean with `beanFullName`; `usePrepareArg(...)` supplies initialization arguments only and does not resolve the target bean.
 
 ```typescript
-import { Use, usePrepareArg } from 'zova';
 import type { ServiceSsrLayout } from 'zova-module-home-base';
 
+import { Use, usePrepareArg } from 'zova';
+
 class ControllerLayout {
   @Use({ beanFullName: 'home-base.service.ssrLayout' })
   get $$serviceSsrLayout(): ServiceSsrLayout {

package/repo-docs/frontend/modules-and-suites.md

@@ -115,6 +115,7 @@ and `.jsx` for a `.tsx` target:
 
 ```ts
 import type { ModelStudent } from '../model/student.js';
+
 import { RenderCard } from './render.card.jsx';
 ```
 

package/repo-docs/reference/repo-scripts.md

@@ -70,6 +70,8 @@ Use the root commands to select the workspace scope:
 
 Explicit native and legacy checks use `--noEmit --incremental false`: Zova selects `tsconfig.vue-tsc.json`, and Vona selects `tsconfig.json`. Vona's daily config has no `include` or project `references`; default source discovery is filtered by `exclude`, following Zova's approach. Backend/application/module source and module tests are checked together in one program. CLI tooling, package-directory roots, dependencies, distribution output, and generated runtime/REST directories are excluded from initial discovery. Exclusions are not import barriers: required framework/package source and hidden module metadata still participate through imports. Unreferenced hidden helpers and generated `.vona` bootstraps are not independent daily-check roots.
 
+Choose the narrowest **supported, semantically appropriate checking project**, not simply the nearest module `tsconfig.json`. Prefer the active repository's root/workspace source-check entrypoints; a module publication/declaration configuration is not automatically a standalone application check. Before using a custom local invocation or interpreting configuration-related diagnostics, inspect the selected configuration's `extends` chain and effective compiler options, and confirm whether dependencies resolve to source or declarations. Dependency source imported into the consuming program is checked under that program's compiler options; the dependency package's own `tsconfig.json` is not automatically applied. Distinguish an unsuitable invocation/configuration from a business-source type error, and do not change import suffixes or relax compiler options merely to make that invocation pass. Keep daily application checks separate from publication/declaration validation, and verify the actual entrypoints in Cabloy Start rather than assuming all Basic aliases apply.
+
 Root `npm run tsc` runs `tsc:zova`, then `tsc:vona`; these are the only root `tsc` entrypoints. Compiler selection remains in the nested workspaces: use `pnpm --dir zova run tsc:legacy` or `pnpm --dir vona run tsc:legacy` for comparison or fallback, and the corresponding workspace `tsc:native` scripts for explicit native checks. The former `tsc:force`, `tsc:vona:native:force`, and nested Vona `tsc:native:force` aliases have been removed: these source checks neither run a project build nor emit declarations/build-info files. Each module's existing publication scripts remain responsible for its declaration output; there is no separate root declaration-validation workflow.
 
 In both nested workspaces, `npm run tsc` delegates to `npm run tsc:native`. Native and legacy checks first run `npm run prerun`, then invoke the selected compiler with incremental caching disabled. Root workspace aliases delegate to these scripts too, so dependency and generated metadata preparation is not bypassed. Each workspace's `prerun` runs only its `:tools:deps` command; it does not call `tsc`, avoiding recursive script execution. Preparation may refresh generated metadata or dependency manifests and install changed dependencies, while the compiler step itself emits no declarations or build-info files.

package/vona/env/.env

@@ -94,6 +94,7 @@ HOME_USER_BUILTIN_ROLE_SYSTEM_ADMIN_SITE_IDS = *
 
 # auth
 
+AUTH_USEMOCKFORDEV = true
 AUTH_GITHUB_CLIENTID =
 AUTH_GITHUB_CLIENTSECRET =
 

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.170",
+  "version": "1.1.171",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.168",
+  "version": "1.1.169",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-utils/zod-query/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabloy/zod-query",
-  "version": "2.1.13",
+  "version": "2.1.14",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "zod-query",
   "keywords": [

package/vona/packages-utils/zod-query/src/lib/query.ts

@@ -10,13 +10,16 @@ interface IParsePayload {
 }
 
 let ZodMetadata: any;
-export function setParseAdapter(zodMetadata: any) {
+let shouldAdapt: (() => boolean) | undefined;
+export function setParseAdapter(zodMetadata: any, policy?: () => boolean) {
   ZodMetadata = zodMetadata;
+  shouldAdapt = policy;
   (z.core as any).setParseAdapter(__parseAdapter);
 }
 
 function __parseAdapter(inst: z.ZodType, parse) {
   return (payload: IParsePayload, _) => {
+    if (shouldAdapt?.() === false) return parse(payload, _);
     const type = inst.type;
     switch (type) {
       case 'string':

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.116",
+  "version": "5.1.117",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.50",
+  "version": "5.1.51",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/bean/type.ts

@@ -7,9 +7,9 @@ import type { TypeErrorsInternal } from './resource/error/errorInternal.ts';
 export interface IBeanRecordGlobal {}
 export interface IBeanRecordGeneral {}
 export type TypeBeanRecordGeneralSelector<SCENE extends keyof IBeanSceneRecord> = {
-  [K in keyof IBeanRecordGeneral as K extends `${string}.${SCENE}.${string}`
-    ? K
-    : never]: IBeanRecordGeneral[K];
+  [
+    K in keyof IBeanRecordGeneral as K extends `${string}.${SCENE}.${string}` ? K : never
+  ]: IBeanRecordGeneral[K];
 };
 export type TypeBeanRecordGeneralSelectorKeys<SCENE extends keyof IBeanSceneRecord> =
   keyof TypeBeanRecordGeneralSelector<SCENE>;

package/vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts

@@ -1,6 +1,8 @@
 import '@cabloy/json5';
+import type { Socket } from 'node:net';
+
 import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import {
   chmodSync,
   lstatSync,
@@ -11,6 +13,7 @@ import {
   rmSync,
   symlinkSync,
 } from 'node:fs';
+import { createServer } from 'node:http';
 import { hostname, tmpdir } from 'node:os';
 import path from 'node:path';
 import { test } from 'node:test';
@@ -363,6 +366,296 @@ test('broker serializes simultaneous updates and acknowledges durable intent bef
   }
 });
 
+test('broker reports safe failure phases without acknowledging invalid or unreadable claims', async () => {
+  const f = fixture();
+  let broker: Awaited<ReturnType<typeof startTestClaimBroker>> | undefined;
+  try {
+    const { claimPath } = await createTestClaim(f.projectPath, runId, 'unit', owner);
+    broker = await startTestClaimBroker(claimPath);
+    const env = transportEnv(broker.env);
+    const before = await readTestClaimFile(claimPath);
+    await assert.rejects(
+      sendTestClaimEvent(env, { type: 'status', status: 'SECRET_INVALID_STATUS' as any }),
+      { message: 'Managed test allocation registration failed (HTTP 409, validate)' },
+    );
+    assert.equal(await readTestClaimFile(claimPath), before);
+    await assert.rejects(
+      sendTestClaimEvent(
+        { ...env, VONA_TEST_CLAIM_TOKEN: '0'.repeat(64) },
+        { type: 'status', status: 'running' },
+      ),
+      { message: 'Managed test allocation registration failed (HTTP 403)' },
+    );
+    rmSync(claimPath);
+    await assert.rejects(sendTestClaimEvent(env, { type: 'status', status: 'running' }), {
+      message:
+        /^Managed test allocation registration failed \(HTTP 409, read, ENOENT(?:, native [23])?\)$/,
+    });
+  } finally {
+    await broker?.close();
+    f.dispose();
+  }
+});
+
+test(
+  'registration uses fresh connections after a blocked startup without replaying events',
+  { timeout: 45000 },
+  async () => {
+    const requests: {
+      connection: string | undefined;
+      authorization: string | undefined;
+      event: unknown;
+      socket: Socket;
+    }[] = [];
+    const server = createServer(async (req, res) => {
+      let body = '';
+      for await (const chunk of req) body += chunk.toString();
+      requests.push({
+        connection: req.headers.connection,
+        authorization: req.headers.authorization,
+        event: JSON.parse(body),
+        socket: req.socket,
+      });
+      res.writeHead(204).end();
+    });
+    await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve));
+    let child: ReturnType<typeof spawn> | undefined;
+    let exited: Promise<number | null> | undefined;
+    let spawnError: Error | undefined;
+    try {
+      const address = server.address();
+      assert.ok(address && typeof address !== 'string');
+      const env = transportEnv({
+        VONA_TEST_CLAIM_URL: `http://127.0.0.1:${address.port}/event`,
+        VONA_TEST_CLAIM_TOKEN: 'a'.repeat(64),
+      });
+      const events = [
+        { type: 'status', status: 'running' },
+        { type: 'status', status: 'failed' },
+      ];
+      const script = `
+      import { setImmediate } from 'node:timers/promises';
+      import { sendTestClaimEvent } from ${JSON.stringify(new URL('./testClaim.ts', import.meta.url).href)};
+      const [env, events] = JSON.parse(process.argv[1]);
+      await sendTestClaimEvent(env, events[0]);
+      await setImmediate();
+      // Let the parent broker expire an idle connection while startup blocks this event loop.
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 6500);
+      await sendTestClaimEvent(env, events[1]);
+    `;
+      child = spawn(
+        process.execPath,
+        ['--input-type=module', '-e', script, JSON.stringify([env, events])],
+        {
+          stdio: 'ignore',
+          windowsHide: true,
+          timeout: 30000,
+          killSignal: 'SIGKILL',
+        },
+      );
+      child.once('error', error => {
+        spawnError = error;
+      });
+      exited = new Promise(resolve => child!.once('close', code => resolve(code)));
+      assert.equal(await exited, 0, 'claim client child failed');
+      assert.equal(spawnError, undefined);
+      assert.deepEqual(
+        requests.map(request => request.event),
+        events,
+      );
+      assert.deepEqual(
+        requests.map(request => request.connection),
+        ['close', 'close'],
+      );
+      assert.ok(
+        requests.every(request => request.authorization === `Bearer ${env.VONA_TEST_CLAIM_TOKEN}`),
+      );
+      assert.notEqual(requests[0].socket, requests[1].socket);
+    } finally {
+      if (child && child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');
+      await exited;
+      server.closeAllConnections();
+      await new Promise<void>((resolve, reject) =>
+        server.close(error => (error ? reject(error) : resolve())),
+      );
+    }
+  },
+);
+
+test('containment requests do not reuse broker connections', async () => {
+  const requests: { connection: string | undefined; url: string | undefined; socket: Socket }[] =
+    [];
+  const server = createServer((req, res) => {
+    req.resume();
+    req.on('end', () => {
+      requests.push({ connection: req.headers.connection, url: req.url, socket: req.socket });
+      res.writeHead(204).end();
+    });
+  });
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const address = server.address();
+    assert.ok(address && typeof address !== 'string');
+    const env = {
+      ...transportEnv({
+        VONA_TEST_CLAIM_URL: `http://127.0.0.1:${address.port}/event`,
+        VONA_TEST_CLAIM_TOKEN: 'a'.repeat(64),
+      }),
+      [TEST_CLAIM_WINDOWS_GUARDIAN_ENV]: 'windows-e2e-guardian',
+    };
+    const identity = { pid: 123, startTime: '133000000000000001', host: hostname() };
+    await assertTestClaimWindowsJob(env, identity);
+    await new Promise(resolve => setImmediate(resolve));
+    await assertTestClaimWindowsJob(env, identity);
+    assert.deepEqual(
+      requests.map(request => request.url),
+      ['/containment', '/containment'],
+    );
+    assert.deepEqual(
+      requests.map(request => request.connection),
+      ['close', 'close'],
+    );
+    assert.notEqual(requests[0].socket, requests[1].socket);
+  } finally {
+    server.closeAllConnections();
+    await new Promise<void>((resolve, reject) =>
+      server.close(error => (error ? reject(error) : resolve())),
+    );
+  }
+});
+
+test('registration waits beyond ten seconds for acknowledgement without replaying the event', async () => {
+  const received = Promise.withResolvers<() => void>();
+  let requests = 0;
+  const server = createServer((req, res) => {
+    requests++;
+    req.resume();
+    req.on('end', () => received.resolve(() => res.writeHead(204).end()));
+  });
+  let registration: Promise<void> | undefined;
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const address = server.address();
+    assert.ok(address && typeof address !== 'string');
+    const env = transportEnv({
+      VONA_TEST_CLAIM_URL: `http://127.0.0.1:${address.port}/event`,
+      VONA_TEST_CLAIM_TOKEN: 'a'.repeat(64),
+    });
+    let settled = false;
+    registration = sendTestClaimEvent(env, { type: 'status', status: 'running' });
+    void registration.then(
+      () => {
+        settled = true;
+      },
+      () => {
+        settled = true;
+      },
+    );
+    const acknowledge = await received.promise;
+    await new Promise(resolve => setTimeout(resolve, 11000));
+    assert.equal(settled, false);
+    assert.equal(requests, 1);
+    acknowledge();
+    await registration;
+    assert.equal(requests, 1);
+  } finally {
+    server.closeAllConnections();
+    await registration?.catch(() => {});
+    await new Promise<void>((resolve, reject) =>
+      server.close(error => (error ? reject(error) : resolve())),
+    );
+  }
+});
+
+test(
+  'registration has a finite acknowledgement deadline and fails closed without replay',
+  { concurrency: false },
+  async t => {
+    const controller = new AbortController();
+    const timeout = AbortSignal.timeout.bind(AbortSignal);
+    let requests = 0;
+    const server = createServer(req => {
+      requests++;
+      req.resume();
+      req.on('end', () => {
+        timeout(20).addEventListener('abort', () => controller.abort(), { once: true });
+      });
+    });
+    const deadlines: number[] = [];
+    let registration: Promise<void> | undefined;
+    await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve));
+    const mock = t.mock.method(AbortSignal, 'timeout', (milliseconds: number) => {
+      deadlines.push(milliseconds);
+      return controller.signal;
+    });
+    try {
+      const address = server.address();
+      assert.ok(address && typeof address !== 'string');
+      const env = transportEnv({
+        VONA_TEST_CLAIM_URL: `http://127.0.0.1:${address.port}/event`,
+        VONA_TEST_CLAIM_TOKEN: 'a'.repeat(64),
+      });
+      registration = sendTestClaimEvent(env, { type: 'status', status: 'running' });
+      await assert.rejects(registration, {
+        message: 'Managed test allocation registration failed (transport)',
+      });
+      assert.deepEqual(deadlines, [120000]);
+      assert.equal(requests, 1);
+    } finally {
+      mock.mock.restore();
+      server.closeAllConnections();
+      await registration?.catch(() => {});
+      await new Promise<void>((resolve, reject) =>
+        server.close(error => (error ? reject(error) : resolve())),
+      );
+    }
+  },
+);
+
+test('registration diagnostics accept only categorical headers and never response bodies', async () => {
+  let headers: Record<string, string> = {
+    'x-vona-claim-phase': 'write',
+    'x-vona-claim-code': 'EBUSY',
+    'x-vona-claim-native-code': '32',
+  };
+  const server = createServer((req, res) => {
+    req.resume();
+    res.writeHead(409, headers).end('SECRET_RESPONSE_BODY');
+  });
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const address = server.address();
+    assert.ok(address && typeof address !== 'string');
+    const env = transportEnv({
+      VONA_TEST_CLAIM_URL: `http://127.0.0.1:${address.port}/event`,
+      VONA_TEST_CLAIM_TOKEN: 'a'.repeat(64),
+    });
+    await assert.rejects(sendTestClaimEvent(env, { type: 'status', status: 'running' }), {
+      message: 'Managed test allocation registration failed (HTTP 409, write, EBUSY, native 32)',
+    });
+    headers = {
+      'x-vona-claim-phase': 'SECRET_PATH',
+      'x-vona-claim-code': 'SECRET_TOKEN',
+      'x-vona-claim-native-code': '999999',
+    };
+    await assert.rejects(sendTestClaimEvent(env, { type: 'status', status: 'running' }), {
+      message: 'Managed test allocation registration failed (HTTP 409)',
+    });
+    await new Promise<void>((resolve, reject) =>
+      server.close(error => (error ? reject(error) : resolve())),
+    );
+    await assert.rejects(sendTestClaimEvent(env, { type: 'status', status: 'running' }), {
+      message: 'Managed test allocation registration failed (transport)',
+    });
+  } finally {
+    if (server.listening) {
+      await new Promise<void>((resolve, reject) =>
+        server.close(error => (error ? reject(error) : resolve())),
+      );
+    }
+  }
+});
+
 test('database confirmations and process registration cannot precede allocation intent', async () => {
   const f = fixture();
   let broker: Awaited<ReturnType<typeof startTestClaimBroker>> | undefined;

package/vona/packages-vona/vona-core/src/lib/core/testClaim.ts

@@ -662,9 +662,17 @@ export async function startTestClaimBroker(claimPath: string) {
   const update = (event: TestClaimEvent) => {
     if (closing) return Promise.reject(new Error('Test claim broker is closed'));
     const result = queue.then(async () => {
-      const manifest = await loadTestClaim(claimPath);
-      applyEvent(manifest, event);
-      await writeTestClaim(claimPath, manifest);
+      let phase = 'read';
+      try {
+        const manifest = await loadTestClaim(claimPath);
+        phase = 'validate';
+        applyEvent(manifest, event);
+        phase = 'write';
+        await writeTestClaim(claimPath, manifest);
+      } catch (error) {
+        if (error instanceof Error) Object.assign(error, { testClaimPhase: phase });
+        throw error;
+      }
     });
     queue = result.catch(() => {});
     return result;
@@ -692,8 +700,21 @@ export async function startTestClaimBroker(claimPath: string) {
       if (req.url === '/containment') await containment(parseTestClaimJson(body));
       else await update(parseTestClaimJson(body));
       res.writeHead(204).end();
-    } catch {
-      res.writeHead(409).end('Test claim registration rejected');
+    } catch (error) {
+      const failure = error as { testClaimPhase?: string; code?: string; nativeCode?: number };
+      const headers: Record<string, string> = {};
+      if (['read', 'validate', 'write'].includes(failure?.testClaimPhase!))
+        headers['x-vona-claim-phase'] = failure.testClaimPhase!;
+      if (['EEXIST', 'ENOENT', 'EBUSY', 'EACCES', 'EUNSAFE'].includes(failure?.code!))
+        headers['x-vona-claim-code'] = failure.code!;
+      if (
+        Number.isInteger(failure?.nativeCode) &&
+        failure.nativeCode! >= 0 &&
+        failure.nativeCode! <= 65535
+      ) {
+        headers['x-vona-claim-native-code'] = String(failure.nativeCode);
+      }
+      res.writeHead(409, headers).end('Test claim registration rejected');
     }
   });
   server.requestTimeout = 10000;
@@ -753,20 +774,35 @@ export function hasTestClaimTransport(env: TestClaimEnv = process.env) {
 }
 export async function sendTestClaimEvent(env: TestClaimEnv, event: TestClaimEvent) {
   if (!hasTestClaimTransport(env)) return;
+  let response: Response;
   try {
-    const response = await fetch(env[TEST_CLAIM_URL_ENV]!, {
+    response = await fetch(env[TEST_CLAIM_URL_ENV]!, {
       method: 'POST',
       headers: {
         'authorization': `Bearer ${env[TEST_CLAIM_TOKEN_ENV]}`,
+        // Startup can block past the broker's idle timeout; never reuse a stale socket.
+        'connection': 'close',
         'content-type': 'application/json',
       },
       body: JSON.stringify(event),
-      signal: AbortSignal.timeout(10000),
+      // Includes the serialized queue and durable Windows filesystem work (30s per operation).
+      signal: AbortSignal.timeout(120000),
       redirect: 'error',
     });
-    if (response.status !== 204) throw new Error('Registration rejected');
   } catch {
-    throw new Error('Managed test allocation registration failed');
+    throw new Error('Managed test allocation registration failed (transport)');
+  }
+  if (response.status !== 204) {
+    const details = [`HTTP ${response.status}`];
+    const phase = response.headers.get('x-vona-claim-phase');
+    const code = response.headers.get('x-vona-claim-code');
+    const nativeCode = response.headers.get('x-vona-claim-native-code');
+    if (['read', 'validate', 'write'].includes(phase!)) details.push(phase!);
+    if (['EEXIST', 'ENOENT', 'EBUSY', 'EACCES', 'EUNSAFE'].includes(code!)) details.push(code!);
+    if (nativeCode && /^\d{1,5}$/.test(nativeCode) && Number(nativeCode) <= 65535)
+      details.push(`native ${nativeCode}`);
+    await response.body?.cancel().catch(() => {});
+    throw new Error(`Managed test allocation registration failed (${details.join(', ')})`);
   }
 }
 
@@ -784,6 +820,8 @@ export async function assertTestClaimWindowsJob(env: TestClaimEnv, identity: Tes
       method: 'POST',
       headers: {
         'authorization': `Bearer ${env[TEST_CLAIM_TOKEN_ENV]}`,
+        // Startup can block past the broker's idle timeout; never reuse a stale socket.
+        'connection': 'close',
         'content-type': 'application/json',
       },
       body: JSON.stringify(query),