kenaz 0.3.11 → 0.3.13

package/vendor/install-kenaz-cli.js

@@ -13,6 +13,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const http = require('http');
 const { spawnSync } = require('child_process');
 
 const ENV_KEY = 'CLAUDE_CODE_PLUGIN_DIRS';
@@ -85,6 +86,29 @@ function unregisterPlugin(file, dir, dry) {
   return 'removed';
 }
 
+// Status line with the project's task counts (plugins/kenaz/scripts/statusline.js). Set only when the user has no
+// statusLine; a user's own is never replaced. Ours is recognised by the script path, so a moved core is updated.
+const STATUSLINE_TAIL = 'plugins/kenaz/scripts/statusline.js';
+const isOurStatusline = (s) => !!(s && typeof s.command === 'string' && norm(s.command).includes(STATUSLINE_TAIL));
+/** @returns 'added'|'already'|'replaced'|'kept-user' */
+function registerStatusline(file, core, dry) {
+  const v = loadSettings(file);
+  const command = 'node "' + path.join(core, ...STATUSLINE_TAIL.split('/')) + '"';
+  if (v.statusLine && !isOurStatusline(v.statusLine)) return 'kept-user';
+  if (v.statusLine && norm(v.statusLine.command) === norm(command)) return 'already';
+  const r = v.statusLine ? 'replaced' : 'added';
+  if (!dry) { v.statusLine = { type: 'command', command }; saveSettings(file, v); }
+  return r;
+}
+/** @returns 'removed'|'absent' */
+function unregisterStatusline(file, dry) {
+  if (!fs.existsSync(file)) return 'absent';
+  const v = loadSettings(file);
+  if (!isOurStatusline(v.statusLine)) return 'absent';
+  if (!dry) { delete v.statusLine; saveSettings(file, v); }
+  return 'removed';
+}
+
 // TASK_2384: Dashboard-era user-level hooks (wrapped by .claude/hooks/_user-scope.js, direct .claude/hooks/*.js, or the
 // agent-flow curl/node posts) duplicate what plugins/kenaz/hooks/hooks.json now runs. Single owner = the plugin, so
 // once it is registered these are removed (first write backs up the pristine file to settings.json.bak-kenaz-peer).
@@ -144,7 +168,30 @@ function systemdUnit(bin, core, nodeExe) {
   return '[Unit]\nDescription=Kenaz server (headless backend)\nAfter=network.target\n\n[Service]\nExecStart=' + bin + '\nEnvironment=KENAZ_SOURCE_DIR=' + core + '\nEnvironment=PATH=' + servicePath(nodeExe) + '\nRestart=on-failure\n\n[Install]\nWantedBy=default.target\n';
 }
 
-function servicePlan(home, bin, core, platform = process.platform) {
+// TASK_2413: no usable systemd user session (containers, WSL1, minimal servers) -> `systemctl --user enable --now`
+// silently does nothing. Fall back to an @reboot crontab entry ('cron') or, without crontab, a manual start ('manual').
+const CRON_MARK = '# kenaz-server (managed by kenaz install)';
+const shq = (v) => "'" + String(v).replace(/'/g, "'\\''") + "'";
+function cronStartCmd(bin, core, log, nodeExe) {
+  return 'KENAZ_SOURCE_DIR=' + shq(core) + ' PATH=' + shq(servicePath(nodeExe)) + ' ' + shq(bin) + ' >> ' + shq(log) + ' 2>&1';
+}
+function cronLine(bin, core, log, nodeExe) { // % is special in crontab
+  return '@reboot ' + cronStartCmd(bin, core, log, nodeExe).replace(/%/g, '\\%') + ' ' + CRON_MARK;
+}
+// stop exactly this binary (never by process name: another install's kenaz-server must survive). An upgraded
+// process still runs the unlinked inode, which /proc reports as "<path> (deleted)".
+function stopCmd(plan) {
+  const b = shq(plan.bin);
+  return 'for p in $(pgrep -x kenaz-server); do e=$(readlink /proc/$p/exe); ' +
+    '[ "$e" = ' + b + ' ] || [ "$e" = ' + shq(plan.bin + ' (deleted)') + ' ] && kill $p; done; true';
+}
+// start now, detached from the installer (new session when setsid exists), output to the log
+function detachedStartCmd(plan) {
+  return 'if command -v setsid >/dev/null 2>&1; then S=setsid; else S=; fi; ' +
+    'KENAZ_SOURCE_DIR=' + shq(plan.core) + ' PATH=' + shq(servicePath()) + ' $S nohup ' + shq(plan.bin) + ' >> ' + shq(plan.log) + ' 2>&1 < /dev/null &';
+}
+
+function servicePlan(home, bin, core, platform = process.platform, caps = { systemd: true }) {
   const L = launcherPaths(home);
   if (platform === 'win32') {
     const roaming = home === os.homedir() && process.env.APPDATA ? process.env.APPDATA : path.join(home, 'AppData', 'Roaming');
@@ -155,12 +202,101 @@ function servicePlan(home, bin, core, platform = process.platform) {
     const p = path.join(home, 'Library', 'LaunchAgents', LABEL + '.plist');
     return { kind: 'launchd', files: [[p, launchdPlist(bin, core, L.log)]], unit: p };
   }
+  if (caps.systemd === false) {
+    return { kind: caps.crontab ? 'cron' : 'manual', files: [], bin, core, log: L.log, cronLine: cronLine(bin, core, L.log) };
+  }
   const p = path.join(home, '.config', 'systemd', 'user', 'kenaz-server.service');
   return { kind: 'systemd', files: [[p, systemdUnit(bin, core)]], unit: p };
 }
-const sh = (cmd, args) => spawnSync(cmd, args, { encoding: 'utf8' });
+const sh = (cmd, args, opts) => spawnSync(cmd, args, { encoding: 'utf8', ...(opts || {}) });
+
+// crontab -l: null = no crontab binary; '' = binary present, no crontab yet. All through the injected `run`.
+function readCron(run) {
+  const r = run('crontab', ['-l']);
+  if (!r || r.error || r.status === 127) return null;
+  return r.status === 0 ? String(r.stdout || '') : '';
+}
+function probeLinux(run) {
+  const r = run('systemctl', ['--user', 'show-environment']);
+  const systemd = !!r && !r.error && r.status === 0;
+  return { systemd, crontab: systemd ? undefined : readCron(run) !== null };
+}
+function writeCron(run, current, line) { // line null = remove our entry; keeps every other line; idempotent
+  const keep = current.split('\n').filter((l) => l.trim() && !l.includes(CRON_MARK));
+  const next = line ? keep.concat(line) : keep;
+  const text = next.length ? next.join('\n') + '\n' : '';
+  if (text === current) return false;
+  if (text) run('crontab', ['-'], { input: text }); else run('crontab', ['-r']);
+  return true;
+}
 
-function serviceInstall(plan, dry, log) {
+// TASK_2418: loading/enabling a unit that is already loaded/active is a no-op, so an upgrade must restart it
+// explicitly, after the new binary is in place. launchd KeepAlive respawns the OLD file in the window between
+// stopOwnServer() and the copy (the process then keeps the unlinked inode); systemd `enable --now` does not
+// restart an active unit. restartHint is also the command printed when the version check fails.
+const defaultUid = () => (typeof process.getuid === 'function' ? process.getuid() : 501);
+function restartHint(plan, uid = defaultUid()) {
+  if (plan.kind === 'launchd') return 'launchctl kickstart -k gui/' + uid + '/' + LABEL;
+  if (plan.kind === 'systemd') return 'systemctl --user restart kenaz-server';
+  if (plan.kind === 'cron' || plan.kind === 'manual') return stopCmd(plan) + '; ' + detachedStartCmd(plan);
+  // the launcher works for both the scheduled task and the Startup-folder fallback (no admin rights needed)
+  return 'end kenaz-server.exe in Task Manager, then run: wscript.exe ' + q(plan.files && plan.files[0] ? plan.files[0][0] : 'kenaz-server.vbs');
+}
+function serviceRestart(plan, dry, log, run = sh, uid = defaultUid()) {
+  if (plan.kind === 'cron' || plan.kind === 'manual') { // no supervisor: start it (stopOwnServer freed the old one)
+    log('start now (detached, log ' + plan.log + ')');
+    if (!dry) { fs.mkdirSync(path.dirname(plan.log), { recursive: true }); run('sh', ['-c', detachedStartCmd(plan)]); }
+    return;
+  }
+  if (plan.kind === 'windows') return; // /Create + /Run above start the just-copied exe (stopOwnServer freed it)
+  log(restartHint(plan, uid));
+  if (dry) return;
+  if (plan.kind === 'launchd') {
+    const r = run('launchctl', ['kickstart', '-k', 'gui/' + uid + '/' + LABEL]);
+    if (r && r.status !== 0) { // old macOS / no GUI session domain: unload + load restarts it the long way
+      log('kickstart failed (exit ' + r.status + '), falling back to launchctl unload + load');
+      run('launchctl', ['unload', plan.unit]); run('launchctl', ['load', '-w', plan.unit]);
+    }
+  } else run('systemctl', ['--user', 'restart', 'kenaz-server']);
+}
+
+/** One GET /api/health; resolves { ok, version }. */
+function healthOnce(port, getFn = http.get) {
+  return new Promise((resolve) => {
+    const req = getFn({ host: '127.0.0.1', port, path: '/api/health', timeout: 2000 }, (res) => {
+      let b = ''; res.on('data', (d) => { b += d; });
+      res.on('end', () => { let v = null; try { v = JSON.parse(b).version || null; } catch (_) { /* body optional */ } resolve({ ok: res.statusCode < 500, version: v }); });
+    });
+    req.on('timeout', () => { req.destroy(); resolve({ ok: false, version: null }); });
+    req.on('error', () => resolve({ ok: false, version: null }));
+  });
+}
+/**
+ * TASK_2418: after the service (re)start, ask the running server for its version and compare with the one just
+ * installed. Retries (the server needs a moment to bind). Returns 'ok' | 'mismatch' | 'unreachable'; the last two
+ * print a warning with the exact restart command and do not fail the install.
+ */
+async function verifyRuntime(plan, expected, log, opts = {}) {
+  const port = opts.port || process.env.KENAZ_HTTP_PORT || '18080';
+  const tries = opts.tries || 6, delay = opts.delayMs === undefined ? 1000 : opts.delayMs;
+  const probe = opts.health || ((p) => healthOnce(p));
+  let last = { ok: false, version: null };
+  for (let i = 0; i < tries; i++) {
+    last = await probe(port);
+    if (last.ok && last.version === expected) { log('server: running version ' + expected + ' on :' + port); return 'ok'; }
+    if (i < tries - 1 && delay) await new Promise((r) => setTimeout(r, delay));
+  }
+  const hint = restartHint(plan, opts.uid);
+  if (last.ok && last.version) {
+    log('WARNING: the server on :' + port + ' still reports version ' + last.version + ' but ' + expected + ' was just installed. Restart it: ' + hint);
+    return 'mismatch';
+  }
+  log('WARNING: could not confirm the new server (' + expected + ') on 127.0.0.1:' + port + (last.ok ? ' (no version in /api/health)' : ' (no answer)') + '. If it is not running: ' + hint);
+  return 'unreachable';
+}
+
+function serviceInstall(plan, dry, log, run = sh, uid) {
+  const sh = run; // injectable for tests; shadows the module-level spawnSync wrapper inside this function
   for (const [f, body] of plan.files) { log('write ' + f); if (!dry) { fs.mkdirSync(path.dirname(f), { recursive: true }); fs.writeFileSync(f, body); } }
   if (plan.kind === 'windows') {
     const tr = 'wscript.exe ' + q(plan.files[0][0]);
@@ -178,29 +314,63 @@ function serviceInstall(plan, dry, log) {
     }
   } else if (plan.kind === 'launchd') {
     log('launchctl load -w ' + plan.unit); if (!dry) sh('launchctl', ['load', '-w', plan.unit]);
+    serviceRestart(plan, dry, log, sh, uid);
+  } else if (plan.kind === 'cron' || plan.kind === 'manual') {
+    if (plan.kind === 'cron') {
+      log('crontab: @reboot entry  ' + plan.cronLine);
+      if (!dry) { const cur = readCron(sh); if (cur !== null) writeCron(sh, cur, plan.cronLine); }
+    } else {
+      log('WARNING: no systemd user session and no crontab here. Add this to your own init/boot script to start the server at boot: ' + cronStartCmd(plan.bin, plan.core, plan.log));
+    }
+    serviceRestart(plan, dry, log, sh, uid);
   } else {
     log('systemctl --user enable --now kenaz-server');
     if (!dry) { sh('systemctl', ['--user', 'daemon-reload']); sh('systemctl', ['--user', 'enable', '--now', 'kenaz-server']); }
+    serviceRestart(plan, dry, log, sh, uid);
   }
 }
-function serviceUninstall(plan, dry, log) {
+function serviceUninstall(plan, dry, log, run = sh) {
   if (plan.kind === 'windows') {
     log('schtasks /End + /Delete /TN ' + TASK_NAME);
-    if (!dry) { sh('schtasks', ['/End', '/TN', TASK_NAME]); sh('schtasks', ['/Delete', '/TN', TASK_NAME, '/F']); }
+    if (!dry) { run('schtasks', ['/End', '/TN', TASK_NAME]); run('schtasks', ['/Delete', '/TN', TASK_NAME, '/F']); }
     if (fs.existsSync(plan.fallbackFile)) { log('remove ' + plan.fallbackFile); if (!dry) fs.rmSync(plan.fallbackFile, { force: true }); }
   } else if (plan.kind === 'launchd') {
-    log('launchctl unload ' + plan.unit); if (!dry) sh('launchctl', ['unload', '-w', plan.unit]);
+    log('launchctl unload ' + plan.unit); if (!dry) run('launchctl', ['unload', '-w', plan.unit]);
+  } else if (plan.kind === 'cron' || plan.kind === 'manual') {
+    if (plan.kind === 'cron') { log('crontab: remove the kenaz-server @reboot entry'); if (!dry) { const cur = readCron(run); if (cur !== null) writeCron(run, cur, null); } }
+    log('stop ' + plan.bin); if (!dry) run('sh', ['-c', stopCmd(plan)]);
   } else {
-    log('systemctl --user disable --now kenaz-server'); if (!dry) sh('systemctl', ['--user', 'disable', '--now', 'kenaz-server']);
+    log('systemctl --user disable --now kenaz-server'); if (!dry) run('systemctl', ['--user', 'disable', '--now', 'kenaz-server']);
   }
   for (const [f] of plan.files) if (fs.existsSync(f)) { log('remove ' + f); if (!dry) fs.rmSync(f, { force: true }); }
 }
-function serviceStatus(plan) {
-  if (plan.kind === 'windows') return sh('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (fs.existsSync(plan.fallbackFile) ? 'startup launcher present' : 'not installed');
-  if (plan.kind === 'systemd') return sh('systemctl', ['--user', 'is-active', 'kenaz-server']).stdout.trim() || 'not installed';
+function serviceStatus(plan, run = sh) {
+  if (plan.kind === 'cron') { const c = readCron(run); return c && c.includes(CRON_MARK) ? 'cron @reboot entry present' : 'not installed'; }
+  if (plan.kind === 'manual') return 'manual (no systemd user session, no crontab)';
+  if (plan.kind === 'windows') return run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (fs.existsSync(plan.fallbackFile) ? 'startup launcher present' : 'not installed');
+  if (plan.kind === 'systemd') return run('systemctl', ['--user', 'is-active', 'kenaz-server']).stdout.trim() || 'not installed';
   return fs.existsSync(plan.unit) ? 'plist present' : 'not installed';
 }
 
+/** Which mechanism keeps the server running on this machine (for `kenaz doctor`). Read-only, all via `run`. */
+function detectServiceMode(home, core, run = sh, platform = process.platform) {
+  if (platform === 'win32') {
+    const plan = servicePlan(home, '', core, 'win32');
+    if (run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0) return { mode: 'windows task', detail: 'scheduled task ' + TASK_NAME };
+    if (fs.existsSync(plan.fallbackFile)) return { mode: 'startup launcher', detail: plan.fallbackFile };
+    return { mode: 'manual', detail: 'no scheduled task or Startup launcher; run `kenaz install`' };
+  }
+  if (platform === 'darwin') {
+    const p = servicePlan(home, '', core, 'darwin').unit;
+    return fs.existsSync(p) ? { mode: 'launchd', detail: p } : { mode: 'manual', detail: 'no launchd agent; run `kenaz install`' };
+  }
+  const unit = servicePlan(home, '', core, 'linux').unit;
+  if (fs.existsSync(unit) && probeLinux(run).systemd) return { mode: 'systemd', detail: unit };
+  const c = readCron(run);
+  if (c && c.includes(CRON_MARK)) return { mode: 'cron', detail: '@reboot crontab entry (no systemd user session)' };
+  return { mode: 'manual', detail: 'no systemd unit or cron entry; run `kenaz install`' };
+}
+
 function parseArgs(argv) {
   const o = { cmd: argv[0], flags: {} };
   for (let i = 1; i < argv.length; i++) {
@@ -217,7 +387,7 @@ function findServerBin(core, home) {
   return c.map((p) => path.resolve(p)).find((p) => fs.existsSync(p)) || null;
 }
 
-function main(argv, out = console.log, getVersion = claudeVersion) { // getVersion: injectable for tests
+function main(argv, out = console.log, getVersion = claudeVersion, deps = {}) { // getVersion, deps {sh, platform, uid, onPlan}: injectable for tests
   const { cmd, flags } = parseArgs(argv);
   if (!['install', 'uninstall', 'status'].includes(cmd)) {
     out('usage: install-kenaz-cli.js <install|uninstall|status> [--dry-run] [--home d] [--core-dir d] [--server-bin p] [--no-service] [--no-plugin]');
@@ -242,6 +412,7 @@ function main(argv, out = console.log, getVersion = claudeVersion) { // getVersi
           out(name + ': ' + (list.some((e) => norm(e) === norm(pluginDir)) ? 'registered' : 'not registered') + ' (' + pluginDir + ')');
         } else if (cmd === 'uninstall') {
           log(name + ': ' + unregisterPlugin(settings, pluginDir, dry) + ' (' + settings + ')');
+          if (name === 'kenaz') log('statusline: ' + unregisterStatusline(settings, dry));
         } else if (process.env.KENAZ_SKIP_CLAUDE_PROVISION === '1') {
           log(name + ': skipped (KENAZ_SKIP_CLAUDE_PROVISION=1)');
         } else if (!fs.existsSync(path.join(pluginDir, 'hooks', 'hooks.json'))) {
@@ -253,6 +424,8 @@ function main(argv, out = console.log, getVersion = claudeVersion) { // getVersi
           else {
             log(name + ': ' + registerPlugin(settings, pluginDir, dry) + ' (' + settings + ')');
             if (name === 'kenaz') {
+              const sl = registerStatusline(settings, core, dry);
+              log('statusline: ' + (sl === 'kept-user' ? 'kept your own statusLine; to show Kenaz task counts, append the output of: node "' + path.join(core, ...STATUSLINE_TAIL.split('/')) + '"' : sl));
               const n = retireDashboardHooks(settings, dry);
               if (n) log('kenaz: retired ' + n + ' Dashboard-era user-level hook(s), now owned by the plugin (backup: ' + path.join(path.dirname(settings), BACKUP) + ')');
             }
@@ -264,11 +437,15 @@ function main(argv, out = console.log, getVersion = claudeVersion) { // getVersi
 
   if (!flags['no-service']) {
     const bin = flags['server-bin'] ? path.resolve(flags['server-bin']) : findServerBin(core, home);
-    const plan = servicePlan(home, bin || '<kenaz-server not found>', core);
-    if (cmd === 'status') out('service: ' + (dry ? 'skipped (dry-run)' : serviceStatus(plan)));
-    else if (cmd === 'uninstall') serviceUninstall(plan, dry, log);
+    const run = deps.sh || sh, platform = deps.platform || process.platform;
+    // the probe is read-only but still a system call: skipped on --dry-run (assumes systemd, as before)
+    const caps = platform === 'linux' && !dry ? probeLinux(run) : undefined;
+    const plan = servicePlan(home, bin || '<kenaz-server not found>', core, platform, caps);
+    if (deps.onPlan) deps.onPlan(plan);
+    if (cmd === 'status') out('service: ' + (dry ? 'skipped (dry-run)' : serviceStatus(plan, run)));
+    else if (cmd === 'uninstall') serviceUninstall(plan, dry, log, run);
     else if (!bin) { out('service: skipped, kenaz-server binary not found (pass --server-bin)'); rc = 1; }
-    else serviceInstall(plan, dry, log);
+    else serviceInstall(plan, dry, log, run, deps.uid);
   }
   if (cmd === 'install' && rc === 0) out('Next: cd <your project>; claude; /kenaz:kenaz init; /kenaz:Ansuz   (Codex: run /hooks once to trust the kenaz hooks, then $kenaz status)');
   if (cmd === 'uninstall') out('Project .kenaz/ data was left untouched.');
@@ -276,4 +453,4 @@ function main(argv, out = console.log, getVersion = claudeVersion) { // getVersi
 }
 
 if (require.main === module) process.exit(main(process.argv.slice(2)));
-module.exports = { main, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, retireDashboardHooks, servicePlan, winVbs, launchdPlist, systemdUnit, parseVersion, cmpVersion };
+module.exports = { main, verifyRuntime, healthOnce, serviceInstall, serviceRestart, restartHint, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, registerStatusline, unregisterStatusline, retireDashboardHooks, servicePlan, detectServiceMode, probeLinux, cronLine, CRON_MARK, winVbs, launchdPlist, systemdUnit, parseVersion, cmpVersion };

package/core/.collaboration/core/task-2264-single-after-capture.test.js

@@ -1,61 +0,0 @@
-// TASK_2264 — completeTask must schedule exactly ONE 'after' health capture.
-// moveTask used to schedule a detached 'after' capture on every ->done move even when
-// completeTask's own postComplete was about to measure the same snapshot.
-// Counting seam: child_process.spawn is patched (task-api requires it at call time) and
-// calls whose inline script carries phase "after" are counted. Isolated temp project.
-// Usage: node .collaboration/core/task-2264-single-after-capture.test.js
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const cp = require('child_process');
-const { TaskAPI, toYAML } = require('./task-api.js');
-
-const SB = fs.mkdtempSync(path.join(os.tmpdir(), 't2264_'));
-const tasksDir = path.join(SB, '.kenaz', 'tasks');
-for (const d of ['backlog', 'active', 'done', 'blocked', 'cancel', 'archived']) fs.mkdirSync(path.join(tasksDir, d), { recursive: true });
-delete process.env.FORMATION_SCHEDULER; delete process.env.FORMATION_HEADLESS;
-
-let pass = 0, fail = 0;
-const check = (n, c, d) => { console.log((c ? 'PASS' : 'FAIL') + ' | ' + n + (c ? '' : ' | ' + d)); c ? pass++ : fail++; };
-
-let phases = [];
-const realSpawn = cp.spawn;
-cp.spawn = function (cmd, argv, opts) {
-  const script = Array.isArray(argv) ? argv.find(a => typeof a === 'string' && a.includes('const CFG')) : null;
-  if (script) {
-    const m = script.match(/"phase":"(before|after)"/);
-    phases.push(m ? m[1] : '?');
-    return { unref() {}, on() {} };
-  }
-  return realSpawn.apply(this, arguments);
-};
-
-const mkActive = (id) => fs.writeFileSync(path.join(tasksDir, 'active', id + '_t.yaml'),
-  toYAML({ id, title: 't2264 ' + id, priority: 'P2', status: 'in_progress' }));
-
-(async () => {
-  const api = new TaskAPI({ tasksDir, projectPath: SB });
-  try {
-    // A: complete with post-complete running in-process (dry run, no git/archive) -> post-complete owns 'after'
-    mkActive('TASK_9001'); phases = [];
-    await api.completeTask('TASK_9001', { dryRun: true, skipGit: true, skipArchive: true });
-    check('A complete w/ post-complete: moveTask schedules NO after capture', phases.filter(p => p === 'after').length === 0, JSON.stringify(phases));
-
-    // B control: post-complete skipped -> nobody else measures, moveTask must still capture exactly once
-    mkActive('TASK_9002'); phases = [];
-    await api.completeTask('TASK_9002', { skipPostComplete: true });
-    check('B control: complete w/ skipPostComplete schedules exactly 1 after capture', phases.filter(p => p === 'after').length === 1, JSON.stringify(phases));
-
-    // C control: bare move done (no post-complete) keeps its single capture
-    mkActive('TASK_9003'); phases = [];
-    await api.moveTask('TASK_9003', 'done');
-    check('C control: bare move done schedules exactly 1 after capture', phases.filter(p => p === 'after').length === 1, JSON.stringify(phases));
-  } catch (e) {
-    check('no exception', false, e && e.stack);
-  } finally {
-    cp.spawn = realSpawn;
-    try { fs.rmSync(SB, { recursive: true, force: true }); } catch { /* best effort */ }
-  }
-  console.log(`\n${pass} passed, ${fail} failed`);
-  process.exit(fail ? 1 : 0);
-})();