gentle-pi 4.3.0 → 4.4.0

package/tests/notification-audio-native.test.ts

@@ -1,9 +1,11 @@
 import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
 import { EventEmitter } from "node:events";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createServer, type Server } from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { test } from "node:test";
 import { NativePulsePlayer, NATIVE_PULSE_SCHEMA, type NativePulseOptions, type NativePulseSpawnOptions } from "../lib/notification-audio-native.ts";
 
@@ -75,9 +77,12 @@ async function startFakeServer(): Promise<FakeServer> {
 class FakeChild extends EventEmitter {
 	readonly stdout = new EventEmitter();
 	readonly stderr = new EventEmitter();
+	readonly stdin = { writes: [] as string[], write(chunk: string): boolean { this.writes.push(chunk); return true; } };
 	readonly kills: string[] = [];
 	kill(signal: string): boolean { this.kills.push(signal); return true; }
 }
+const okPlay = (): string => `${JSON.stringify({ schema: NATIVE_PULSE_SCHEMA, ok: true, played: true })}\n`;
+const failPlay = (): string => `${JSON.stringify({ schema: NATIVE_PULSE_SCHEMA, ok: false })}\n`;
 function recorder(platform = "linux", overrides: Partial<NativePulseOptions> = {}) {
 	const spawned: Array<{ executable: string; args: string[]; options: NativePulseSpawnOptions }> = [];
 	const children: FakeChild[] = [];
@@ -135,11 +140,77 @@ test("play gate false prevents spawning and no async runs after it", async () =>
 	const { player: second, spawned: secondSpawned, children } = recorder();
 	const playing = second.play("/tmp/s.wav", undefined, { permit: () => true });
 	assert.equal(secondSpawned.length, 1);
-	children[0]!.stdout.emit("data", JSON.stringify({ schema: NATIVE_PULSE_SCHEMA, ok: true, played: true }));
-	children[0]!.emit("close");
+	children[0]!.stdout.emit("data", okPlay());
 	await playing;
 });
 
+/** N plays must reuse ONE persistent `serve` worker: spawn once, queue, answer one envelope per play. */
+test("persistent serve worker: N plays spawn exactly one worker and each play succeeds", async () => {
+	const { player, spawned, children } = recorder();
+	const paths = ["/tmp/a.wav", "/tmp/b.wav", "/tmp/c.wav"];
+	const plays = paths.map(path => player.play(path));
+	assert.equal(spawned.length, 1, "N plays must spawn exactly one serve worker");
+	assert.equal(spawned[0]!.args[3], "serve");
+	assert.deepEqual(spawned[0]!.options.stdio, ["pipe", "pipe", "pipe"]);
+	assert.equal(children[0]!.stdin.writes.length, 1, "queued plays must not write until the active play settles");
+	for (const write of children[0]!.stdin.writes) {
+		const request = JSON.parse(write) as { schema: string; op: string; path: string };
+		assert.equal(request.schema, NATIVE_PULSE_SCHEMA); assert.equal(request.op, "play"); assert.equal(request.path, paths[0]);
+	}
+	for (let i = 0; i < plays.length; i++) children[0]!.stdout.emit("data", okPlay());
+	await Promise.all(plays);
+	assert.equal(spawned.length, 1);
+	assert.equal(children[0]!.stdin.writes.length, 3);
+	assert.deepEqual(children[0]!.stdin.writes.map(write => (JSON.parse(write) as { path: string }).path), paths);
+});
+
+test("a crashed serve worker is replaced by a fresh spawn on the next play", async () => {
+	const { player, spawned, children } = recorder();
+	const first = player.play("/tmp/a.wav");
+	children[0]!.stdout.emit("data", okPlay());
+	await first;
+	children[0]!.emit("close"); // crash while idle
+	const second = player.play("/tmp/b.wav");
+	assert.equal(spawned.length, 2, "the next play must spawn a fresh worker after a crash");
+	assert.equal(spawned[1]!.args[3], "serve");
+	children[1]!.stdout.emit("data", okPlay());
+	await second;
+});
+
+test("a crash with a play in flight fails that play privately and the next play spawns fresh", async () => {
+	const { player, spawned, children } = recorder();
+	const failing = player.play("/tmp/a.wav");
+	children[0]!.emit("close");
+	await assert.rejects(failing, /Native pulse/);
+	const next = player.play("/tmp/b.wav");
+	assert.equal(spawned.length, 2);
+	children[1]!.stdout.emit("data", okPlay());
+	await next;
+});
+
+test("dispose kills the persistent worker, fails pending plays and the next play spawns fresh", async () => {
+	const { player, spawned, children } = recorder();
+	const playing = player.play("/tmp/a.wav");
+	player.dispose();
+	assert.deepEqual(children[0]!.kills, ["SIGKILL"]);
+	await assert.rejects(playing, /Native pulse/);
+	const next = player.play("/tmp/b.wav");
+	assert.equal(spawned.length, 2);
+	children[1]!.stdout.emit("data", okPlay());
+	await next;
+	player.dispose(); // a second dispose is a no-op
+});
+
+test("pending plays are bounded fail-closed and never grow without bound", async () => {
+	const { player, spawned, children } = recorder();
+	const plays = Array.from({ length: 10 }, (_, i) => player.play(`/tmp/${i}.wav`).catch(error => error));
+	assert.equal(spawned.length, 1);
+	assert.match(String(await plays[9]), /too many pending/);
+	for (let i = 0; i < 9; i++) children[0]!.stdout.emit("data", okPlay()); // settle active + queued
+	const settled = await Promise.all(plays);
+	assert.equal(settled.filter(value => value instanceof Error).length, 1);
+});
+
 test("malformed, oversize and error output fail privately and kill at most once", async () => {
 	const malformed = recorder();
 	const malformedProbe = malformed.player.probe();
@@ -158,9 +229,11 @@ test("malformed, oversize and error output fail privately and kill at most once"
 
 	const failure = recorder();
 	const playing = failure.player.play("/private/snapshot.wav");
-	failure.children[0]!.stdout.emit("data", JSON.stringify({ schema: NATIVE_PULSE_SCHEMA, ok: false }));
-	failure.children[0]!.emit("close");
+	failure.children[0]!.stdout.emit("data", failPlay());
+	// A private ok:false leaves the healthy worker serviceable; no kill, no restart needed.
 	await assert.rejects(playing, (error: Error) => /Native pulse/.test(error.message) && !/snapshot|cookie|\/private/.test(error.message));
+	assert.equal(failure.children[0]!.kills.length, 0);
+	assert.equal(failure.spawned.length, 1);
 });
 
 test("timeout and abort SIGKILL once and settle only on close", async () => {
@@ -181,6 +254,11 @@ test("timeout and abort SIGKILL once and settle only on close", async () => {
 	const playing = aborted.player.play("/tmp/s.wav", controller.signal);
 	controller.abort();
 	assert.deepEqual(aborted.children[0]!.kills, ["SIGKILL"]);
+	let abortSettled = false; void playing.then(() => { abortSettled = true; }, () => { abortSettled = true; });
+	aborted.children[0]!.emit("exit", null);
+	aborted.children[0]!.emit("error", new Error("kill race")); // Node emits close after error
+	await new Promise(resolve => setTimeout(resolve, 0));
+	assert.equal(abortSettled, false);
 	aborted.children[0]!.emit("close");
 	await assert.rejects(playing, /aborted|Native pulse/);
 });
@@ -210,7 +288,8 @@ test("probe never throws for offline/malformed IPC while play rejects and cleans
 	assert.deepEqual(await probing, { available: false, formats: [] });
 	const { player: playPlayer, children: playChildren } = recorder();
 	const playing = playPlayer.play("/tmp/s.wav");
-	playChildren[0]!.stdout.emit("data", JSON.stringify({ schema: "wrong", ok: true, played: true }));
+	playChildren[0]!.stdout.emit("data", `${JSON.stringify({ schema: "wrong", ok: true, played: true })}\n`);
+	assert.deepEqual(playChildren[0]!.kills, ["SIGKILL"], "a malformed serve line is a protocol violation: kill once");
 	playChildren[0]!.emit("close");
 	await assert.rejects(playing, /Native pulse/);
 });
@@ -259,13 +338,13 @@ test("real worker plays a fake PCM snapshot to a fake socket with no OS audio",
 	const snapshot = join(dir, "sound.wav");
 	writeFileSync(snapshot, bytes, { mode: 0o400 });
 	const server = await startFakeServer();
+	const player = new NativePulsePlayer({ platform: "linux", env: { PULSE_SERVER: `unix:${server.path}` }, playTimeoutMs: 8000 });
 	try {
-		const player = new NativePulsePlayer({ platform: "linux", env: { PULSE_SERVER: `unix:${server.path}` }, playTimeoutMs: 8000 });
 		await player.play(snapshot);
 		assert.deepEqual(Buffer.concat(server.pcm), dataOf(bytes));
 		assert.ok(server.seen.includes(3) && server.seen.includes(12) && server.seen.includes(4));
 		assert.ok(existsSync(snapshot), "the bridge/worker must not delete the snapshot; the owner does");
-	} finally { await server.close(); rmSync(dir, { recursive: true, force: true }); }
+	} finally { player.dispose(); await server.close(); rmSync(dir, { recursive: true, force: true }); }
 });
 
 test("real worker rejects invalid WAV before opening the socket", async () => {
@@ -273,9 +352,49 @@ test("real worker rejects invalid WAV before opening the socket", async () => {
 	const snapshot = join(dir, "sound.wav");
 	writeFileSync(snapshot, Buffer.alloc(64, 0x00), { mode: 0o400 });
 	const server = await startFakeServer();
+	const player = new NativePulsePlayer({ platform: "linux", env: { PULSE_SERVER: `unix:${server.path}` }, playTimeoutMs: 8000 });
 	try {
-		const player = new NativePulsePlayer({ platform: "linux", env: { PULSE_SERVER: `unix:${server.path}` }, playTimeoutMs: 8000 });
 		await assert.rejects(player.play(snapshot), /Native pulse/);
 		assert.deepEqual(server.seen, []);
-	} finally { await server.close(); rmSync(dir, { recursive: true, force: true }); }
+	} finally { player.dispose(); await server.close(); rmSync(dir, { recursive: true, force: true }); }
+});
+
+/** Direct serve-protocol check: bounded fail-closed requests, private per-play failures, stdin EOF teardown. */
+test("real serve worker fails closed on protocol violations and exits on stdin EOF", async () => {
+	const workerPath = fileURLToPath(new URL("../lib/notification-pulse-worker.ts", import.meta.url));
+	const serveEnv = { ...process.env, NODE_NO_WARNINGS: "1", GENTLE_PI_AGENTS_CHILD: "1" };
+	const spawnServe = () => spawn(process.execPath, ["--experimental-strip-types", workerPath, "serve"],
+		{ stdio: ["pipe", "pipe", "pipe"], env: serveEnv });
+	const collect = (child: ReturnType<typeof spawn>): string[] => {
+		const lines: string[] = []; let text = "";
+		child.stdout!.setEncoding("utf8");
+		child.stdout!.on("data", (chunk: string) => {
+			text += chunk;
+			for (let index = text.indexOf("\n"); index !== -1; index = text.indexOf("\n")) { lines.push(text.slice(0, index)); text = text.slice(index + 1); }
+		});
+		return lines;
+	};
+	const exited = (child: ReturnType<typeof spawn>): Promise<number | null> => new Promise(resolve => {
+		if (child.exitCode !== null || child.signalCode !== null) { resolve(child.exitCode); return; }
+		child.once("exit", code => resolve(code));
+	});
+	// (a) A malformed line is a protocol violation: one generic envelope, then a crash the owner restarts.
+	const crashing = spawnServe();
+	const crashingLines = collect(crashing);
+	crashing.stdin!.write("not json\n");
+	assert.equal(await exited(crashing), 1);
+	assert.deepEqual(await crashingLines, [JSON.stringify({ schema: "gentle.audio.pulse/v1", ok: false })]);
+	// (b) A schema-valid request for a missing snapshot fails privately and the worker keeps serving.
+	const serving = spawnServe();
+	const servingLines = collect(serving);
+	for (const path of ["/nonexistent/gentle-a.wav", "/nonexistent/gentle-b.wav"])
+		serving.stdin!.write(`${JSON.stringify({ schema: "gentle.audio.pulse/v1", op: "play", path })}\n`);
+	await new Promise(resolve => setTimeout(resolve, 1200));
+	assert.deepEqual(servingLines, [
+		JSON.stringify({ schema: "gentle.audio.pulse/v1", ok: false }),
+		JSON.stringify({ schema: "gentle.audio.pulse/v1", ok: false }),
+	]);
+	// (c) stdin EOF (owner death) is a clean exit.
+	serving.stdin!.end();
+	assert.equal(await exited(serving), 0);
 });

package/tests/notification-customize.test.ts

@@ -10,6 +10,15 @@ import { basename } from "node:path";
 
 const tick = () => new Promise<void>((resolve) => setImmediate(resolve));
 
+/** UI chains settle across a load-dependent number of turns: wait on the
+ * observable state instead of assuming a fixed tick count landed the async
+ * step (gentle-shell#2498). The deadline keeps a broken chain failing fast. */
+const settleUntil = async (predicate: () => boolean, what: string): Promise<void> => {
+	const deadline = Date.now() + 5000;
+	while (!predicate() && Date.now() < deadline) await tick();
+	assert.ok(predicate(), `timed out waiting for ${what}`);
+};
+
 /** Real packaged WAVs so a valid path uses an existing fixture, never a synthetic name. */
 const WAV_FIXTURE = fileURLToPath(new URL("../assets/sounds/success.wav", import.meta.url));
 const WAV_FIXTURES = {
@@ -223,7 +232,7 @@ test("an in-flight local sound validation keeps busy, blocking a second field an
 		assert.match(view.render(160).join("\n"), /Local audio path/);
 		view.handleInput(WAV_FIXTURE);
 		view.handleInput("\r");
-		await tick();
+		await settleUntil(() => validated.length === 1, "the submitted value to start validating");
 		assert.deepEqual(validated, [`file:${WAV_FIXTURE}`], "the submitted value is validated exactly once");
 		// Validation is still pending: `f` must not open a second field and Enter must not write.
 		view.handleInput("f");
@@ -233,11 +242,11 @@ test("an in-flight local sound validation keeps busy, blocking a second field an
 		assert.equal(h.writes, 0, "no write before the deferred validation resolves");
 		// Resolve: a single write, then busy releases for the next edit.
 		resolveValidation(true);
-		await tick(); await tick();
+		await settleUntil(() => h.writes === 1, "the resolved validation to write exactly once");
 		assert.equal(h.writes, 1, "the resolved validation writes exactly once");
 		assert.equal(getNotificationService()!.getState().settings.audio.events["agent.failed"], `file:${WAV_FIXTURE}`);
 		view.handleInput("f");
-		assert.match(view.render(160).join("\n"), /Local audio path/, "busy is released so the next edit opens a fresh field");
+		await settleUntil(() => view.render(160).join("\n").includes("Local audio path"), "busy released so the next edit opens a fresh field");
 	} finally { h.owner.retire(); }
 });
 
@@ -262,14 +271,17 @@ test("disposing the card while validation is in flight never writes the stale ch
 	const h = harness(); try {
 		const rows = h.rows();
 		let resolveValidation!: (value: boolean) => void;
-		getNotificationService()!.validateFile = () => new Promise<boolean>(resolve => { resolveValidation = resolve; });
+		let validationStarted = false;
+		getNotificationService()!.validateFile = () => { validationStarted = true; return new Promise<boolean>(resolve => { resolveValidation = resolve; }); };
 		const view = customizeView(rows);
 		await expandAndSelect(view, "agent.failed:");
 		view.handleInput("f");
 		view.render(160);
 		view.handleInput(WAV_FIXTURE);
 		view.handleInput("\r");
-		await tick();
+		// Disposing before the validation even starts would never observe the
+		// stale-choice guard, so wait until the deferred validation is pending.
+		await settleUntil(() => validationStarted, "the in-flight validation to start");
 		view.dispose();
 		resolveValidation(true);
 		await tick(); await tick();

package/tests/odd-routing-canonical-ratchet.test.ts

@@ -149,7 +149,8 @@ const ANCHORS: readonly RoutingAnchor[] = [
 		canonical: "run a differential check",
 		mirrors: [
 			{ surface: DELEGATION, includes: "**Differential check (PRESERVE):**" },
-			{ surface: EXTENSION, includes: "run a differential check" },
+			// weak-model-economy S2: the harness gates the check on shared code an unnamed command uses.
+			{ surface: EXTENSION, includes: "run one differential check" },
 		],
 	},
 	{

package/tests/orchestrator-budget.test.ts

@@ -33,7 +33,10 @@ const FIXTURE_PATH = join(import.meta.dirname, "fixtures", "orchestrator.pre-die
 // gentle-shell#1731 T10 (user decision): 8,192 -> 8,400 B for the narrowed high-risk items 1 and 3.
 // Verification by named risk (escalate-only rule 3) and the writer-rule fix (triggers hold only when
 // their condition holds; a unit is independent behavior over a size floor), user decision 2026-10-14: 8,400 -> 9,100 B.
-const BUDGET_BYTES = 9100;
+// Weak-model economy (small path reads one batch with no todo; item 1 excludes rebuildable dev/test data), measured in
+// gentle-shell-bench 1321c60 (DeepSeek -24-30% time on x2/x5, -70% on a dev-database rename; Sol unchanged), user decision
+// 2026-10-22: 9,100 -> 9,250 B.
+const BUDGET_BYTES = 9250;
 const MIN_CONTROLLED_LONG_ASSETS_ROOT_CHARS = 93;
 
 const LAZY_ASSET_NAMES = [
@@ -126,7 +129,7 @@ function measureOrchestratorPromptBytes(assetsDir: string): number {
 // measuring a shorter render again.
 const RDD_WORST_CASE_LINE = "Receipt-driven development: unknown (native status unavailable)";
 
-test("getOrchestratorPrompt return value stays within the canonical 9,100 B budget at a short assets root", () => {
+test("getOrchestratorPrompt return value stays within the canonical 9,250 B budget at a short assets root", () => {
 	const rendered = __testing.renderOrchestratorPrompt(representativeProductionAssetsDir);
 	assert.ok(
 		rendered.includes(RDD_WORST_CASE_LINE),

package/tests/orchestrator-presence.test.ts

@@ -2,8 +2,10 @@ import assert from "node:assert/strict";
 import { fork } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
+import fsSync from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import test from "node:test";
 import { historyDir, saveTask } from "../lib/agents-history.ts";
 import { TASK_STATUS, TaskStore, type TaskRecord } from "../lib/agents-protocol.ts";
@@ -20,7 +22,7 @@ function fixture(t: test.TestContext) {
 		if (fs.existsSync(root) && !fs.lstatSync(root).isSymbolicLink()) {
 			for (const name of fs.readdirSync(root)) {
 				const path = join(root, name);
-				if (["tasks", "presence"].includes(name) && fs.lstatSync(path).isDirectory()) {
+				if (["tasks", "presence", "catalog"].includes(name) && fs.lstatSync(path).isDirectory()) {
 					for (const file of fs.readdirSync(path)) fs.unlinkSync(join(path, file));
 					fs.rmdirSync(path);
 				} else fs.unlinkSync(path);
@@ -56,6 +58,102 @@ test("heartbeat refreshes a bounded canonical label and stops an invalid source"
 	assert.deepEqual(listPresence(profile).entries, []);
 });
 
+test("warm-cache flush performs no synchronous ancestor validation", (t) => {
+	t.mock.timers.enable({ apis: ["Date", "setInterval", "setTimeout"], now: 100_000 });
+	const profile = fixture(t);
+	const pub = publisher(t, profile);
+	const absolute = resolve(profile);
+	const ancestors = new Set<string>();
+	for (let path = absolute;; path = dirname(path)) {
+		ancestors.add(path);
+		if (dirname(path) === path) break;
+	}
+	ancestors.add(join(absolute, "gentle-agents"));
+	ancestors.add(join(absolute, "gentle-agents", "presence"));
+	const probes: string[] = [];
+	const originalLstat = fsSync.lstatSync;
+	const spy = t.mock.method(fsSync, "lstatSync", (path: Parameters<typeof fsSync.lstatSync>[0], ...args: unknown[]) => {
+		if (typeof path === "string" && ancestors.has(path)) probes.push(path);
+		return (originalLstat as (...args: unknown[]) => fs.Stats)(path, ...args);
+	});
+	syncBuiltinESMExports();
+	t.after(() => { spy.mock.restore(); syncBuiltinESMExports(); });
+	pub.update(rows("warm cache"));
+	t.mock.timers.tick(400);
+	assert.deepEqual(probes, [], "writes must consume the validated cache, not re-probe ancestors");
+	assert.equal(listPresence(profile).entries[0].generation, 2);
+});
+
+test("a vanished storage tree skips publication without crashing and revalidates asynchronously", async (t) => {
+	const profile = fixture(t);
+	let heartbeat: (() => void) | undefined;
+	const interval = globalThis.setInterval;
+	t.mock.method(globalThis, "setInterval", (callback: () => void, ms: number) => {
+		if (ms === 5000) heartbeat = callback;
+		return interval(callback, ms);
+	});
+	const pub = publisher(t, profile);
+	const root = join(profile, "gentle-agents", "presence");
+	for (const name of fs.readdirSync(root)) fs.unlinkSync(join(root, name));
+	fs.rmdirSync(root);
+	heartbeat!();
+	await new Promise((resolve) => setTimeout(resolve, 50));
+	assert.equal(pub.error, undefined, "a vanished tree skips writes instead of failing the publisher");
+	assert.deepEqual(listPresence(profile).entries, []);
+	fs.mkdirSync(root, { mode: 0o700 });
+	heartbeat!(); // cache is still cold: skip this tick while the heartbeat revalidates
+	await new Promise((resolve) => setTimeout(resolve, 50));
+	heartbeat!(); // warm cache again: publication resumes
+	assert.equal(listPresence(profile).entries.length, 1);
+	assert.equal(pub.error, undefined);
+});
+
+test("heartbeat path validations never overlap", async (t) => {
+	const profile = fixture(t);
+	let heartbeat: (() => void) | undefined;
+	const interval = globalThis.setInterval;
+	t.mock.method(globalThis, "setInterval", (callback: () => void, ms: number) => {
+		if (ms === 5000) heartbeat = callback;
+		return interval(callback, ms);
+	});
+	const pub = publisher(t, profile);
+	let chains = 0;
+	let release!: () => void;
+	const gate = new Promise<void>((done) => { release = done; });
+	const original = fs.promises.lstat;
+	const spy = t.mock.method(fs.promises, "lstat", async (path: Parameters<typeof fs.promises.lstat>[0], ...args: unknown[]) => {
+		if (String(path) === resolve(profile)) { chains++; await gate; }
+		return (original as (...args: unknown[]) => Promise<fs.Stats>).apply(fs.promises, [path, ...args]);
+	});
+	t.after(() => spy.mock.restore());
+	heartbeat!();
+	heartbeat!(); // while the first validation waits, this tick must not start another
+	release();
+	await new Promise((resolve) => setTimeout(resolve, 50));
+	assert.equal(chains, 1, "overlapping heartbeat validations must be skipped");
+	heartbeat!();
+	await new Promise((resolve) => setTimeout(resolve, 50));
+	assert.equal(chains, 2, "the next heartbeat validates again");
+	assert.equal(pub.error, undefined);
+});
+
+test("first publication lands immediately after start() with no heartbeat wait", (t) => {
+	const profile = fixture(t);
+	const pub = publisher(t, profile);
+	// The first updateDiscovery lands in the same tick: no heartbeat may be
+	// required for the first header, discovery, or catalog publication.
+	pub.updateDiscovery({ sessionId: "same session", endpoint: "/fixture/first.sock", createdAt: 1 },
+		{ workspace: "/repo", tasks: [{ id: "child", label: "Check auth", status: "waiting", cwd: "/repo-child" }] });
+	const header = listPresence(profile).entries[0];
+	assert.equal(header.label, "Workspace");
+	assert.equal(presence.readDiscovery(profile, header)?.workspace, "/repo");
+	assert.equal(presence.readDiscovery(profile, header)?.tasks[0].id, "child");
+	const catalog = JSON.parse(fs.readFileSync(
+		join(profile, "gentle-agents", "catalog", `${header.sessionHash}.${header.incarnation}.json`), "utf8"));
+	assert.equal(catalog.schema, 1);
+	assert.deepEqual(catalog.catalog.tasks.map((row: { id: string }) => row.id), ["child"]);
+});
+
 function rows(text = "full retained output") {
 	return [{ task: { id: "t", agent: "worker", label: "summary", status: "running", model: "model",
 		createdAt: 1000, startedAt: 1100, endedAt: null, lastActivityAt: 1200,

package/tests/orchestrator-rdd-ownership.test.ts

@@ -66,13 +66,13 @@ test("rendered parent prompt keeps the RDD boundary while omitting lifecycle mir
 	// the three renderable forms -- so this IS the worst-case render the core
 	// budget below must cover, not a smaller placeholder production later
 	// exceeds. gentle-shell#1731 T10 (user decision): budget 8,192 -> 8,400 B.
-	// Verification by named risk and the writer-rule fix: 8,400 -> 9,100 B
+	// Verification by named risk and the writer-rule fix: 8,400 -> 9,100 B; weak-model economy: 9,100 -> 9,250 B
 	// (the canonical budget in orchestrator-budget.test.ts).
 	assert.ok(
 		rendered.includes("Receipt-driven development: unknown (native status unavailable)"),
 		"the default render must include the worst-case RDD status line",
 	);
-	assert.ok(Buffer.byteLength(rendered, "utf8") <= 9100, "the rendered parent prompt must stay within the 9,100 B core budget");
+	assert.ok(Buffer.byteLength(rendered, "utf8") <= 9250, "the rendered parent prompt must stay within the 9,250 B core budget");
 });
 
 test("static prompts retain ODD and delegated-work guidance without SDD", () => {

package/tests/orchestrator-scope.test.ts

@@ -8,6 +8,20 @@ import { OrchestratorScopeCache, validRecordedScope } from "../lib/orchestrator-
 import { PresencePublisher, listPresence, readDiscovery } from "../lib/orchestrator-presence.ts";
 import { resolveSessionWorktree } from "../lib/session-worktree-registry.ts";
 
+test("cachedScope serves deferred publications from the snapshot without probing", () => {
+	let probes = 0;
+	const cache = new OrchestratorScopeCache(() => { probes++; return { root: "/repo", commonDir: "/clone" }; });
+	assert.equal(cache.cachedScope(), undefined, "nothing is cached before a projection");
+	const snapshot = cache.project("/repo", [], []);
+	assert.equal(probes, 1, "the event-time projection resolves eagerly");
+	assert.equal(cache.cachedScope(), snapshot);
+	assert.equal(cache.cachedScope(), snapshot, "repeated deferred reads never probe");
+	assert.equal(probes, 1);
+	cache.clear();
+	assert.equal(cache.cachedScope(), undefined, "a cleared cache publishes no stale scope");
+	assert.equal(probes, 1);
+});
+
 test("recorded host/owned child/registered scope correlates clones, isolates ambient Git and caches lifecycle", (t) => {
 	const base = realpathSync(mkdtempSync(join(tmpdir(), "orchestrator-scope-")));
 	t.after(() => rmSync(base, { recursive: true, force: true }));

package/tests/orchestrator-state.test.ts

@@ -74,6 +74,35 @@ test("alias identity preserves status age, validates data, and rejects stale bra
 	assert.deepEqual(cache.get(manager)?.aliases, valid.aliases);
 });
 
+test("explicit work topic refreshes the current alias when no subject is declared (#2553)", () => {
+	const cache = new OrchestratorStateCache();
+	const entries: { type: string; customType: string; data: unknown }[] = [];
+	const manager = { getSessionId: () => "owner", getCwd: () => "/repo", getBranch: () => entries };
+	const append = (customType: string, data: unknown) => entries.push({ type: "custom", customType, data });
+	cache.load(manager);
+	const work = { area: "gentle-shell", topic: "pr-2509-followup" };
+	cache.publish(manager, { work }, append, 10);
+	assert.deepEqual(cache.get(manager)?.aliases, { initialAlias: "pr-2509-followup", currentAlias: "pr-2509-followup" });
+	// Fresh topic on a later publication updates Current; Initial is retained.
+	cache.publish(manager, { work: { area: "gentle-shell", topic: "ci-watch" } }, append, 20);
+	assert.deepEqual(cache.get(manager)?.aliases, { initialAlias: "pr-2509-followup", currentAlias: "ci-watch" });
+	// A state-only refresh never re-derives the alias from stored work.
+	cache.publish(manager, undefined, append, 30);
+	assert.deepEqual(cache.get(manager)?.aliases, { initialAlias: "pr-2509-followup", currentAlias: "ci-watch" });
+	// An explicit subject in the same publication wins over the topic.
+	cache.publish(manager, { work }, append, 40, "declared-task");
+	assert.deepEqual(cache.get(manager)?.aliases, { initialAlias: "pr-2509-followup", currentAlias: "declared-task" });
+	// Legacy records without aliases: topic refreshes Current, Initial stays unknown.
+	const legacy = [{ type: "custom", customType: ORCHESTRATOR_STATE_ENTRY, data: {
+		schema: 1, sessionId: "owner", recordedAt: 1, cwd: "/repo", source: "owner-curated",
+		ownerReply: false, authority: "none", state: null } }];
+	const legacyManager = { getSessionId: () => "owner", getCwd: () => "/repo", getBranch: () => legacy };
+	const legacyCache = new OrchestratorStateCache();
+	legacyCache.load(legacyManager);
+	legacyCache.publish(legacyManager, { work }, append, 50);
+	assert.deepEqual(legacyCache.get(legacyManager)?.aliases, { initialAlias: null, currentAlias: "pr-2509-followup" });
+});
+
 test("recorded cwd preserves only unambiguous native absolute paths", () => {
 	const separators = [0x00a0, ...Array.from({ length: 11 }, (_, i) => 0x2000 + i), 0x202f, 0x205f, 0x3000];
 	const invalid = ["relative/repo", "/repo\nother", "/repo\ud800", "/" + "x".repeat(1024),

package/tests/package-files.test.ts

@@ -0,0 +1,34 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { missingRequiredPaths, requiredPaths } from "../scripts/verify-package-files.mjs";
+
+// The voice worker is spawned by path and never imported, so only the package
+// check keeps it in the published tarball next to the modules that launch it.
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+
+test("the package check requires the voice command, its modules and the worker script", () => {
+	const voice = ["extensions/gentle-voice.ts", "lib/voice-command.ts", "lib/voice-session.ts", "lib/voice-ui.ts", "scripts/voice-worker.cjs", "docs/voice.md"];
+	for (const path of voice) assert.ok(requiredPaths.includes(path), `${path} is required`);
+	assert.deepEqual(missingRequiredPaths(root, voice), []);
+});
+
+// The canvas server reads its page and scripts from assets/ by path, never by import.
+const designCanvas = [
+	"lib/design-canvas-server.ts",
+	"lib/design-open-browser.ts",
+	"lib/design-comments.ts",
+	"lib/design-handoffs.ts",
+	"assets/design-canvas/index.html",
+	"assets/design-canvas/canvas.js",
+	"assets/design-canvas/canvas.css",
+	"assets/design-canvas/inspector.js",
+];
+
+// The design command names its skill file by path when Pi has not loaded it.
+test("the package check requires the design command, its helpers and its skill", () => {
+	const design = ["extensions/gentle-design.ts", "lib/gentle-design.ts", "lib/design-sources.ts", "skills/design/SKILL.md", ...designCanvas];
+	for (const path of design) assert.ok(requiredPaths.includes(path), `${path} is required`);
+	assert.deepEqual(missingRequiredPaths(root, design), []);
+});

package/tests/package-manifest.test.ts

@@ -431,20 +431,20 @@ test("package manifest installs pi-pretty through a wrapper without bundling nat
 	);
 });
 
-test("package verification binds the published Gentle AI v4.2.0 runtime pin", () => {
+test("package verification binds the published Gentle AI v4.3.1 runtime pin", () => {
 	const installer = readFileSync(join(PACKAGE_ROOT, "scripts", "gentle-ai-installer.mjs"), "utf8");
 	const binary = readFileSync(join(PACKAGE_ROOT, "lib", "gentle-ai-binary.ts"), "utf8");
 	const verifier = readFileSync(join(PACKAGE_ROOT, "scripts", "verify-package-files.mjs"), "utf8");
 
-	assert.match(installer, /INSTALLER_VERSION = "4\.2\.0"/);
+	assert.match(installer, /INSTALLER_VERSION = "4\.3\.1"/);
 	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_PACKAGE.*GENTLE_AI_WINDOWS_SOURCE_MODULE/);
-	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:J8EluS7QrfM\+m3vmQlF26B\/shZRjD6rBfsKtrABL5mc="/);
+	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:00p8dnjJrhYFq1Qikk2oY6K\/UXIty9A\/IBUUOUiX9XA="/);
 	assert.match(installer, /GOTOOLCHAIN: "local"/);
 	assert.match(installer, /GOSUMDB: "sum\.golang\.org"/);
 	assert.match(binary, /GENTLE_AI_VERSION = INSTALLER_VERSION/);
 	assert.match(binary, /GO_SUMDB_SOURCE_BUILD/);
 	assert.match(binary, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM/);
-	assert.match(verifier, /v4\.2\.0/);
+	assert.match(verifier, /v4\.3\.1/);
 });
 
 
@@ -1793,9 +1793,9 @@ test("pi-pretty wrapper uses cached ESM loading for compiled and pnpm symlink in
 	assert.match(wrapper, /quietToolsEnabled/);
 });
 
-test("Gentle Shell v4.3.0 package manifest declares the release version", () => {
+test("Gentle Shell v4.4.0 package manifest declares the release version", () => {
 	const packageJson = readPackageJson();
-	assert.equal(packageJson.version, "4.3.0", "the release manifest must be explicitly pinned to v4.3.0");
+	assert.equal(packageJson.version, "4.4.0", "the release manifest must be explicitly pinned to v4.4.0");
 	assert.equal(packageJson.scripts?.test, "node scripts/run-test-suite.mjs");
 	assert.ok(packageJson.files?.includes("assets/"));
 	assert.ok(packageJson.files?.includes("contracts/"));

package/tests/permission-mode-policy.test.ts

@@ -7,7 +7,7 @@ import { syncBuiltinESMExports } from "node:module";
 import { join } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { registerYoloSessionPolicy, discoverYoloUiAdapter } from "../lib/yolo-session-policy.ts";
-import { parsePermissionModePolicyFile, resolvePermissionModePolicy, writePermissionModePolicy, permissionModePolicyFile, PERMISSION_MODE_SCHEMA } from "../lib/permission-mode-policy.ts";
+import { isPermissionMode, parsePermissionModePolicyFile, resolvePermissionModePolicy, writePermissionModePolicy, permissionModePolicyFile, PERMISSION_MODE_SCHEMA } from "../lib/permission-mode-policy.ts";
 
 function fixture(t: test.TestContext) {
  const home = mkdtempSync(join(tmpdir(), "gentle-mode-"));
@@ -192,3 +192,12 @@ test("stale pending activation, scope loss and malformed preference remain close
  assert.equal(await h.controller.saveDefault("yolo", h.context), false);
  assert.equal(readFileSync(permissionModePolicyFile(options), "utf8"), "{");
 });
+
+test("super-yolo is a valid saved and parsed permission mode", t => {
+ const options = fixture(t);
+ assert.equal(isPermissionMode("super-yolo"), true);
+ assert.equal(isPermissionMode("superyolo"), false);
+ const path = writePermissionModePolicy("super-yolo", options);
+ assert.equal(parsePermissionModePolicyFile(readFileSync(path, "utf8")), "super-yolo");
+ assert.equal(resolvePermissionModePolicy(options).mode, "super-yolo");
+});