diff --git a/.github/workflows/preflight-cli-platforms.yml b/.github/workflows/preflight-cli-platforms.yml index 2aaa7bc4c6c..ba38aee2ea6 100644 --- a/.github/workflows/preflight-cli-platforms.yml +++ b/.github/workflows/preflight-cli-platforms.yml @@ -47,7 +47,6 @@ jobs: src/main/ipc/preflight-runnable-local-cli.test.ts src/main/ipc/preflight-wsl-agent-detection.test.ts src/main/ipc/preflight-windows-path-refresh.repro.test.ts - src/main/startup/hydrate-shell-path.test.ts src/main/startup/hydrate-shell-path.windows.test.ts src/main/startup/login-shell-environment.test.ts src/packages/process-host/src/process-tree-termination.test.ts diff --git a/config/flaky-test-pattern-baseline.txt b/config/flaky-test-pattern-baseline.txt index 2d5824f93fa..45fd00046a3 100644 --- a/config/flaky-test-pattern-baseline.txt +++ b/config/flaky-test-pattern-baseline.txt @@ -658,7 +658,7 @@ 2 test-no-wall-clock:src/main/runtime/workspace-layout-live-titles.test.ts 1 test-no-wall-clock:src/main/runtime/workspaces/process-listing/runtime-worktree-structured-agent-rows-liveness.test.ts 6 test-no-wall-clock:src/main/skills/skill-bundle-process-termination.integration.test.ts -7 test-no-wall-clock:src/main/skills/skill-install-lock.test.ts +6 test-no-wall-clock:src/main/skills/skill-install-lock.test.ts 1 test-no-wall-clock:src/main/skills/skill-install-recovery.test.ts 1 test-no-wall-clock:src/main/skills/skill-install-request-service.test.ts 1 test-no-wall-clock:src/main/skills/skill-install-service.test.ts @@ -859,7 +859,7 @@ 1 test-timeout-needs-reason:src/main/windows/windows-host-job.win32.test.ts 1 test-timeout-needs-reason:src/main/windows/windows-msys-job.win32.test.ts 2 test-timeout-needs-reason:src/main/windows/windows-pty-job.win32.test.ts -8 test-timeout-needs-reason:src/main/worker-thread-child-process/worker-thread-child-process.test.ts +5 test-timeout-needs-reason:src/main/worker-thread-child-process/worker-thread-child-process.test.ts 2 test-timeout-needs-reason:src/main/workspace-hooks/hook-archive-timeout-observation.test.ts 2 test-timeout-needs-reason:src/main/workspace-hooks/hook-termination-real-process.test.ts 2 test-timeout-needs-reason:src/main/workspaces/removal/local-worktree-filesystem-wsl-banner.wsl.test.ts diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc index 045ccaa1cd6..246cbfcf89e 100644 --- a/config/reliability-gates.jsonc +++ b/config/reliability-gates.jsonc @@ -3952,13 +3952,13 @@ "providers": ["local", "daemon", "ssh"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1589 removes mock-only CLI forwarding, canned provisioning/catalog/error projections and private inventories without equivalent replacement coverage. Retained cases exercise actual local markdown/paste/reconciliation, stream framing/backpressure/output-drain, temporary directory cleanup and persisted handoff with injected host/provider/process boundaries. No real Jira, provisioning, remote launch, native pipe/process-tree authority or deployed provider catalog proof. Assertion references use the surviving handoff registration titles; changed-selector historical receipts are retired and unaffected receipts remain unchanged. Historical scope before this audit: Deterministic unit coverage exercises activation gating, single-instance ownership, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. Supervisor settlement coverage prevents a late handoff-completion failure from rearming termination after the replacement child exits. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1589 removes mock-only CLI forwarding, canned provisioning/catalog/error projections and private inventories without equivalent replacement coverage. Retained cases exercise actual local markdown/paste/reconciliation, stream framing/backpressure/output-drain, temporary directory cleanup and persisted handoff with injected host/provider/process boundaries. No real Jira, provisioning, remote launch, native pipe/process-tree authority or deployed provider catalog proof. Assertion references use the surviving handoff registration titles; changed-selector historical receipts are retired and unaffected receipts remain unchanged. Historical scope before this audit: Deterministic unit coverage exercises activation gating, single-instance ownership, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. Supervisor settlement coverage prevents a late handoff-completion failure from rearming termination after the replacement child exits. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/8457", "https://github.com/stablyai/orca/issues/9563" ], "invariant": "A safely promotable headless serve process is the single app owner. Desktop activation preserves its daemon-backed sessions. On macOS, a CLI-supervised serve update keeps the node-mode parent alive across ShipIt's atomic bundle swap, restarts with the original serve arguments only after the target bundle is present, and clears handoff state only after that target version reports runtime readiness. Once a supervised child exits or fails to start, no late handoff completion may signal it or arm force-kill escalation. Unsupported or failed handoffs leave the current serving owner intact or recover it once without an install retry loop.", - "oracle": "Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. Force handoff completion to fail after the replacement child exits and require zero later child signals and zero escalation timers. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. Force handoff completion to fail after the replacement child exits and require zero later child signals and zero escalation timers. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/updater/serve-update-handoff.test.ts src/main/updater/updater.headless-serve-install.test.ts src/main/updater/mac-install/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts", @@ -4078,6 +4078,7 @@ "Add an Electron SSH promotion journey in addition to the deterministic identity-transfer unit contract." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1589 removes mock-only CLI forwarding, canned provisioning/catalog/error projections and private inventories without equivalent replacement coverage. Retained cases exercise actual local markdown/paste/reconciliation, stream framing/backpressure/output-drain, temporary directory cleanup and persisted handoff with injected host/provider/process boundaries. No real Jira, provisioning, remote launch, native pipe/process-tree authority or deployed provider catalog proof. Assertion references use the surviving handoff registration titles; changed-selector historical receipts are retired and unaffected receipts remain unchanged.", @@ -4113,14 +4114,14 @@ "providers": ["local", "daemon", "ssh", "paired-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "paired-runtime"], - "coverageNotes": "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire. The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire. The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/14066", "https://linear.app/stably/issue/STA-4016", "https://github.com/stablyai/orca/pull/14070" ], "invariant": "Every genuine renderer graph reload revision settles exactly once, while a blocked external navigation that preserves the current document never starts a revision. A cancelled renderer-document navigation restores authority only when that same renderer survived; cancellation after an earlier document committed remains fenced until publication or timeout. Replacing a reload cancels only the prior revision; its timer and callbacks cannot settle a newer revision. A desktop reload succeeds only from a publication carrying a new renderer-document generation, while a failed headless promotion may recover only from its originating window. Timeout, renderer loss, and close reach a terminal graph state, and successful desktop publication permanently retires headless sentinel fallback until a new headless runtime is established.", - "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts", "pnpm exec electron-vite build --mode e2e", @@ -4241,6 +4242,7 @@ "Add live SSH or WSL promotion evidence if provider-specific graph restoration diverges." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -4536,7 +4538,7 @@ "providers": ["remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": [], - "coverageNotes": "Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1899 replays sealed Audit1895: workspace-doc-history.test.ts is entirely removed from its current command and testFiles. Supplied recency/dedupe/cap/title/identity examples and the10000-row getter-read budget alarm are intentionally lost. No current assertionRef or active receipt selects that file. Unrelated active receipts and all prior gap literals remain verbatim; no replacement history/index-work coverage or new browser/paired-preview gate execution is claimed. Historical coverage account before Audit1899: Audit1853 reduces LinkActionPopover.test.tsx and archives its complete 2026-09-06 mixed-selector receipt. The lost copy/open-state and Settings callback-order/omission alarms are accepted without equivalent replacement coverage. No fresh execution of this gate is credited. Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1568 removes API inventories, supplied mock-value/forwarding assertions, implementation-shape tables and negative/setup cases that do not reach their intended boundary, without equivalent replacement claims. Retained changed definitions exercise owned manager lifetime/queue/refcount/clamp and real synthetic process/files/staging boundaries. Seventeen unchanged native Electron definitions across this combined audit are statically reviewed and not rerun. Changed native suites exercise local popup wire/cookie/session and clean/native process-identity behavior; known popup-admission flaws remain unfixed. Unit native/event/session/registry inputs remain injected. No actual OS focus, registry/host execution, CRX verification or durable restart proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1564 retires copied cookie key recipes, mock bridge/preview forwarding and flag tables, source-spelling/script inventories and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise actual scoped SQLite merge/rollback/schema refusal, owned cancellation and grant authority/canonical containment, ranged response consistency, replacement guest ownership and executed guest-script promise/DOM cleanup behavior. Session, host response, geometry/observer and transport producers remain injected where documented. One unchanged native extension definition is not rerun locally; no actual remote filesystem, native layout/focus or authentication claim. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1386 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A macOS desktop host and a separate paired Electron client exercise the Explorer preview action end to end: the document renders inside the client-local orca-preview guest, the client gains exactly one browser workspace and it is the document one, the host's own page registry and tab snapshot gain nothing, the split does not take focus from the source editor, an explicit click activates the preview, and closing it with its X leaves the editor and terminal intact. Both host oracles are read in a run where an ordinary URL browser tab from the same client does arrive in them, because a host that cannot project browser pages at all would otherwise answer the absence question the same way. A second journey quits that client with a document tab open and relaunches it on the same profile, which is the restore the user's original report turned on: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit. The same journey pins the guest URL to the orca-preview scheme, so a regression back to file:// or to a host browser page is visible. The rewritten journey caught a live gap the old one could not see: since previews became browser pages they had no chrome to hand focus to their guest, so main refused every reported link click as coming from an unfocused guest and the one route out of a preview was dead. Main's own log answered it — registered true, grant live, focused false — after the embedder reported the anchor really taking six real presses. The pane now hands focus over when it is the reader's surface, and the journey routes. The preview's own components moved out of the editor folder into browser-pane/workspace-doc/ with this change, since a preview is a browser pane and no longer an editor one; their i18n keys keep the historical auto.components.editor.HtmlDocPreview prefix rather than dropping thirty translated strings across four locales for a tidier key path. Seven gate commands named those files by their old paths and were re-issued at the new ones, and the nine dated runs behind them were retired rather than left naming files that are no longer there, on the same principle this gate already applied twice: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. Each retired record's finding is carried into the replacement run recorded below it, including the red half of the entry/subresource pair, which was re-measured by re-applying its mutant at the new path rather than being dropped. The fence over the page-management channels was decided channel by channel before it was built, and that decision record is: of the 23 channels that can name a page, 6 are allowed for a workspace-document page — the tool channels the reader drives, which reach it through the one authority that reads both halves of the registry — 9 refuse (download accept and cancel, devtools, certificate proceed, client page metadata publish, viewport override, WebAuthn account response, registration probe, registration repair), 3 cannot name a page at all because they take a profile or a worktree instead, and the rest are the registration and activation doors, refused on membership. What shipped is not the per-channel guard that classification implies: eleven call sites read the browsing map directly, so a guard per channel is exactly the caller-flag seam that has to be remembered at every future call site. The registry was split in two instead, which makes the classification structural — a document guest is absent from the browsing map, so every refusing channel refuses by absence rather than by a guard, and a channel added later inherits the refusal without being classified at all. Unit contracts cover grant scoping and path containment, per-owner read routing, refusal of a truncated or over-cap read, the old-server binary degradation, scheme admission on will-attach-webview, the guest navigation policy, the plan layer's local/SSH/paired/out-of-worktree routing, and the distinct sentence the reader sees for each failure reason. The paired browser-creation surfaces this gate still owns — capability rejection cleanup, canonical page identity, reconciliation rollback, close convergence — keep their existing headed and headless journeys. Linux and Windows live journeys remain gaps. A refused subresource is a notice on a rendered document rather than a failure panel, since only the entry document's failure leaves the reader with nothing; the entry document is served as text by every owner and cannot be refused for its format at all. Grants die with the renderer document that minted them, at window creation and on every reload, because the renderer holds the only record of which preview owns which grant. The mint and revoke channels answer only the trusted renderer, and a preview tab is never republished to mobile clients, which have no grant to read it with. External URLs leave the preview only via a trusted user click on an anchor while the preview is focused; script-driven navigation and popups reach nothing. The guest's navigation sinks are deny-only and route no URL at all, and the guest carries a preview-only preload, pinned by will-attach-webview and denied to every other attach path, whose capture-phase click handler reports an anchor's URL to main; main answers only a report from a preview guest with a live bound grant that is the focused contents, and only for http(s). Two earlier reader-facing records from 2026-08-26, which measured a shape where a subresource failure was filtered out and the panel still carried an unsupported-asset sentence, were retired with that shape rather than left contradicting the 10/10 runs of the command they share. Two more were retired on the same principle when the external-link design changed: a record showing that removing a recent-input gate let the unattended document open two browser tabs, and a record showing that dropping the webview's allowpopups attribute left a target=_blank press with nothing to route. Both measured machinery that no longer exists — the input gate could not tell a script's navigation from the click it followed, which is the case now recorded below, and the preload intercepts the press before Chromium considers a popup at all, so allowpopups was removed. WebRTC is fenced by the guest's IP-handling policy alone: this Chromium answers a webrtc content-security-policy directive as unrecognized and gathers candidates anyway, so the directive is deliberately absent from the served policy and a unit assertion keeps it out. A standalone Electron probe on the same version gathered 7 candidates including a STUN reflexive one without the policy and 0 with it. Two command paths this gate used to carry no longer exist, and their structured evidence was retired with them rather than left naming files that are no longer there: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. The first is src/renderer/src/lib/file-preview-capability-cleanup.test.ts, deleted in STA-5557 when HTML previews stopped creating paired browser tabs: on 2026-08-12 its five-assertion STA-4063 oracle ran red 5/5 on scan e4c278eb52 and on main bc2e30000b, partially green 2/5 on pre-fix PR #14100, and green 5/5 on candidate 14b5877a75; the surviving half of that oracle is web-runtime-browser-capability-cleanup.test.ts, still commanded above. The second is tests/e2e/paired-remote-html-browser-focus.spec.ts, renamed in STA-5557 to paired-remote-html-preview-local-render.spec.ts because the journey no longer proves anything about browser focus: its 2026-08-12 runs established the owning-runtime routing and no-focus-steal behavior of the then-current browser-tab preview (red on main 346e59c879 and a90a18d43d, green on candidates d05217c40d and b7de9c0961, red again with only the side-preview focus or routing seam disabled), and its 2026-08-26 runs are recorded below under the current path. An adversarial pass after the journey landed found four coverage gaps rather than shipping defects, and all four are pinned here. The page url had a third door: the navigation commit wrote whatever url was reported, unfenced, and while nothing reaches it for a document page today it sat one report away from giving a document page a URL that persistence, the publish boundary and the address bar all read. The group projection was the load-bearing half of the mobile publish boundary that no test had: removing it alone left the whole suite green, because no test in it had tab groups, while the phone payload gained a group whose order and active tab named a document tab it was never sent. The focus handoff was covered only in the narrowing direction, so widening it — dropping the page-activity check, or either half of the reader-surface check — survived both suites. And the handoff itself was offered once and never again, so another app taking the front left the preview's one route out shut until the pane remounted, which is a desktop gap rather than a test-only one. The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical. The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent. The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged. The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite. Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed. Audit1421 removes browser-address-bar-suggestions.test.ts. Document suggestion title/path matching, recency merging and path-prefix ranking alarms are lost. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; the reduced command has no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1899 replays sealed Audit1895: workspace-doc-history.test.ts is entirely removed from its current command and testFiles. Supplied recency/dedupe/cap/title/identity examples and the10000-row getter-read budget alarm are intentionally lost. No current assertionRef or active receipt selects that file. Unrelated active receipts and all prior gap literals remain verbatim; no replacement history/index-work coverage or new browser/paired-preview gate execution is claimed. Historical coverage account before Audit1899: Audit1853 reduces LinkActionPopover.test.tsx and archives its complete 2026-09-06 mixed-selector receipt. The lost copy/open-state and Settings callback-order/omission alarms are accepted without equivalent replacement coverage. No fresh execution of this gate is credited. Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1568 removes API inventories, supplied mock-value/forwarding assertions, implementation-shape tables and negative/setup cases that do not reach their intended boundary, without equivalent replacement claims. Retained changed definitions exercise owned manager lifetime/queue/refcount/clamp and real synthetic process/files/staging boundaries. Seventeen unchanged native Electron definitions across this combined audit are statically reviewed and not rerun. Changed native suites exercise local popup wire/cookie/session and clean/native process-identity behavior; known popup-admission flaws remain unfixed. Unit native/event/session/registry inputs remain injected. No actual OS focus, registry/host execution, CRX verification or durable restart proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1564 retires copied cookie key recipes, mock bridge/preview forwarding and flag tables, source-spelling/script inventories and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise actual scoped SQLite merge/rollback/schema refusal, owned cancellation and grant authority/canonical containment, ranged response consistency, replacement guest ownership and executed guest-script promise/DOM cleanup behavior. Session, host response, geometry/observer and transport producers remain injected where documented. One unchanged native extension definition is not rerun locally; no actual remote filesystem, native layout/focus or authentication claim. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1386 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A macOS desktop host and a separate paired Electron client exercise the Explorer preview action end to end: the document renders inside the client-local orca-preview guest, the client gains exactly one browser workspace and it is the document one, the host's own page registry and tab snapshot gain nothing, the split does not take focus from the source editor, an explicit click activates the preview, and closing it with its X leaves the editor and terminal intact. Both host oracles are read in a run where an ordinary URL browser tab from the same client does arrive in them, because a host that cannot project browser pages at all would otherwise answer the absence question the same way. A second journey quits that client with a document tab open and relaunches it on the same profile, which is the restore the user's original report turned on: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit. The same journey pins the guest URL to the orca-preview scheme, so a regression back to file:// or to a host browser page is visible. The rewritten journey caught a live gap the old one could not see: since previews became browser pages they had no chrome to hand focus to their guest, so main refused every reported link click as coming from an unfocused guest and the one route out of a preview was dead. Main's own log answered it — registered true, grant live, focused false — after the embedder reported the anchor really taking six real presses. The pane now hands focus over when it is the reader's surface, and the journey routes. The preview's own components moved out of the editor folder into browser-pane/workspace-doc/ with this change, since a preview is a browser pane and no longer an editor one; their i18n keys keep the historical auto.components.editor.HtmlDocPreview prefix rather than dropping thirty translated strings across four locales for a tidier key path. Seven gate commands named those files by their old paths and were re-issued at the new ones, and the nine dated runs behind them were retired rather than left naming files that are no longer there, on the same principle this gate already applied twice: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. Each retired record's finding is carried into the replacement run recorded below it, including the red half of the entry/subresource pair, which was re-measured by re-applying its mutant at the new path rather than being dropped. The fence over the page-management channels was decided channel by channel before it was built, and that decision record is: of the 23 channels that can name a page, 6 are allowed for a workspace-document page — the tool channels the reader drives, which reach it through the one authority that reads both halves of the registry — 9 refuse (download accept and cancel, devtools, certificate proceed, client page metadata publish, viewport override, WebAuthn account response, registration probe, registration repair), 3 cannot name a page at all because they take a profile or a worktree instead, and the rest are the registration and activation doors, refused on membership. What shipped is not the per-channel guard that classification implies: eleven call sites read the browsing map directly, so a guard per channel is exactly the caller-flag seam that has to be remembered at every future call site. The registry was split in two instead, which makes the classification structural — a document guest is absent from the browsing map, so every refusing channel refuses by absence rather than by a guard, and a channel added later inherits the refusal without being classified at all. Unit contracts cover grant scoping and path containment, per-owner read routing, refusal of a truncated or over-cap read, the old-server binary degradation, scheme admission on will-attach-webview, the guest navigation policy, the plan layer's local/SSH/paired/out-of-worktree routing, and the distinct sentence the reader sees for each failure reason. The paired browser-creation surfaces this gate still owns — capability rejection cleanup, canonical page identity, reconciliation rollback, close convergence — keep their existing headed and headless journeys. Linux and Windows live journeys remain gaps. A refused subresource is a notice on a rendered document rather than a failure panel, since only the entry document's failure leaves the reader with nothing; the entry document is served as text by every owner and cannot be refused for its format at all. Grants die with the renderer document that minted them, at window creation and on every reload, because the renderer holds the only record of which preview owns which grant. The mint and revoke channels answer only the trusted renderer, and a preview tab is never republished to mobile clients, which have no grant to read it with. External URLs leave the preview only via a trusted user click on an anchor while the preview is focused; script-driven navigation and popups reach nothing. The guest's navigation sinks are deny-only and route no URL at all, and the guest carries a preview-only preload, pinned by will-attach-webview and denied to every other attach path, whose capture-phase click handler reports an anchor's URL to main; main answers only a report from a preview guest with a live bound grant that is the focused contents, and only for http(s). Two earlier reader-facing records from 2026-08-26, which measured a shape where a subresource failure was filtered out and the panel still carried an unsupported-asset sentence, were retired with that shape rather than left contradicting the 10/10 runs of the command they share. Two more were retired on the same principle when the external-link design changed: a record showing that removing a recent-input gate let the unattended document open two browser tabs, and a record showing that dropping the webview's allowpopups attribute left a target=_blank press with nothing to route. Both measured machinery that no longer exists — the input gate could not tell a script's navigation from the click it followed, which is the case now recorded below, and the preload intercepts the press before Chromium considers a popup at all, so allowpopups was removed. WebRTC is fenced by the guest's IP-handling policy alone: this Chromium answers a webrtc content-security-policy directive as unrecognized and gathers candidates anyway, so the directive is deliberately absent from the served policy and a unit assertion keeps it out. A standalone Electron probe on the same version gathered 7 candidates including a STUN reflexive one without the policy and 0 with it. Two command paths this gate used to carry no longer exist, and their structured evidence was retired with them rather than left naming files that are no longer there: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. The first is src/renderer/src/lib/file-preview-capability-cleanup.test.ts, deleted in STA-5557 when HTML previews stopped creating paired browser tabs: on 2026-08-12 its five-assertion STA-4063 oracle ran red 5/5 on scan e4c278eb52 and on main bc2e30000b, partially green 2/5 on pre-fix PR #14100, and green 5/5 on candidate 14b5877a75; the surviving half of that oracle is web-runtime-browser-capability-cleanup.test.ts, still commanded above. The second is tests/e2e/paired-remote-html-browser-focus.spec.ts, renamed in STA-5557 to paired-remote-html-preview-local-render.spec.ts because the journey no longer proves anything about browser focus: its 2026-08-12 runs established the owning-runtime routing and no-focus-steal behavior of the then-current browser-tab preview (red on main 346e59c879 and a90a18d43d, green on candidates d05217c40d and b7de9c0961, red again with only the side-preview focus or routing seam disabled), and its 2026-08-26 runs are recorded below under the current path. An adversarial pass after the journey landed found four coverage gaps rather than shipping defects, and all four are pinned here. The page url had a third door: the navigation commit wrote whatever url was reported, unfenced, and while nothing reaches it for a document page today it sat one report away from giving a document page a URL that persistence, the publish boundary and the address bar all read. The group projection was the load-bearing half of the mobile publish boundary that no test had: removing it alone left the whole suite green, because no test in it had tab groups, while the phone payload gained a group whose order and active tab named a document tab it was never sent. The focus handoff was covered only in the narrowing direction, so widening it — dropping the page-activity check, or either half of the reader-surface check — survived both suites. And the handoff itself was offered once and never again, so another app taking the front left the preview's one route out shut until the pane remounted, which is a desktop gap rather than a test-only one. The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical. The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent. The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged. The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite. Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed. Audit1421 removes browser-address-bar-suggestions.test.ts. Document suggestion title/path matching, recency merging and path-prefix ranking alarms are lost. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; the reduced command has no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-5557/remote-html-preview-render-workspace-files-locally-over-the-file", "https://linear.app/stably/issue/STA-3872/unable-to-open-html-files-in-remote-server", @@ -4547,7 +4549,7 @@ "https://github.com/stablyai/orca/pull/13876" ], "invariant": "Opening one HTML preview from a paired client renders the workspace document in exactly one client-local browser tab, located by that document and served over the orca-preview scheme. The client gains exactly that one browser workspace and it is the document one — blank where a URL page carries a URL, named by the document, with the chip naming the file — while the host gains no browser page at all, neither in its own page registry nor in the tab snapshot its clients publish into. The preview occupies its own split without taking focus from the source editor; an explicit click activates it, and closing it removes only the preview. Following a document from a file link is the other half of that switch and does move the reader to it, tab group included, whether the preview is new or already open, because opening a file is a request to look at it. A document tab quit with the client comes back as the same row on a grant the relaunched client mints afresh. A preview is named by the browser page it is open in, not by a namespace of its own, and the page registry has two halves: a workspace-document guest is registered in its own map and is absent from the browsing one entirely. That absence is the fence. Page, session and profile management, agent tab enumeration and command targeting, download routing and certificate attribution all read the browsing map directly, in more places than a per-channel guard could be remembered in, so none of them can name a document page and none of them carries a guard. Browser tools the reader drives (element grab, hover describe, selection capture, the annotation viewport bridge) are the one operation that legitimately spans the halves, and they go through the single authority that reads both, keyed by the page and its hosting renderer. The halves are disjoint in both directions: browsing registration refuses a page the document half already holds, and minting a grant refuses a page the browsing half already holds, so one id can never name a surface in both. The headless backend acts on that refusal by destroying the window it had already opened rather than leaving a policy-less page behind an id nothing can drive, keeping nothing under that id for its own shutdown to hand back. Registration refuses on the same terms when the guest it was asked about is already gone. The exit door is guarded in both its halves: a preview withdraws by revoking its grant and never through the unregister channel, so a page the document half holds arriving there is refused before either the registration teardown or the grab-state disposal beside it, which would otherwise drop the intent an in-flight preview grab compares by identity and leave that grab answering ok without ever arming its guest. A bridge request whose guest does not resolve is refused without tearing down the page it named, so a misaddressed request cannot cancel a healthy page's in-flight downloads and grabs. The annotation viewport bridge resolves its guest when its serialized op actually runs rather than when the request arrived, so a cross-process navigation while it waited cannot leave the bridge installed in a retired guest while the reader looks at a new one. State main keys by a preview's page is disposed when that page's grant is revoked, which is the only signal a preview's surface is gone. A tool asking for a page whose guest has not attached yet waits for that registration and arms when it arrives, rather than answering not-ready at the reader; that wait resolves only the request already naming this page, never the worktree-wide or any-tab waits the CLI and agents use to ask for a browser tab to drive. Handing the previewed document to the reader's own machine routes on the owners its grant was minted against — the file's own connection owner and the worktree's own runtime owner, neither read from the tab's stored fields. Only a document proven to live on this machine reaches the client OS; one with a resolved remote owner is downloaded first; and one whose owner cannot be resolved at all, workspace root included, is refused with a message naming that, because the download route would otherwise read the same absolute path on the client and hand back a same-named local file under the remote document's name. A runtime-owned path that falls outside its worktree root is refused by that route itself and surfaces as a failure toast rather than a download. Nothing the document does writes a file to this machine either: the preview partition denies downloads outright instead of routing them through the browser download flow, which has no page to attribute a preview's bytes to and would otherwise reserve a name in this desktop's Downloads folder and write them there unprompted. That refusal is visible to the reader and invisible to the document: the preview's shell carries a fixed sentence saying downloads are off, published at most once per preview per interval so a document asking in a loop cannot fill Orca's chrome, while the page itself gets back exactly what it got before, which is nothing. The sentence names no file, because the document chooses the name it offers; and a refusal never takes the document away the way an entry document's own failure does, whatever it names. A preview is a browser tab, not an editor tab in a preview mode: it is named the way a browser tab is named — by the document it shows when that document declares a title, and by the file it shows when it does not — while the chip goes on naming the file and the host whatever the document calls itself. A title is refused on the same terms the url is: a document that declares none has Chromium report the grant URL as its title, and that title is stored, mirrored onto the tab and written to disk, so anything carrying the scheme falls back to the file instead. It is created by the preview action as a page located by its document, it carries the workspace-relative path copy the editor's path header owned, and closing it revokes the grant that made the document readable while a URL tab closing beside it revokes nothing. Chrome persisted by builds that made previews editor tabs is dropped on restore rather than coming back naming a surface no restore can produce, and the ordinary editor tab for the same document is left alone. A document tab is held back at the mobile publish boundary — no client holds its grant, and the wire has no tab kind for it — while an ordinary browser tab beside it still publishes. It is held back from the group projection that publishes tab order, recency and group activity as well as from the tab list itself, so no published group names a tab the phone is never sent. A browser page can be located by a workspace document instead of a URL, and the document is the whole of its stored identity. The grant and the orca-preview URL that document is served over are minted when the page mounts and replaced by a hard reload, so neither is ever written to the page's url, mirrored onto its tab, persisted or published: such a page's url is the blank URL from creation through restore, including when a session written elsewhere carries a grant URL in, and what the session carries is the worktree and path a restored page mints afresh against today's owners. Every door onto a page's url holds that line — creation, the title update, and the navigation commit alike — so a report about a document page cannot give it a URL it never had, and the title fallback and the loading affordance follow the url each door actually wrote. The mirror carries the document too, so a tab entry cannot go on naming a document its active page has left. Every guest in the app is policy-attached through one door: a workspace document takes a restricted profile there rather than a separate installer beside it, so the attachment bookkeeping that door owns — what registration refuses, and what teardown frees — covers a preview on the same terms as a browsing page, and a preview takes none of the browsing machinery that door installs. That authority answers from the moment the embedder hands the guest over rather than only after a later navigation: the guest binds to the grant it is already showing, so the tools reach the document the reader opened and not just one they navigated to. A read the host reports as truncated or over-cap is refused rather than served partially, and a document outside the paired worktree is refused with a message naming that boundary instead of a bare read failure. The rendered document reaches nothing off-machine on its own: every served response carries a self-only content security policy, the preview session cancels any request that is not in-document, subframes cannot navigate outside the grant, a guest no document has yet bound to a grant may not navigate at all, the guest gathers no ICE candidates, and an SSH path that canonicalizes outside the grant root is refused before it is read. The one route out is a link the reader presses: a trusted click on an anchor, reported by the preview's own preload from a guest still bound to a live grant, leaves through the configured browser destination and captured source route — and only after the reader confirms the exact destination URL, so a document cannot spend a single stray press exfiltrating what it can read into a link it authored. The preview hands its guest that focus itself whenever it is the surface the reader is in — a browsing page gets it from the chrome around it, and a preview has no chrome to get it from — and it does so only then, so a preview mounted behind a terminal or an editor never takes the keyboard from what the reader is actually in. It offers again when the window itself takes focus back and nothing in the embedder has claimed that focus, because another app coming to the front lands focus on the embedder rather than the guest and the route out would otherwise stay shut until something remounted the pane — while the same window focus also arrives when the reader presses a tab, that being the guest's own blur returning, and taking focus back from there would fight the reader for their own click. Nothing else does. A navigation or popup the document starts by itself is swallowed whatever else is happening, including immediately after a genuine press elsewhere in the document, so a page that can read its grant cannot hand it to a browser tab; a middle click opens nothing; and a fragment link is answered inside the document. A preview attach carries the preview preload and no renderer-supplied one, and no other attach path can acquire it. A subresource the workspace will not send degrades the document to a notice naming that file, never to a failure panel over a page that rendered. A grant outlives neither the tab that owns it nor the renderer document that minted it, and only the trusted renderer can mint or revoke one. For the browser creations this gate still owns, owner-pinned creation returns the canonical host page identity before navigation readiness; delayed navigation cannot turn a created page into an unidentifiable failure or a duplicate retry. Capability rejection before host mutation must preserve the original error, issue no RPC, surface a failure toast, and remove only a caller-declared newly-created empty split. Post-create reconciliation failure requires exact rollback; ambiguous rollback rejects without local fallback.", - "oracle": "Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1421 narrows renderer unit coverage as recorded in coverageNotes. Prior oracle descriptions are historical for the changed suite. The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): In paired Electron, write an HTML fixture that declares its own title on the host, invoke the Explorer preview action on the client, and require the document text to be readable out of the orca-preview guest before judging any absence. With that presence established, require the client to hold exactly one browser workspace more than its baseline and that workspace to be the document one: page and tab url blank, the document path mirrored onto both, the tab named by the document's title, the chip naming the file, no editor row of the retired preview species anywhere, and the guest URL carrying the orca-preview scheme. Ask the host through its own page registry as well as through the tab snapshot, and in the same run open an ordinary URL browser tab from the same client and require that one to arrive in both — the presence precondition without which “the host gained nothing” is satisfied just as well by an oracle that cannot see browser pages at all. Require the preview to sit in a group other than the source editor's while the active group and tab remain the source editor's. Then click away to the terminal, click the preview tab, require it to reactivate and still render, close it with its own X, and require the document tab to be gone while the host still holds only the URL tab and the source group, source editor and terminal survive. Quit the client with a document tab open and relaunch it on the same profile: require the same workspace row to come back, blank and named by the document, rendering the document again over a grant URL that differs from the one that was quit, with no preview-scheme or document-named page anywhere in what the host holds. Prove the halves are live by flipping one product property at a time and requiring the run to fail: publish document workspaces to the host like ordinary ones, and stop mirroring the document onto the workspace row. Have the fixture document attempt its own egress on every load — an unattended window.open and location.href to an off-machine URL, plus an inline ICE gathering probe — and require the same baseline counts and a candidate count of zero, so the document's own attempts are measured rather than assumed. Then, as a separate phase after the close oracle has already run, bring the client window to the front, press the document's heading with a real mouse event, and require the document to report that the same press drove it to attempt a second window.open and location.href while both browser counts stay at that phase's baseline and nothing routes — the case a recent-input gate cannot distinguish from the press's own effect. Only then press the target=_blank link with a real mouse event and require both a recorded routing call that returned success and a browser count above that baseline, with the preview tab still open. Drive the preload's click policy as a unit oracle over a real document: a dispatched click, a trusted press on an external anchor, an anchor reached through what it wraps, an SVG animated href, a sibling preview link, fragment and percent-encoded fragment targets, a bare hash, and a middle click. Create a browser page located by a workspace document, handing creation a live grant URL, and require its stored url, its mirrored tab url and the written session payload all to be blank with no orca-preview string anywhere in what was written, while an ordinary page created the same way keeps the URL it was given and asks for the address bar the document page never does. Parse the written page and tab through the session schema and require the document to survive both halves. Hydrate them back and require the document page to return blank and still named — including when its page row was salvaged away and only the tab's own copy remains, and when a foreign session carried a grant URL into both rows. Drive the mirror across a page switch out of the document and back, and across a repair in which the document is the only mirrored field that differs. Name a document page from its document and require the tab to take that name, name it with an empty title and require the file, name it with a live grant URL and require the file again with no preview scheme anywhere in the written session, and require an ordinary blank browser tab beside it to still be called New Tab. Dispatch a title update out of a rendered preview's own guest and require it to reach the page state while the identity chip still reads the document's workspace-relative path. Attach a browsing guest and a workspace-document guest through the same method in one run and require the browsing one to take clicked-link routing, popup handling and auth-identity detach tracking while the document guest takes none of them, stays inside the grant it is showing, denies every window it asks for, and is dropped from the page-keyed document registry by the same teardown that frees its id for a later attach. Register a browsing guest and attach a workspace-document guest in one run against the real manager, require the one door to answer each page with the guest of its own half, and require the document page to be absent from the browsing map and from its enumeration. Drive both browsing registration entry points with a page the document half already holds and require them to register nothing, and drive the mint channel with a page the browsing half already holds and require it to refuse; and drive the offscreen one with a guest that is missing and with one already destroyed, requiring the same refusal. Arm a grab on a live preview target, drive the unregister channel at that same target in the window before the queued operation runs, and require the grab to reach the guest anyway — then drive the same sequence for an ordinary browser page and require its grab state to be disposed after all. Hold one viewport-bridge op open, queue a second behind it, swap the page's guest while that second op waits, and require the injection to land in the guest the page has then. Revoke a grant after a tool has run against its page and require that page's grab state to be cancelled and disposed. Ask a tool for a document page whose guest has not attached, require the request to park in the registration wait, attach the guest, and require the same request to arm on it; require a page nothing ever renders to answer not-ready once that wait elapses. With a document open, ask a tool for a browsing page id and require it to be answered by the browsing half or not at all, with the same channel reaching the document guest under the page it really renders. Drive open-externally for a document whose per-file owner is remote while the workspace-scoped owner is unresolved, for a runtime-owned worktree whose preview tab carries no runtime id of its own, and for a worktree that resolves no runtime owner while the tab still carries one, requiring the download route in each; and for an owner that cannot be resolved at all, and for an unknown workspace root while nothing names another host, requiring a refusal that neither opens nor downloads. Drive the headless backend with a page the document half already holds and require it to reject, destroy the window, and unregister nothing — then shut the backend down and require it still to have unregistered nothing. Navigate a bound preview guest at a second grant through both latch events and require it to stay on the grant it bound to. Mount a preview while a renderer drag is already in flight and require its guest to be click-through at the moment it is appended, not a turn later. Render the editor panel shell in each remaining tab mode and require the path header exactly where the surface does not already name itself. Drive the preview action and require a browser tab located by the document rather than an editor tab, require a second open of the same document to activate the tab it is already in, and require closing that tab to revoke its grant while a URL tab closed beside it revokes none. Publish a worktree holding a document tab and a URL tab and require only the URL tab to reach the mobile snapshot. Install the shared partition policies for a preview partition and for an ordinary browsing partition in the same run, fire each one's own will-download listener, and require the preview's to cancel while the browsing one still reaches the download router — then require the preview protocol installer to be what asks for that deny. In the same run, require the cancelled download to raise a reader-facing notice and the routed one to raise none. require the guest registry to name the bound grant for a live preview guest and nothing for a contents that is not one, has committed no document, or is gone. Drive the shell with a refusal and require one fixed sentence, still one row after three more refusals, standing beside an asset failure rather than being counted with it, gone behind the failure panel, and ignored when it names another preview's grant. Drive the main-side report gate directly for a sender that is no preview guest, a guest with no bound or a revoked grant, a genuine press Electron's webview focus flag misreports as unfocused, and non-web URLs; drive the reader-facing confirmation for accept, cancel, and a confirmed tab the browser refuses; and drive will-attach-webview in both preload directions. Run the per-owner reader, grant-containment, scheme-admission, guest-policy, and plan-routing contracts as unit oracles, including a host-reported truncation, an over-cap binary, and an out-of-worktree paired path. Drive the reader-facing component with the payloads the reader can actually produce — the entry document fails only as truncated or unreadable, a subresource additionally as a refused format — and require the asset case to leave the guest mounted. Drive the closed-tab cleanup hook, the window installer, and the grant IPC handlers directly, requiring the grant to be released when the preview tab closes, cleared at window creation and on a cross-document main-frame navigation, and refused to any sender that is not the trusted renderer. For the browser creations this gate still owns, run the unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host, requiring the original unsupported error or visible toast, zero RPCs, and no retained new split; hold a real navigation response beyond the 15-second client deadline after host creation and require the first RPC to return the exact host inventory page ID, one host page, and no retry; repeat reconciliation faults against headless serve and retain the separate exact-page reconciliation rollback oracle.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1421 narrows renderer unit coverage as recorded in coverageNotes. Prior oracle descriptions are historical for the changed suite. The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): In paired Electron, write an HTML fixture that declares its own title on the host, invoke the Explorer preview action on the client, and require the document text to be readable out of the orca-preview guest before judging any absence. With that presence established, require the client to hold exactly one browser workspace more than its baseline and that workspace to be the document one: page and tab url blank, the document path mirrored onto both, the tab named by the document's title, the chip naming the file, no editor row of the retired preview species anywhere, and the guest URL carrying the orca-preview scheme. Ask the host through its own page registry as well as through the tab snapshot, and in the same run open an ordinary URL browser tab from the same client and require that one to arrive in both — the presence precondition without which “the host gained nothing” is satisfied just as well by an oracle that cannot see browser pages at all. Require the preview to sit in a group other than the source editor's while the active group and tab remain the source editor's. Then click away to the terminal, click the preview tab, require it to reactivate and still render, close it with its own X, and require the document tab to be gone while the host still holds only the URL tab and the source group, source editor and terminal survive. Quit the client with a document tab open and relaunch it on the same profile: require the same workspace row to come back, blank and named by the document, rendering the document again over a grant URL that differs from the one that was quit, with no preview-scheme or document-named page anywhere in what the host holds. Prove the halves are live by flipping one product property at a time and requiring the run to fail: publish document workspaces to the host like ordinary ones, and stop mirroring the document onto the workspace row. Have the fixture document attempt its own egress on every load — an unattended window.open and location.href to an off-machine URL, plus an inline ICE gathering probe — and require the same baseline counts and a candidate count of zero, so the document's own attempts are measured rather than assumed. Then, as a separate phase after the close oracle has already run, bring the client window to the front, press the document's heading with a real mouse event, and require the document to report that the same press drove it to attempt a second window.open and location.href while both browser counts stay at that phase's baseline and nothing routes — the case a recent-input gate cannot distinguish from the press's own effect. Only then press the target=_blank link with a real mouse event and require both a recorded routing call that returned success and a browser count above that baseline, with the preview tab still open. Drive the preload's click policy as a unit oracle over a real document: a dispatched click, a trusted press on an external anchor, an anchor reached through what it wraps, an SVG animated href, a sibling preview link, fragment and percent-encoded fragment targets, a bare hash, and a middle click. Create a browser page located by a workspace document, handing creation a live grant URL, and require its stored url, its mirrored tab url and the written session payload all to be blank with no orca-preview string anywhere in what was written, while an ordinary page created the same way keeps the URL it was given and asks for the address bar the document page never does. Parse the written page and tab through the session schema and require the document to survive both halves. Hydrate them back and require the document page to return blank and still named — including when its page row was salvaged away and only the tab's own copy remains, and when a foreign session carried a grant URL into both rows. Drive the mirror across a page switch out of the document and back, and across a repair in which the document is the only mirrored field that differs. Name a document page from its document and require the tab to take that name, name it with an empty title and require the file, name it with a live grant URL and require the file again with no preview scheme anywhere in the written session, and require an ordinary blank browser tab beside it to still be called New Tab. Dispatch a title update out of a rendered preview's own guest and require it to reach the page state while the identity chip still reads the document's workspace-relative path. Attach a browsing guest and a workspace-document guest through the same method in one run and require the browsing one to take clicked-link routing, popup handling and auth-identity detach tracking while the document guest takes none of them, stays inside the grant it is showing, denies every window it asks for, and is dropped from the page-keyed document registry by the same teardown that frees its id for a later attach. Register a browsing guest and attach a workspace-document guest in one run against the real manager, require the one door to answer each page with the guest of its own half, and require the document page to be absent from the browsing map and from its enumeration. Drive both browsing registration entry points with a page the document half already holds and require them to register nothing, and drive the mint channel with a page the browsing half already holds and require it to refuse; and drive the offscreen one with a guest that is missing and with one already destroyed, requiring the same refusal. Arm a grab on a live preview target, drive the unregister channel at that same target in the window before the queued operation runs, and require the grab to reach the guest anyway — then drive the same sequence for an ordinary browser page and require its grab state to be disposed after all. Hold one viewport-bridge op open, queue a second behind it, swap the page's guest while that second op waits, and require the injection to land in the guest the page has then. Revoke a grant after a tool has run against its page and require that page's grab state to be cancelled and disposed. Ask a tool for a document page whose guest has not attached, require the request to park in the registration wait, attach the guest, and require the same request to arm on it; require a page nothing ever renders to answer not-ready once that wait elapses. With a document open, ask a tool for a browsing page id and require it to be answered by the browsing half or not at all, with the same channel reaching the document guest under the page it really renders. Drive open-externally for a document whose per-file owner is remote while the workspace-scoped owner is unresolved, for a runtime-owned worktree whose preview tab carries no runtime id of its own, and for a worktree that resolves no runtime owner while the tab still carries one, requiring the download route in each; and for an owner that cannot be resolved at all, and for an unknown workspace root while nothing names another host, requiring a refusal that neither opens nor downloads. Drive the headless backend with a page the document half already holds and require it to reject, destroy the window, and unregister nothing — then shut the backend down and require it still to have unregistered nothing. Navigate a bound preview guest at a second grant through both latch events and require it to stay on the grant it bound to. Mount a preview while a renderer drag is already in flight and require its guest to be click-through at the moment it is appended, not a turn later. Render the editor panel shell in each remaining tab mode and require the path header exactly where the surface does not already name itself. Drive the preview action and require a browser tab located by the document rather than an editor tab, require a second open of the same document to activate the tab it is already in, and require closing that tab to revoke its grant while a URL tab closed beside it revokes none. Publish a worktree holding a document tab and a URL tab and require only the URL tab to reach the mobile snapshot. Install the shared partition policies for a preview partition and for an ordinary browsing partition in the same run, fire each one's own will-download listener, and require the preview's to cancel while the browsing one still reaches the download router — then require the preview protocol installer to be what asks for that deny. In the same run, require the cancelled download to raise a reader-facing notice and the routed one to raise none. require the guest registry to name the bound grant for a live preview guest and nothing for a contents that is not one, has committed no document, or is gone. Drive the shell with a refusal and require one fixed sentence, still one row after three more refusals, standing beside an asset failure rather than being counted with it, gone behind the failure panel, and ignored when it names another preview's grant. Drive the main-side report gate directly for a sender that is no preview guest, a guest with no bound or a revoked grant, a genuine press Electron's webview focus flag misreports as unfocused, and non-web URLs; drive the reader-facing confirmation for accept, cancel, and a confirmed tab the browser refuses; and drive will-attach-webview in both preload directions. Run the per-owner reader, grant-containment, scheme-admission, guest-policy, and plan-routing contracts as unit oracles, including a host-reported truncation, an over-cap binary, and an out-of-worktree paired path. Drive the reader-facing component with the payloads the reader can actually produce — the entry document fails only as truncated or unreadable, a subresource additionally as a refused format — and require the asset case to leave the guest mounted. Drive the closed-tab cleanup hook, the window installer, and the grant IPC handlers directly, requiring the grant to be released when the preview tab closes, cleared at window creation and on a cross-document main-frame navigation, and refused to any sender that is not the trusted renderer. For the browser creations this gate still owns, run the unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host, requiring the original unsupported error or visible toast, zero RPCs, and no retained new split; hold a real navigation response beyond the 15-second client deadline after host creation and require the first RPC to return the exact host inventory page ID, one host page, and no retry; repeat reconciliation faults against headless serve and retain the separate exact-page reconciliation rollback oracle.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/lib/doc-preview-grants.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts", @@ -5042,6 +5044,7 @@ "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.", @@ -6161,10 +6164,10 @@ "providers": ["local", "daemon", "ssh", "remote-runtime", "wsl"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "remote-runtime"], - "coverageNotes": "Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host/parser, process-classifier, snapshot-publication, mixed-version, renderer, and macOS Electron coverage proves the local and shared paired-runtime contracts. Direct SSH intentionally publishes no shell proof and immediately preserves incumbent behavior. WSL, Windows ConPTY, Linux desktop, and paired headed/headless journeys remain gaps. The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage. Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/daemon/terminal-host-concurrent-create.test.ts reduced. Loses race deduplication, attach during unsettled ownership proof, retry after failed spawn, distinct-session parallelism, disposal waiting and shutdown retry-fencing alarms bundled with removed internal-call counts or real-time waits. No replacement-equivalence claim. src/main/daemon/terminal-checkpoint-serializer.test.ts reduced. Loses bounded native conversion/no-whole-candidate materialization and snapshot getter single-read alarms. Retained byte-size outcomes do not establish CPU/allocation bounds. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host/parser, process-classifier, snapshot-publication, mixed-version, renderer, and macOS Electron coverage proves the local and shared paired-runtime contracts. Direct SSH intentionally publishes no shell proof and immediately preserves incumbent behavior. WSL, Windows ConPTY, Linux desktop, and paired headed/headless journeys remain gaps. The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage. Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/daemon/terminal-host-concurrent-create.test.ts reduced. Loses race deduplication, attach during unsettled ownership proof, retry after failed spawn, distinct-session parallelism, disposal waiting and shutdown retry-fencing alarms bundled with removed internal-call counts or real-time waits. No replacement-equivalence claim. src/main/daemon/terminal-checkpoint-serializer.test.ts reduced. Loses bounded native conversion/no-whole-candidate materialization and snapshot getter single-read alarms. Retained byte-size outcomes do not establish CPU/allocation bounds. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": ["https://github.com/stablyai/orca/pull/16379"], "invariant": "After a TUI exits or is killed, reveal, reattach, snapshot replay, or renderer remount must not deliver terminal-owned mouse or alternate-screen protocol bytes to the surviving shell. Recovery is an ordered output barrier in the daemon session data path: an OSC 133;D completing while the alternate screen is still active pauses the stream at that exact byte boundary, a fresh execution-host process inspection proves shell ownership, and on proof a mode reset is injected as in-stream output so every consumer converges by parsing the same bytes and the queued post-boundary shell output (the prompt) lands on the normal buffer. Snapshots are pure reads. Any failure — refuted proof, timeout, queue overflow, session death, disposal — flushes the queue unmodified, preserving incumbent behavior; later command or mode bytes revoke proof. Clean alternate-screen exits prove ownership asynchronously without pausing.", - "oracle": "Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Run one fixed child-TUI journey for normal exit and cleanup-free SIGKILL. Assert renderer and host normal-buffer/non-mouse state, host snapshot terminalOwner metadata, exact PTY writes with no post-exit mouse report, unrelated-pane survival, post-boundary prompt output preserved (normal exit), ordered proof invalidation, bounded settlement and bail-out flush, one inspection per unclean episode with zero scans for ordinary output, split-escape safety at every chunk boundary, and old/new client-host fallback parity.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Run one fixed child-TUI journey for normal exit and cleanup-free SIGKILL. Assert renderer and host normal-buffer/non-mouse state, host snapshot terminalOwner metadata, exact PTY writes with no post-exit mouse report, unrelated-pane survival, post-boundary prompt output preserved (normal exit), ordered proof invalidation, bounded settlement and bail-out flush, one inspection per unclean episode with zero scans for ordinary output, split-escape safety at every chunk boundary, and old/new client-host fallback parity.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/mobile-presence-lock.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot", "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot", @@ -6249,6 +6252,7 @@ "Keep missing-proof mixed-version behavior identical to the incumbent client path." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.", @@ -6665,7 +6669,7 @@ "providers": ["local", "daemon", "ssh", "runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh", "runtime"], - "coverageNotes": "Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability and same-incarnation handle continuity; persisted-empty restart suppression remains historical Electron evidence, alongside replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. The retained paired journey covers the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId. The repeated target-after-unrelated-terminal journey was retired; its separate ordering alarm is no longer provided. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here. The synthetic default-tabs unit suite was retired: its explicit-empty/default-tab assertions no longer supply unit evidence. This retirement supplies no new persisted-restart, runtime-routing, cross-platform, or mobile evidence; existing historical runs and counts remain historical. The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged. The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical. The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its former 100-tab scan-count case was subsequently retired too; no assertion remains in that suite. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical. The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability and same-incarnation handle continuity; persisted-empty restart suppression remains historical Electron evidence, alongside replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. The retained paired journey covers the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId. The repeated target-after-unrelated-terminal journey was retired; its separate ordering alarm is no longer provided. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here. The synthetic default-tabs unit suite was retired: its explicit-empty/default-tab assertions no longer supply unit evidence. This retirement supplies no new persisted-restart, runtime-routing, cross-platform, or mobile evidence; existing historical runs and counts remain historical. The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged. The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical. The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its former 100-tab scan-count case was subsequently retired too; no assertion remains in that suite. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical. The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-4327", "https://github.com/stablyai/orca/pull/14590", @@ -6674,7 +6678,7 @@ "https://github.com/stablyai/orca/issues/14524" ], "invariant": "Close permanently removes the owned provider session, agent descendants, persisted tab/layout authority, and resume authority even when no TerminalPane is mounted; final-pane CLI close commits durable tab retirement before PTY stop can publish graph loss, does not acknowledge before that retirement, and treats the later exit retirement as idempotent. Workspace-wide CLI close applies that same durable contract to every terminal in exactly one worktree, including pinned and persisted-only surfaces, without touching sibling-worktree PTYs or resume records. A persisted explicit-empty state prevents initial-tab fallback from repopulating the workspace after reload or restart. A handle remains valid while the same provider-attested PTY incarnation survives renderer reload or re-key, and becomes stale without adopting a replacement incarnation. A terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.", - "oracle": "Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. terminal.closeAll must force-retire every pinned and unpinned target surface, clear its persisted agent-resume and incarnation records, await authoritative PTY exit, preserve a sibling worktree's tab, PTY, and resume authority, and return an unverifiable failure instead of claiming exit when the owning host does not confirm a stop. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. terminal.closeAll must force-retire every pinned and unpinned target surface, clear its persisted agent-resume and incarnation records, await authoritative PTY exit, preserve a sibling worktree's tab, PTY, and resume authority, and return an unverifiable failure instead of claiming exit when the owning host does not confirm a stop. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts", @@ -6867,6 +6871,7 @@ "Add restart/no-resurrection and repeated park-close soak coverage." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -6917,7 +6922,7 @@ "providers": ["daemon", "runtime", "ssh", "wsl"], "coveredPlatforms": ["linux", "macos", "windows"], "coveredProviders": ["daemon", "runtime"], - "coverageNotes": "Audit2020: The CLI WebSocket source retains old-protocol refusal only; its paired-open, capability, timeout and admission projection examples are removed. No daemon-generation coverage is transferred to that callback. Both independent daemon E2E receipts remain unchanged at their original commands; the reduced unit selector has no fresh result. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The browser auth capability-advertisement case is removed in this audit; its direct encrypted-auth literal alarm is lost. Retained lifecycle evidence is not an equivalent replacement. Historical run commands and results remain historical. Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps. The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage. The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage. The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: The CLI WebSocket source retains old-protocol refusal only; its paired-open, capability, timeout and admission projection examples are removed. No daemon-generation coverage is transferred to that callback. Both independent daemon E2E receipts remain unchanged at their original commands; the reduced unit selector has no fresh result. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The browser auth capability-advertisement case is removed in this audit; its direct encrypted-auth literal alarm is lost. Retained lifecycle evidence is not an equivalent replacement. Historical run commands and results remain historical. Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps. The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage. The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage. The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/9749", "https://github.com/stablyai/orca/issues/9949", @@ -6926,7 +6931,7 @@ "https://github.com/stablyai/orca/issues/9229" ], "invariant": "Reconnect, replay, or lifecycle observations from a viewer that negotiated explicit close intent must never kill a live PTY. A capable reasonless close must keep and republish; a legacy paired viewer must retain current-main behavior because its intentional close and cleanup echo are wire-identical. Lifecycle close requires the exact observed publication, terminal, environment, and authoritative liveness, never signals a process, and leaves renderer-owned or partial-split retirement to its owner. Legacy daemon hello and warm reattachment remain non-destructive.", - "oracle": "Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/remote-runtime-request-connection.integration.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts", "pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1", @@ -7036,6 +7041,7 @@ "Add live Linux SSH-relay and Windows WSL reconnect artifacts without weakening keep-on-unknown." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "The strongest proof is Electron-as-Node over real daemon PTYs, not a packaged headed Orca host paired to a separate old client; that is the primary live E2E still required.", @@ -7499,7 +7505,7 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "remote-runtime"], - "coverageNotes": "Audit1685 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Renderer ownership/dedupe contracts cover provider-session claims. Local and daemon attach-only contracts prove an existing stable-pane owner is adopted without provider creation, while remote-runtime transport contracts preserve adopted ownership through cancellation. The Electron oracle covers a local macOS runtime and daemon with real agent, Setup, and unrelated-canary processes; SSH, WSL, paired-server, Linux, and Windows remain contract-only or unrun. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1685 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Renderer ownership/dedupe contracts cover provider-session claims. Local and daemon attach-only contracts prove an existing stable-pane owner is adopted without provider creation, while remote-runtime transport contracts preserve adopted ownership through cancellation. The Electron oracle covers a local macOS runtime and daemon with real agent, Setup, and unrelated-canary processes; SSH, WSL, paired-server, Linux, and Windows remain contract-only or unrun. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/pull/6800", "https://github.com/stablyai/orca/pull/5240", @@ -7509,7 +7515,7 @@ "https://github.com/stablyai/orca/pull/11819" ], "invariant": "Workspace activation, launch, restore, sleep, hibernate, dedupe, clearing, mount, remount, and reconnect code must not replay or resume a provider session id already owned, queued, pending, live, or durably bound to a host PTY in that workspace. A renderer with missing projection state must adopt the exact runtime-owned PTY for the original tab and leaf rather than create a replacement.", - "oracle": "Audit1685 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Renderer-state tests assert provider-session ownership across preserved and queued panes. Main/provider contracts assert atomic attach-only adoption, stable host/worktree/tab/leaf identity, no fresh spawn on adoption, and safe paired-runtime cancellation. The Electron oracle creates inactive runtime-owned Codex and Setup PTYs plus an unrelated canary, seeds an exact resumable provider session, removes only the target renderer projections, and activates the workspace. It requires byte-stable handle, PTY, incarnation, tab, leaf, process PID, renderer graph, persisted binding, runtime id, graph epoch, and daemon PID across first mount and reload; PID-specific DOM keyboard I/O must remain live with one launch, zero resume argv, zero signals, zero interruption text, and no canary mutation.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1685 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Renderer-state tests assert provider-session ownership across preserved and queued panes. Main/provider contracts assert atomic attach-only adoption, stable host/worktree/tab/leaf identity, no fresh spawn on adoption, and safe paired-runtime cancellation. The Electron oracle creates inactive runtime-owned Codex and Setup PTYs plus an unrelated canary, seeds an exact resumable provider session, removes only the target renderer projections, and activates the workspace. It requires byte-stable handle, PTY, incarnation, tab, leaf, process PID, renderer graph, persisted binding, runtime id, graph epoch, and daemon PID across first mount and reload; PID-specific DOM keyboard I/O must remain live with one launch, zero resume argv, zero signals, zero interruption text, and no canary mutation.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts", "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose", @@ -7622,6 +7628,7 @@ "Record byte-identical latest-main, candidate, and candidate-revert Electron results." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1685 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -7665,7 +7672,7 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh", "wsl", "remote-runtime"], - "coverageNotes": "Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1495 intentionally deletes the orphan-owner suite: explicit owner/host predicate examples are retired; no equivalent replacement coverage or fresh result is claimed. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts: Loses obsolete pending title process races, inspection failure suppression, explicit completion precedence and delayed remote inspection alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1301 and1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps. The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence. Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed. Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1495 intentionally deletes the orphan-owner suite: explicit owner/host predicate examples are retired; no equivalent replacement coverage or fresh result is claimed. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts: Loses obsolete pending title process races, inspection failure suppression, explicit completion precedence and delayed remote inspection alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1301 and1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps. The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence. Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed. Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/8878", "https://github.com/stablyai/orca/issues/9151", @@ -7675,7 +7682,7 @@ "https://github.com/stablyai/orca/pull/10193" ], "invariant": "For every claim-capable execution route, one provider-session identity has at most one live PTY owner and one canonical host surface across concurrent clients, retries, reconnects, and stale publications. For paired structured fresh and resume requests, the authenticated owning runtime creates in background without a renderer window; activate=true focuses the exact requested leaf only on the requesting viewer, while activate=false changes no viewer focus. A live orphan may be adopted only when the controller proves its exact handle and incarnation, its worktree and host owner match, no competing visual owner exists, and a host topology CAS wins. A viewer may classify completion only from successful host/provider inspection or explicit lifecycle evidence; transport, handle, or provider unavailability remains unknown and breaks any consecutive-idle proof. A physical exit retires that exact incarnation durably so stale client state and host restart cannot recreate it. Mixed-version routes select the unchanged legacy request before any authority side effect or execution-owner-local filesystem access.", - "oracle": "Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts", @@ -7887,6 +7894,7 @@ "Add live SSH/WSL provider evidence before claiming full provider coverage; Docker SSH proves only the SSH provider/relay path." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -8894,13 +8902,13 @@ "providers": ["paired-runtime", "ssh"], "coveredPlatforms": ["macos", "linux"], "coveredProviders": [], - "coverageNotes": "Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Module ownership cleanup retires the modeled cold-park private watcher/render/work-count suites under the current test policy. Their assertions are no longer active evidence. Retained lifecycle tests and headed/headless journeys do not establish equivalent coverage for those removed harness alarms. Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx: Loses modeled React oscillation alarm; real pane/watchers are not exercised. deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser response-after-manual-disconnect example. Its distinct in-flight response fencing alarm is lost; retained queued-call disconnect tests are not an equivalent replacement. Historical commands and results remain historical. Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps. The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage. The test-value audit removes separate responsive-stream, intervening-control-frame and capacity-error classification examples. Retained multiplexer checks use fake clocks and captured transport callbacks; their per-stream isolation, deadline and probe-baseline assertions do not prove an actual host restart or equivalent replacement coverage. Historical run commands and results remain historical. The test-value audit removes the standalone retained/live metadata projection and additive-preference negative example from runtime-client-events.test.ts. Its remaining case checks partial-authority event admission through a captured callback; it does not establish full-pair projection, actual peer delivery or equivalent replacement coverage. Historical commands and results remain historical. The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage. Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed. Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts reduced. Loses FIFO fairness/spacing, semantic bypass/cancellation, delayed-boundary scheduling and teardown timer-cleanup alarms. Retained fixed emission cases do not replace those outcomes. No equivalent replacement coverage is claimed.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Module ownership cleanup retires the modeled cold-park private watcher/render/work-count suites under the current test policy. Their assertions are no longer active evidence. Retained lifecycle tests and headed/headless journeys do not establish equivalent coverage for those removed harness alarms. Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx: Loses modeled React oscillation alarm; real pane/watchers are not exercised. deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser response-after-manual-disconnect example. Its distinct in-flight response fencing alarm is lost; retained queued-call disconnect tests are not an equivalent replacement. Historical commands and results remain historical. Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps. The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage. The test-value audit removes separate responsive-stream, intervening-control-frame and capacity-error classification examples. Retained multiplexer checks use fake clocks and captured transport callbacks; their per-stream isolation, deadline and probe-baseline assertions do not prove an actual host restart or equivalent replacement coverage. Historical run commands and results remain historical. The test-value audit removes the standalone retained/live metadata projection and additive-preference negative example from runtime-client-events.test.ts. Its remaining case checks partial-authority event admission through a captured callback; it does not establish full-pair projection, actual peer delivery or equivalent replacement coverage. Historical commands and results remain historical. The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage. Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed. Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts reduced. Loses FIFO fairness/spacing, semantic bypass/cancellation, delayed-boundary scheduling and teardown timer-cleanup alarms. Retained fixed emission cases do not replace those outcomes. No equivalent replacement coverage is claimed.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/8652", "https://github.com/stablyai/orca/pull/10625" ], "invariant": "A host advertising terminal.paired-parking.v1 keeps the PTY and bounded authoritative history alive while an ordinary hidden-view park destroys the client xterm and releases its raw per-PTY stream. Reveal must restore up to the requested 5,000 rows, parked-time side effects/output, the same PTY identity, and continued input/output. Parked watcher synchronization compares parking semantics rather than fresh object identity, owns setup and cleanup across StrictMode replay, reconciles real PTY/layout changes, and performs no terminal-state scan when nothing is parked. After a host main-process relaunch, unknown local delivery-sync state must not be treated as proof that a surviving daemon PTY is already foregrounded. An empty headed session-tab inventory is authoritative only after the current renderer graph generation publishes a complete inventory and every execution host answers the PTY census; unpublished, resync-pending, transport-failed, and partially scoped inventories remain unverifiable, while genuinely authoritative empty and non-empty inventories settle and a scope-less legacy empty keeps its pre-authority best-effort settle so outdated hosts retain agent auto-resume. The unpublished-empty regression must keep the resume dispatch parked with exactly one daemon process/writer; restoring unconditional empty hydration must release one dispatch and create two live writers. If subscription precedes provider readiness, authoritative inventory must reconsider that existing subscriber without spawning, resizing, or changing reconnect state. A snapshot without an output high-water must keep it unknown rather than borrowing a layout version that can suppress newer live output. Hosts without the capability must gate hidden raw output before xterm scheduling and repaint from the authoritative snapshot on reveal while retaining the existing limit/TTL force-parking fallback. After the first semantic title state, decorative spinner frequency must add zero paired client-event frames and zero full session-tabs work between status-freshness leases regardless of hidden worktree count. Continuous working or permission evidence may refresh each affected worktree once per 15 minutes through one globally spaced FIFO so current and legacy viewers do not decay before 30 minutes; sibling PTYs share that worktree refresh, while local title animation, raw output, and semantic title, status, bell, completion, and query facts remain intact. A paired terminal stream whose delivery credits stop progressing must replace only that stream; command silence first probes authoritative state and replaces the stream if the probe times out or proves the PTY advanced beyond the client's delivered output sequence. When no comparable delivery high-water exists, the first sequenced probe establishes a baseline and only later advancement proves staleness. A same-sequence snapshot remains valid proof of a responsive silent command. A successful status probe may replace a pre-ready shared-control socket without rejecting or duplicating calls already waiting for that transport. Manual disconnect must retain pairing while preventing queued or passive calls and subscriptions from recreating transport until explicit Connect. A paired pane reconnecting to a relaunched host that has not yet published its window graph (an unpublished frame, bare or client-projected) must stay in recovery rather than retire, and the host's first published snapshot carrying the surface must reattach it; a published frame lacking the surface still retires it. The placeholder is only ever sent before the host's graph first publishes; afterwards a worktree with no tabs gets a real empty answer, pushed once to any client that asked during startup, so a paired client opening a never-opened host worktree still gets its first terminal.", - "oracle": "Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts", "ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1", @@ -9296,6 +9304,7 @@ "Keep the budget-off control, exact manager count, final bounded-tail flood marker, parked-time output, and post-reveal PTY input in both topology runs." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -9529,7 +9538,7 @@ "providers": ["local", "daemon", "ssh", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["ssh"], - "coverageNotes": "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS evidence covers main-process pending-output and projection-admission caps, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS evidence covers main-process pending-output and projection-admission caps, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/pull/6836", "https://github.com/stablyai/orca/pull/6858", @@ -9537,7 +9546,7 @@ "https://github.com/stablyai/orca/pull/7054" ], "invariant": "High-volume terminal output must stay bounded across daemon socket writes, SSH relay writer/decoder/source retention/reconnect, main model and projection admission, runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input. Every new SSH session offers V1 and every same-build relay supports it; legacy delivery is reachable only when capability negotiation proves the peer cannot use V1. Negotiated SSH spans remain exact and contiguous through activation, exit, cancellation, recovery, desktop projection, and required remote replacement; provisional activation data cannot project, reconnect may release it only into the exact attempt's private recovery quarantine after contract validation, and exit seals that quarantine against later same-token frames until ordered admission or exact cancellation proof. Reconnect checkpoint capture freezes exact provider-generation/PTy admission, cancels queued old work, and waits for the running raw completion before exposing its accepted checkpoint; timeout or failure detaches only that PTy's old model, makes the checkpoint unavailable, and releases the bounded fence without closing the shared provider, while the same failure outside an active exact migration remains generation-fatal and overlapping reconnects preserve any earlier outstanding fence. Pending renderer projection IDs are capped and compacted across split remainders, exit preparation owns its renderer fence through finalization, exit-time cancellation transfers published projections before proof commit, generation close fences late proof while draining exact projection waiters, closed-generation identity compacts without weakening stale rejection, canceled source-delivery retirement retains at most one ordered token per PTY, and pause/resume targets only the exact provider generation. Additional subscribers cannot stall the owner, while the required legacy primary retains backpressure.", - "oracle": "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The current executable slice injects main-process renderer backlog pressure, then asserts ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The current executable slice injects main-process renderer backlog pressure, then asserts ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts", @@ -9652,6 +9661,7 @@ "Keep stress variants non-blocking until stable runtime history exists." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -9907,7 +9917,7 @@ "providers": ["ssh", "remote-runtime", "wsl"], "coveredPlatforms": ["macos"], "coveredProviders": ["ssh", "remote-runtime"], - "coverageNotes": "Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic renderer coverage proves retained native and runtime SSH payloads are admitted through production routes only with valid complete authority, stale cleanup cannot unregister a replacement runtime terminal, direct SSH Git and folder panes keep their PTY bindings through disconnect and reconnect, one authority chain stops after two automatic attempts even when each timeout exceeds the rolling window, rejected acknowledgements mutate no store maps, and one shared exact attempt admits every concurrent split-pane spawn and reattach while preserving the first PTY as the tab fallback. A later sibling failure rotates the tab once, stale callbacks from the prior attempt mutate no state, split remount activity suppression is counted per leaf, primary PTY exit promotes a bound survivor or preserves an empty continuation gap for a late sibling, and primary, non-primary, or null-PTY detach preserves exact authority on both resulting tabs. Intentional pane disposal cancels its settlement timer without breaking StrictMode remount timeout ownership. A mounted remote-runtime terminal survives repeated transport partitions without changing PTY identity. A real encrypted-WebSocket oracle proves a successful reachability probe can replace a pre-ready shared-control socket without rejecting or duplicating the waiting RPC. Direct SSH coordinator tests cover immediate terminal finalization, hydration correction, damping, bounded retry, and telemetry non-interference. Client/server heartbeat tests cover timer suspension, socket generations fence stale callbacks, cold restored-terminal attachment retries, cached pixels remain unhealthy until authoritative replay, automatic retries stop after one minute, manual reconnect preserves the PTY, and pane closure releases recovery UI state. Current-transport recovery clears every error that transport surfaced without clearing or displaying a sibling pane's errors, while transport suppression, pane retention, and the rendered surface are independently bounded. Current macOS Electron journeys against an ephemeral Linux Docker SSH target cover exact-authority repo/worktree hydration, live terminal recovery after disconnect/reconnect, and eager six-terminal remount after renderer reload. A Windows remote-runtime smoke covers reachability and PTY round-trip. Multi-target live fanout, paired-close, WSL, and patched live partition journeys remain gaps. The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical. The test-value audit removes standalone unwritten/released renderer-authority and cross-scope request-count examples. The retained synthetic mirror/store/sidebar and pending-inventory checks do not establish real PTY byte ownership, SSH reconnection or equivalent replacement coverage; historical commands and results remain historical. The test-value audit removes direct join/label ledgers, immediate failure and negative-only stale/removal/partial-authority examples, plus the standalone retained/live event projection. Retained synthetic store/hydration compositions do not establish real SSH continuity, remote authority delivery or equivalent replacement alarms. Historical commands and results remain historical. The renderer scheduling fixture retains in-flight coalescing only. Its immediate publication and negative stale-SSH-cleanup call ledgers were removed; the retained SSH recovery evidence does not replace those alarms. The accepted-handle-events observer suite is removed, including its scoped listener and settlement-release assertions. These observer alarms are lost; retained SSH/transport journeys are not equivalent replacement coverage. The test-value audit removed repeated remote-handle rotation inventories and snapshot-first pending-restart migration examples from terminal-pty-identity-replacement.test.ts, plus direct foreground metadata setter, confirmation, evidence-enum, and prefix/worktree cleanup examples. Those rotation, pending-restart, snapshot-first migration, and foreground scalar-update alarms are lost. The retained replacement case observes pane and tab identities in one subscriber publication; it does not establish equivalent migration, process-evidence, or input-routing coverage. Historical commands and results remain historical. The test-value audit narrows terminals-hydration.test.ts to a real reconnect batch with one measured store publication and hydration-seeded history consumed by a subsequent visit/Back check. Direct split-layout, runtime/folder/floating restoration, dead-leaf focus, cold/known-absent SSH deferral, title, default-tab marker, navigation initialization, and hydrationSucceeded scalar examples are removed; those specific alarms are lost. No actual target-removal transition, live SSH connection, session writer, or persisted restart is exercised by the retained cases. The old target-scoped/snapshot assertion references are retired because the current file does not contain those oracles. Other suites and historical runs do not establish equivalent replacement coverage. Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts removed. Initial and event-triggered partial-authority hydration fixture alarms disappear. src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts removed. Multiline dedup/storm bounds, resource classification/collision, scoped clear/reconnect strip and1000-pane map count alarms disappear. No equivalent replacement coverage is claimed. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic renderer coverage proves retained native and runtime SSH payloads are admitted through production routes only with valid complete authority, stale cleanup cannot unregister a replacement runtime terminal, direct SSH Git and folder panes keep their PTY bindings through disconnect and reconnect, one authority chain stops after two automatic attempts even when each timeout exceeds the rolling window, rejected acknowledgements mutate no store maps, and one shared exact attempt admits every concurrent split-pane spawn and reattach while preserving the first PTY as the tab fallback. A later sibling failure rotates the tab once, stale callbacks from the prior attempt mutate no state, split remount activity suppression is counted per leaf, primary PTY exit promotes a bound survivor or preserves an empty continuation gap for a late sibling, and primary, non-primary, or null-PTY detach preserves exact authority on both resulting tabs. Intentional pane disposal cancels its settlement timer without breaking StrictMode remount timeout ownership. A mounted remote-runtime terminal survives repeated transport partitions without changing PTY identity. A real encrypted-WebSocket oracle proves a successful reachability probe can replace a pre-ready shared-control socket without rejecting or duplicating the waiting RPC. Direct SSH coordinator tests cover immediate terminal finalization, hydration correction, damping, bounded retry, and telemetry non-interference. Client/server heartbeat tests cover timer suspension, socket generations fence stale callbacks, cold restored-terminal attachment retries, cached pixels remain unhealthy until authoritative replay, automatic retries stop after one minute, manual reconnect preserves the PTY, and pane closure releases recovery UI state. Current-transport recovery clears every error that transport surfaced without clearing or displaying a sibling pane's errors, while transport suppression, pane retention, and the rendered surface are independently bounded. Current macOS Electron journeys against an ephemeral Linux Docker SSH target cover exact-authority repo/worktree hydration, live terminal recovery after disconnect/reconnect, and eager six-terminal remount after renderer reload. A Windows remote-runtime smoke covers reachability and PTY round-trip. Multi-target live fanout, paired-close, WSL, and patched live partition journeys remain gaps. The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical. The test-value audit removes standalone unwritten/released renderer-authority and cross-scope request-count examples. The retained synthetic mirror/store/sidebar and pending-inventory checks do not establish real PTY byte ownership, SSH reconnection or equivalent replacement coverage; historical commands and results remain historical. The test-value audit removes direct join/label ledgers, immediate failure and negative-only stale/removal/partial-authority examples, plus the standalone retained/live event projection. Retained synthetic store/hydration compositions do not establish real SSH continuity, remote authority delivery or equivalent replacement alarms. Historical commands and results remain historical. The renderer scheduling fixture retains in-flight coalescing only. Its immediate publication and negative stale-SSH-cleanup call ledgers were removed; the retained SSH recovery evidence does not replace those alarms. The accepted-handle-events observer suite is removed, including its scoped listener and settlement-release assertions. These observer alarms are lost; retained SSH/transport journeys are not equivalent replacement coverage. The test-value audit removed repeated remote-handle rotation inventories and snapshot-first pending-restart migration examples from terminal-pty-identity-replacement.test.ts, plus direct foreground metadata setter, confirmation, evidence-enum, and prefix/worktree cleanup examples. Those rotation, pending-restart, snapshot-first migration, and foreground scalar-update alarms are lost. The retained replacement case observes pane and tab identities in one subscriber publication; it does not establish equivalent migration, process-evidence, or input-routing coverage. Historical commands and results remain historical. The test-value audit narrows terminals-hydration.test.ts to a real reconnect batch with one measured store publication and hydration-seeded history consumed by a subsequent visit/Back check. Direct split-layout, runtime/folder/floating restoration, dead-leaf focus, cold/known-absent SSH deferral, title, default-tab marker, navigation initialization, and hydrationSucceeded scalar examples are removed; those specific alarms are lost. No actual target-removal transition, live SSH connection, session writer, or persisted restart is exercised by the retained cases. The old target-scoped/snapshot assertion references are retired because the current file does not contain those oracles. Other suites and historical runs do not establish equivalent replacement coverage. Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts removed. Initial and event-triggered partial-authority hydration fixture alarms disappear. src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts removed. Multiline dedup/storm bounds, resource classification/collision, scoped clear/reconnect strip and1000-pane map count alarms disappear. No equivalent replacement coverage is claimed. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-3107", "https://github.com/stablyai/orca/pull/12664", @@ -9922,7 +9932,7 @@ "https://github.com/stablyai/orca/issues/12902" ], "invariant": "SSH, WSL, and remote-runtime restore paths must treat provider listing failures and unknown liveness as unknown, not dead, while still avoiding duplicate spawn and clearing expired relay leases exactly once. Direct SSH disconnect, reconnect, and wake must keep PTY bindings and relay identity, and target snapshot hydration/reconnect cannot reset sibling SSH, local, WSL, or runtime-owned state. Every restored remote terminal must preserve its provider PTY identity, including the authoritative incarnation returned by a successful session-ID reattach. After a recoverable partition the same authenticated runtime must reattach the same PTY, reject detached input, apply the latest viewport, and report healthy only after authoritative replay. A successful one-shot reachability probe may replace a pre-ready shared-control socket, but waiting RPCs must continue onto the replacement under their original deadline without duplicate host delivery or retained request bytes. Automatic PTY recovery stops after one bounded minute without a fatal terminal error; a manual reconnect starts a newly fenced epoch against the same PTY, and closed panes retain no recovery UI state. Successful current-transport recovery must clear every stale error surfaced for that pane without clearing or displaying a sibling pane's error; a later genuine failure must remain visible. Each transport retains at most eight suppressed messages, each pane retains at most eight distinct messages, and the rendered surface retains at most 24 lines and 4,000 characters. One capability-gated terminal-create mutation must produce at most one host PTY across an unknown response outcome, remain manually retryable after cutoff, and never let a stale completion replace a newer pane lifecycle. Reconnect must alternate exact activation with authoritative inventory so neither a stale activation response nor an activation failure can strand or retire a pane, and activating a parked surface whose persisted binding was already retired must respawn it rather than report a changed owner after signalling its exit.", - "oracle": "Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Deterministic tests cover bounded stale-handle replacement, suspended heartbeat clocks, cold and established subscription failure, ten partition/recovery cycles, automatic-recovery cutoff, manual reconnect, and direct SSH binding retention. They assert SSH state changes leave PTY bindings in place, relay identity survives, and another target/local/WSL/runtime panes remain byte-identical through target snapshot hydration and reconnect. Both remount callbacks consume split-count activity suppression, intentional dispose emits no failure/timeout, and a same-attempt StrictMode remount still owns one timeout. Hydration clears an untrusted PTY hint without clearing its current pending owner, healthy current-authority bindings suppress correction, hydration finalizes once, and reconnect emits no paired close lifecycle. A provider-level session-ID reattach returns an incarnation, then a legacy exit without an incarnation must resolve to that returned identity rather than minting a fallback identity. The shared-control oracle withholds the first encrypted ready frame, starts one RPC, triggers the successful-probe refresh, then requires exactly two client connections, one host request, a successful response, zero pending calls, and zero retained request bytes. Tests also assert one unsubscribe per remote-runtime epoch, observable recovery phases, stable PTY identity, resumed snapshot/output/input, no healthy state before replay, no retry or input after cutoff, a new manual epoch against the same PTY, quiet recovery UI with an explicit Reconnect action, pane-close state cleanup, one stable create mutation id, old-runtime no-retry behavior, cross-process PTY adoption, and bounded in-flight coordination. A focused recovery oracle surfaces two distinct failures through one transport, completes authoritative replay, and requires both matching clear callbacks; pane-state tests require only the active pane's error to render, matching-pane recovery to preserve sibling and unrelated errors, dismissal to re-admit later failures, and distinct storms to retain only the newest eight messages within 24 lines and 4,000 characters. The retained store replacement assertion observes one atomic pane/tab subscriber publication; repeated rotations and snapshot-first pending-restart migration no longer have their direct store examples.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Deterministic tests cover bounded stale-handle replacement, suspended heartbeat clocks, cold and established subscription failure, ten partition/recovery cycles, automatic-recovery cutoff, manual reconnect, and direct SSH binding retention. They assert SSH state changes leave PTY bindings in place, relay identity survives, and another target/local/WSL/runtime panes remain byte-identical through target snapshot hydration and reconnect. Both remount callbacks consume split-count activity suppression, intentional dispose emits no failure/timeout, and a same-attempt StrictMode remount still owns one timeout. Hydration clears an untrusted PTY hint without clearing its current pending owner, healthy current-authority bindings suppress correction, hydration finalizes once, and reconnect emits no paired close lifecycle. A provider-level session-ID reattach returns an incarnation, then a legacy exit without an incarnation must resolve to that returned identity rather than minting a fallback identity. The shared-control oracle withholds the first encrypted ready frame, starts one RPC, triggers the successful-probe refresh, then requires exactly two client connections, one host request, a successful response, zero pending calls, and zero retained request bytes. Tests also assert one unsubscribe per remote-runtime epoch, observable recovery phases, stable PTY identity, resumed snapshot/output/input, no healthy state before replay, no retry or input after cutoff, a new manual epoch against the same PTY, quiet recovery UI with an explicit Reconnect action, pane-close state cleanup, one stable create mutation id, old-runtime no-retry behavior, cross-process PTY adoption, and bounded in-flight coordination. A focused recovery oracle surfaces two distinct failures through one transport, completes authoritative replay, and requires both matching clear callbacks; pane-state tests require only the active pane's error to render, matching-pane recovery to preserve sibling and unrelated errors, dismissal to re-admit later failures, and distinct storms to retain only the newest eight messages within 24 lines and 4,000 characters. The retained store replacement assertion observes one atomic pane/tab subscriber publication; repeated rotations and snapshot-first pending-restart migration no longer have their direct store examples.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts --reporter=dot", "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts", @@ -10180,6 +10190,7 @@ "Include reconnect/polling artifacts that identify provider, connection id, and lease state." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionStartupCwdFallbackNoticeTests } from '../startup/pty-connection-startup-cwd-fallback-notice.spec'; registerPtyConnectionStartupCwdFallbackNoticeTests(). src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-startup-cwd-fallback-notice.spec.ts: prints a terminal notice when the startup cwd fell back to the workspace root. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.", "Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -10903,13 +10914,13 @@ "providers": ["local", "daemon", "ssh", "remote-runtime"], "coveredPlatforms": ["macos", "windows"], "coveredProviders": ["local"], - "coverageNotes": "Audit1991: Remove partial-runtime terminal-send micro-alarms; the reduced RPC source retains held viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences. Preserve the3 unrelated historical repro and source-built end-to-end receipts at their original exact commands; do not transfer their counts or physical platform claims to reduced unit callbacks. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1586 removes mock-only terminal prompt forwarding and capability assertions without equivalent replacement coverage. Retained CLI tests cover unverified close failures and a missing prompt receipt after preflight using injected host responses; they do not establish actual PTY delivery, host restart or durable replay. Assertion references selecting removed alarms are retired; unaffected execution receipts remain unchanged. Historical scope before this audit: Source-built macOS and physical Windows Electron journeys cover the public CLI through RPC, runtime identity, real PTY/ConPTY writes, and a delayed fake Codex composer. Focused units cover CLI intent, fresh Claude/Codex foreground identity, framing bytes, stale-agent shell fallback, and exact legacy behavior for every other configured agent. SSH, daemon, and remote-runtime remain explicit gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/rpc/terminal-agent-prompt-send.test.ts reduced. Lose mocked successful routing, fallback args and signal identity forwarding. Retained fake PTY write sink observes no output; no actual shell/provider claimed. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send micro-alarms; the reduced RPC source retains held viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences. Preserve the3 unrelated historical repro and source-built end-to-end receipts at their original exact commands; do not transfer their counts or physical platform claims to reduced unit callbacks. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1586 removes mock-only terminal prompt forwarding and capability assertions without equivalent replacement coverage. Retained CLI tests cover unverified close failures and a missing prompt receipt after preflight using injected host responses; they do not establish actual PTY delivery, host restart or durable replay. Assertion references selecting removed alarms are retired; unaffected execution receipts remain unchanged. Historical scope before this audit: Source-built macOS and physical Windows Electron journeys cover the public CLI through RPC, runtime identity, real PTY/ConPTY writes, and a delayed fake Codex composer. Focused units cover CLI intent, fresh Claude/Codex foreground identity, framing bytes, stale-agent shell fallback, and exact legacy behavior for every other configured agent. SSH, daemon, and remote-runtime remain explicit gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/rpc/terminal-agent-prompt-send.test.ts reduced. Lose mocked successful routing, fallback args and signal identity forwarding. Retained fake PTY write sink observes no output; no actual shell/provider claimed. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-4328", "https://github.com/stablyai/orca/issues/14525" ], "invariant": "A public CLI send containing non-empty text plus Enter and no interrupt identifies agent-prompt intent. The owning runtime uses bracketed-paste and settled submit only when a fresh foreground-process read positively identifies the exact target as Claude or Codex on a desktop call; every other agent, stale agent metadata over a shell, text-only input, bare Enter, interrupts, mobile input, query replies, and older clients keep the direct terminal contract.", - "oracle": "Audit1991: Remove partial-runtime terminal-send micro-alarms; the reduced RPC source retains held viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences. Preserve the3 unrelated historical repro and source-built end-to-end receipts at their original exact commands; do not transfer their counts or physical platform claims to reduced unit callbacks. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Launch a bare fake Codex through the real Electron PTY and delay its composer render for 1,200 ms, beyond the legacy generic 500 ms gap. Send a 557-byte prompt with the public CLI and require the marker, zero premature Enter, no rescue Enter, and one submission. POSIX child stdin must retain one bracketed-paste frame; Windows ConPTY consumes that control frame, so runtime tests require the frame at the PTY write boundary while the Windows child requires the exact prompt. The same harness against the installed pre-fix runtime must record one premature Enter and require one bare rescue Enter. Focused units require CLI intent only for text plus Enter, settlement only for freshly identified Claude/Codex, the legacy platform delay for every other configured agent, stale Codex launch identity over a shell to fall back, no wrapper polling, and byte-for-byte direct delivery for non-targets.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send micro-alarms; the reduced RPC source retains held viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences. Preserve the3 unrelated historical repro and source-built end-to-end receipts at their original exact commands; do not transfer their counts or physical platform claims to reduced unit callbacks. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Launch a bare fake Codex through the real Electron PTY and delay its composer render for 1,200 ms, beyond the legacy generic 500 ms gap. Send a 557-byte prompt with the public CLI and require the marker, zero premature Enter, no rescue Enter, and one submission. POSIX child stdin must retain one bracketed-paste frame; Windows ConPTY consumes that control frame, so runtime tests require the frame at the PTY write boundary while the Windows child requires the exact prompt. The same harness against the installed pre-fix runtime must record one premature Enter and require one bare rescue Enter. Focused units require CLI intent only for text plus Enter, settlement only for freshly identified Claude/Codex, the legacy platform delay for every other configured agent, stale Codex launch identity over a shell to fall back, no wrapper polling, and byte-for-byte direct delivery for non-targets.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts", "pnpm run build:cli && pnpm exec playwright test tests/e2e/terminal-send-agent-prompt-submit.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1", @@ -10985,6 +10996,7 @@ "Retain mixed-version evidence that old hosts strip the optional intent and new hosts accept old clients without a protocol bump." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1586 removes mock-only terminal prompt forwarding and capability assertions without equivalent replacement coverage. Retained CLI tests cover unverified close failures and a missing prompt receipt after preflight using injected host responses; they do not establish actual PTY delivery, host restart or durable replay. Assertion references selecting removed alarms are retired; unaffected execution receipts remain unchanged.", @@ -11021,7 +11033,7 @@ "providers": ["local", "daemon", "ssh", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local"], - "coverageNotes": "Audit1973: Remove mocked injected-preamble forwarding and raw terminal.send absence aliases. Retain the real database rollback alias for failed injection and both unrelated dated receipts. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned coordinator suite retains actual dispatch-failure circuit breaking through SQLite and an actual drift-threshold silent-skip. Both existing prompt-injection aliases remain backed within injected send/terminal/probe scope. Other scalar admission, identity attribution, stop flag and prompt-section/fallback projections are intentionally lost; independent runtime writer and worker-start receipts remain limited to their original selectors, without transferred execution or replacement claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Local macOS evidence covers the runtime PTY write contract, live Codex orchestration, a dev-runtime CLI repro, and Claude and Codex composer traces. A deterministic worker-start RPC/SQLite contract proves delayed Codex composer acceptance, exactly one submitted turn, durable Dispatch success, and explicit stalled failure when Enter is swallowed without a rescue send. The render gate stays on the PTY-owning runtime, so paired and SSH callers use the same provider write/output path without a wire change. SSH, daemon, remote-runtime, Linux, and Windows live journeys remain gaps. The test-value audit intentionally removes these direct unit alarms: Only OMP joins submit to paste frame. Exact bracketed multiline prompt frame. Claude/team/unknown lead-line positives and Codex/OpenCode negatives. DSB generic lead/submit/delay fallback on three platform strings. 2KB/8KB Windows and 8KB Darwin delay below700ms. 320KB ingest estimate greater than1.4x3342ms. 145KB delay greater than1500ms. Darwin8KB <=2ms, zero/NaN Linux and negative Windows return zero. 400KB greater than40KB across platforms and Windows slower than Darwin. Antigravity100-line settle addition and Aider one-line delta. Retained unit cases still assert safe typed-lead normalization, pinned measured delay floors and chunk byte-budget bounds, ESC sanitization, exact framed UTF-8 chunk reassembly, and held-draft discrimination. The later test-value audit also removes the 16MiB arithmetic extrapolation: Windows delay greater than250000ms and Linux delay greater than4000ms, including its no-cap scaling alarm; that test never delivered ceiling input. They are not equivalent replacements for the removed unit alarms. The OMP-versus-Claude/Codex/unidentified-agent submit-join predicate obligation remains deferred. Runtime PTY-writer, worker-start and live evidence above are unchanged; no runtime-writer coverage loss, new execution, owner-gap closure or credit is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1973: Remove mocked injected-preamble forwarding and raw terminal.send absence aliases. Retain the real database rollback alias for failed injection and both unrelated dated receipts. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned coordinator suite retains actual dispatch-failure circuit breaking through SQLite and an actual drift-threshold silent-skip. Both existing prompt-injection aliases remain backed within injected send/terminal/probe scope. Other scalar admission, identity attribution, stop flag and prompt-section/fallback projections are intentionally lost; independent runtime writer and worker-start receipts remain limited to their original selectors, without transferred execution or replacement claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Local macOS evidence covers the runtime PTY write contract, live Codex orchestration, a dev-runtime CLI repro, and Claude and Codex composer traces. A deterministic worker-start RPC/SQLite contract proves delayed Codex composer acceptance, exactly one submitted turn, durable Dispatch success, and explicit stalled failure when Enter is swallowed without a rescue send. The render gate stays on the PTY-owning runtime, so paired and SSH callers use the same provider write/output path without a wire change. SSH, daemon, remote-runtime, Linux, and Windows live journeys remain gaps. The test-value audit intentionally removes these direct unit alarms: Only OMP joins submit to paste frame. Exact bracketed multiline prompt frame. Claude/team/unknown lead-line positives and Codex/OpenCode negatives. DSB generic lead/submit/delay fallback on three platform strings. 2KB/8KB Windows and 8KB Darwin delay below700ms. 320KB ingest estimate greater than1.4x3342ms. 145KB delay greater than1500ms. Darwin8KB <=2ms, zero/NaN Linux and negative Windows return zero. 400KB greater than40KB across platforms and Windows slower than Darwin. Antigravity100-line settle addition and Aider one-line delta. Retained unit cases still assert safe typed-lead normalization, pinned measured delay floors and chunk byte-budget bounds, ESC sanitization, exact framed UTF-8 chunk reassembly, and held-draft discrimination. The later test-value audit also removes the 16MiB arithmetic extrapolation: Windows delay greater than250000ms and Linux delay greater than4000ms, including its no-cap scaling alarm; that test never delivered ceiling input. They are not equivalent replacements for the removed unit alarms. The OMP-versus-Claude/Codex/unidentified-agent submit-join predicate obligation remains deferred. Runtime PTY-writer, worker-start and live evidence above are unchanged; no runtime-writer coverage loss, new execution, owner-gap closure or credit is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-3800", "https://linear.app/stably/issue/STA-3904", @@ -11031,7 +11043,7 @@ "https://github.com/stablyai/orca/issues/14347" ], "invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and submit exactly once only after the agent can accept Enter. Local worker-start with supported observation must preserve an unobserved turn as start_unknown without revoking authority, closing questions, or triggering a rescue Enter; a worker report during observation must settle normally. Claude and Codex must emit a post-paste composer marker and then settle, or reach the bounded fallback first; every other agent retains the platform delay.", - "oracle": "Audit1973: Remove mocked injected-preamble forwarding and raw terminal.send absence aliases. Retain the real database rollback alias for failed injection and both unrelated dated receipts. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned coordinator suite retains actual dispatch-failure circuit breaking through SQLite and an actual drift-threshold silent-skip. Both existing prompt-injection aliases remain backed within injected send/terminal/probe scope. Other scalar admission, identity attribution, stop flag and prompt-section/fallback projections are intentionally lost; independent runtime writer and worker-start receipts remain limited to their original selectors, without transferred execution or replacement claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Runtime tests assert the exact PTY write sequence, failure cleanup, Claude/Codex marker-gated multi-frame renders, and the legacy platform delay for every other configured agent. The candidate resets settlement on later frames, gives a late marker a fresh bounded window, and still submits once at the hard deadline if output never settles. The worker-start contract drives the production RPC through a delayed fake Codex composer and independently checks exact turn/Enter counts plus reopened SQLite Task, Dispatch, worker receipt, and mutation receipt state for accepted and swallowed outcomes. Other orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness covers long Codex-like framing.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1973: Remove mocked injected-preamble forwarding and raw terminal.send absence aliases. Retain the real database rollback alias for failed injection and both unrelated dated receipts. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned coordinator suite retains actual dispatch-failure circuit breaking through SQLite and an actual drift-threshold silent-skip. Both existing prompt-injection aliases remain backed within injected send/terminal/probe scope. Other scalar admission, identity attribution, stop flag and prompt-section/fallback projections are intentionally lost; independent runtime writer and worker-start receipts remain limited to their original selectors, without transferred execution or replacement claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Runtime tests assert the exact PTY write sequence, failure cleanup, Claude/Codex marker-gated multi-frame renders, and the legacy platform delay for every other configured agent. The candidate resets settlement on later frames, gives a late marker a fresh bounded window, and still submits once at the hard deadline if output never settles. The worker-start contract drives the production RPC through a delayed fake Codex composer and independently checks exact turn/Enter counts plus reopened SQLite Task, Dispatch, worker receipt, and mutation receipt state for accepted and swallowed outcomes. Other orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness covers long Codex-like framing.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator/coordinator.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts --reporter=dot", @@ -11125,6 +11137,7 @@ "Capture stable red/green intentional-break evidence in CI before blocking promotion." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Live harness command currently expects an already-running dev runtime and generated out/bin/orca-dev wrapper.", @@ -11165,14 +11178,14 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "Audit2003: Remove simpler proven-absent/unknown-delivery, synchronous double-trigger and exit-cleanup examples from the stale-leaf source. Retain controlled waiter-versus-probe races, queued-row progression, same-ID stale-Enter cancellation and orphaned-snapshot fences. Provider/process observations and database rows in this source are supplied, not actual process absence or SQLite delivery durability. Preserve the independent five-case SQLite/CLI receipt only at its unchanged command. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove scalar, private-shape and projection examples and check cases whose reconciler runs manually before check. Retain actual federation lost-ack/gap and lifecycle completion-ack/replay alarms; unrelated message-delivery-identity receipt remains exact. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 14, 26, 31, 39, 40, 47): Pruning removes scalar Run binding/projection and worker-start round-trip examples, v28 self-convergence, simple relay-type/legacy-payload and peer-probe/checkpoint cleanup examples, and reservation-failure/Cursor Enter examples. Preserve the three coordinator migration aliases, duplicate-replay waiter suppression and refused-write drain alias. The reminted-pane SQLite lookup checks active owner replacement and malformed decoys, not lookup cardinality or a performance budget. Overlapping sync uses an injected RPC/DB harness: promise coalescing and modeled checkpoint/ACK progression do not prove real durable checkpoint persistence. The complete affected combined federation receipt is retired whole; the independent unchanged CLI receipt remains in its original scope. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned notification-consistency suite loses50-row counter/wake budget and named-index EXPLAIN inventory, unbound direct-row projection and synthetic parked-decoy deadline examples. Preserve exact genuine SQLite ownership, disk-reopen/staged pointer and controlled provider-transition callbacks; fake PTY/title/clock seams do not establish actual provider delivery or measured backlog latency. Also retire three preexisting unsupported full aliases (explicit-check reservation redrive, known-PTY-exit replacement, and filtered/wait later-page draining), absent from both the frozen21and retained17callbacks. These retire stale metadata with no additional source/removal credit. Existing aliases are retained only where independently mapped below; no equivalent replacement for removed callbacks. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1734 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: A deterministic isolated runtime/SQLite/RPC harness covers Run and Dispatch ownership, exact handle and remint-stable pane recipients, fixed Delivery replay and acknowledgment, restart, concurrent pollers, filtered waiters, and built-CLI parity with direct DB state. Schema v28 durably records every coordinator handle through SQLite triggers, backfills current handles on open, recreates routing triggers after old table rebuilds, and atomically canonicalizes coordinator-addressed inserts to run:. A 125-row oracle and 151-row reconciliation suite cover paged old-handle backlogs, commit-without-notify recovery, duplicate Dispatch owners, cancellation, and lifecycle fencing. Federation tests use real databases, dropped acknowledgments, restart/reconnect, and protocol v1/v2 peers; duplicate read rows do not wake again. Daemon and SSH pointer settlement is deterministic, with SSH bounded at 60 seconds beyond the 20-second mux health window. No RPC parameter, stream opcode, or published payload changed. Live headed/headless paired-runtime, physical SSH, WSL, Linux, and Windows acceptance remain gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/runtime/orchestration-mailbox-cold-park-idle.spec.ts removed. Loses fresh-output cold-park quiet continuation, same-incarnation deferred Enter, late pointer-write settlement and explicit-check batch-claim alarms, including durable delivered_at state checks mixed into registrations0/3. No equivalent coverage claim. src/main/runtime/orchestration-dispatch-mailbox-delivery.spec.ts reduced. Loses dispatch wake dedup, restart unread guidance, legacy ack behavior and ambiguous pointer write/Enter crash retention alarms. DB-only stable delivery identity does not replace those paths. src/main/runtime/orchestration-mailbox-delivery.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove simpler proven-absent/unknown-delivery, synchronous double-trigger and exit-cleanup examples from the stale-leaf source. Retain controlled waiter-versus-probe races, queued-row progression, same-ID stale-Enter cancellation and orphaned-snapshot fences. Provider/process observations and database rows in this source are supplied, not actual process absence or SQLite delivery durability. Preserve the independent five-case SQLite/CLI receipt only at its unchanged command. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove scalar, private-shape and projection examples and check cases whose reconciler runs manually before check. Retain actual federation lost-ack/gap and lifecycle completion-ack/replay alarms; unrelated message-delivery-identity receipt remains exact. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 14, 26, 31, 39, 40, 47): Pruning removes scalar Run binding/projection and worker-start round-trip examples, v28 self-convergence, simple relay-type/legacy-payload and peer-probe/checkpoint cleanup examples, and reservation-failure/Cursor Enter examples. Preserve the three coordinator migration aliases, duplicate-replay waiter suppression and refused-write drain alias. The reminted-pane SQLite lookup checks active owner replacement and malformed decoys, not lookup cardinality or a performance budget. Overlapping sync uses an injected RPC/DB harness: promise coalescing and modeled checkpoint/ACK progression do not prove real durable checkpoint persistence. The complete affected combined federation receipt is retired whole; the independent unchanged CLI receipt remains in its original scope. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned notification-consistency suite loses50-row counter/wake budget and named-index EXPLAIN inventory, unbound direct-row projection and synthetic parked-decoy deadline examples. Preserve exact genuine SQLite ownership, disk-reopen/staged pointer and controlled provider-transition callbacks; fake PTY/title/clock seams do not establish actual provider delivery or measured backlog latency. Also retire three preexisting unsupported full aliases (explicit-check reservation redrive, known-PTY-exit replacement, and filtered/wait later-page draining), absent from both the frozen21and retained17callbacks. These retire stale metadata with no additional source/removal credit. Existing aliases are retained only where independently mapped below; no equivalent replacement for removed callbacks. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1734 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: A deterministic isolated runtime/SQLite/RPC harness covers Run and Dispatch ownership, exact handle and remint-stable pane recipients, fixed Delivery replay and acknowledgment, restart, concurrent pollers, filtered waiters, and built-CLI parity with direct DB state. Schema v28 durably records every coordinator handle through SQLite triggers, backfills current handles on open, recreates routing triggers after old table rebuilds, and atomically canonicalizes coordinator-addressed inserts to run:. A 125-row oracle and 151-row reconciliation suite cover paged old-handle backlogs, commit-without-notify recovery, duplicate Dispatch owners, cancellation, and lifecycle fencing. Federation tests use real databases, dropped acknowledgments, restart/reconnect, and protocol v1/v2 peers; duplicate read rows do not wake again. Daemon and SSH pointer settlement is deterministic, with SSH bounded at 60 seconds beyond the 20-second mux health window. No RPC parameter, stream opcode, or published payload changed. Live headed/headless paired-runtime, physical SSH, WSL, Linux, and Windows acceptance remain gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/runtime/orchestration-mailbox-cold-park-idle.spec.ts removed. Loses fresh-output cold-park quiet continuation, same-incarnation deferred Enter, late pointer-write settlement and explicit-check batch-claim alarms, including durable delivered_at state checks mixed into registrations0/3. No equivalent coverage claim. src/main/runtime/orchestration-dispatch-mailbox-delivery.spec.ts reduced. Loses dispatch wake dedup, restart unread guidance, legacy ack behavior and ambiguous pointer write/Enter crash retention alarms. DB-only stable delivery identity does not replace those paths. src/main/runtime/orchestration-mailbox-delivery.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-4325", "https://github.com/stablyai/orca/issues/14522", "internal incident evidence: improve-vps-setup, 2026-08-10" ], "invariant": "Each message has one stable row ID and authoritative recipient; coordinator-addressed current-delivery inserts are atomically owned by run:. Pointer staging may set delivered_at but never consumes mail. Each Run consumer generation has at most one outstanding Delivery with a fixed ID and fixed message IDs; ordinary checks replay it until an explicit matching acknowledgment marks exactly those rows read. Rebinding fences the old generation, notification types/counts correspond to unread rows retrievable under the same authority, and federation replay imports each stable message identity once without re-waking an already-read duplicate.", - "oracle": "Audit2003: Remove simpler proven-absent/unknown-delivery, synchronous double-trigger and exit-cleanup examples from the stale-leaf source. Retain controlled waiter-versus-probe races, queued-row progression, same-ID stale-Enter cancellation and orphaned-snapshot fences. Provider/process observations and database rows in this source are supplied, not actual process absence or SQLite delivery durability. Preserve the independent five-case SQLite/CLI receipt only at its unchanged command. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove scalar, private-shape and projection examples and check cases whose reconciler runs manually before check. Retain actual federation lost-ack/gap and lifecycle completion-ack/replay alarms; unrelated message-delivery-identity receipt remains exact. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 14, 26, 31, 39, 40, 47): Pruning removes scalar Run binding/projection and worker-start round-trip examples, v28 self-convergence, simple relay-type/legacy-payload and peer-probe/checkpoint cleanup examples, and reservation-failure/Cursor Enter examples. Preserve the three coordinator migration aliases, duplicate-replay waiter suppression and refused-write drain alias. The reminted-pane SQLite lookup checks active owner replacement and malformed decoys, not lookup cardinality or a performance budget. Overlapping sync uses an injected RPC/DB harness: promise coalescing and modeled checkpoint/ACK progression do not prove real durable checkpoint persistence. The complete affected combined federation receipt is retired whole; the independent unchanged CLI receipt remains in its original scope. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned notification-consistency suite loses50-row counter/wake budget and named-index EXPLAIN inventory, unbound direct-row projection and synthetic parked-decoy deadline examples. Preserve exact genuine SQLite ownership, disk-reopen/staged pointer and controlled provider-transition callbacks; fake PTY/title/clock seams do not establish actual provider delivery or measured backlog latency. Also retire three preexisting unsupported full aliases (explicit-check reservation redrive, known-PTY-exit replacement, and filtered/wait later-page draining), absent from both the frozen21and retained17callbacks. These retire stale metadata with no additional source/removal credit. Existing aliases are retained only where independently mapped below; no equivalent replacement for removed callbacks. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1734 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Seed status, dispatch, and worker_done rows across direct-handle and canonical Run recipients in an isolated DB. Compare pointer count, RPC and built-CLI check output, direct SQLite rows, unread/peek/all/type filters, concurrent pollers, fixed Delivery IDs, explicit acknowledgment, restart, filtered check --wait, and coordinator remint. Route a 125-row old-handle backlog, inject a commit without notification, and require startup repair. Exercise duplicate Run/Dispatch owners, stale panes, 50-row pages, cancellation, lifecycle fencing, and absent PTYs. Drop a federation ACK, reconnect/restart v1/v2 peers, and require stable import plus no duplicate read-row wake. Hold a healthy SSH write past five seconds but below the 60-second settlement deadline, then distinguish the three settlement outcomes end to end: only a proven refusal releases the reservation and drains a delivery parked behind the watermark; a dropped in-flight settlement must surface as unverifiable with bytes handed to the transport, preserve the durable write-attempted reservation, and emit no duplicate pointer after restart; a settled write that throws mid-pointer is unverifiable, not a refusal; and an Enter whose settlement is lost stays at enter-attempted so restart emits no second Enter. Install the production PTY controller and verify that it routes settled writes through the owning provider and refuses before any byte when the routed provider cannot settle. Census every production PTY provider class and reject a settlement synthesized from the fire-and-forget write.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove simpler proven-absent/unknown-delivery, synchronous double-trigger and exit-cleanup examples from the stale-leaf source. Retain controlled waiter-versus-probe races, queued-row progression, same-ID stale-Enter cancellation and orphaned-snapshot fences. Provider/process observations and database rows in this source are supplied, not actual process absence or SQLite delivery durability. Preserve the independent five-case SQLite/CLI receipt only at its unchanged command. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove scalar, private-shape and projection examples and check cases whose reconciler runs manually before check. Retain actual federation lost-ack/gap and lifecycle completion-ack/replay alarms; unrelated message-delivery-identity receipt remains exact. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 14, 26, 31, 39, 40, 47): Pruning removes scalar Run binding/projection and worker-start round-trip examples, v28 self-convergence, simple relay-type/legacy-payload and peer-probe/checkpoint cleanup examples, and reservation-failure/Cursor Enter examples. Preserve the three coordinator migration aliases, duplicate-replay waiter suppression and refused-write drain alias. The reminted-pane SQLite lookup checks active owner replacement and malformed decoys, not lookup cardinality or a performance budget. Overlapping sync uses an injected RPC/DB harness: promise coalescing and modeled checkpoint/ACK progression do not prove real durable checkpoint persistence. The complete affected combined federation receipt is retired whole; the independent unchanged CLI receipt remains in its original scope. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned notification-consistency suite loses50-row counter/wake budget and named-index EXPLAIN inventory, unbound direct-row projection and synthetic parked-decoy deadline examples. Preserve exact genuine SQLite ownership, disk-reopen/staged pointer and controlled provider-transition callbacks; fake PTY/title/clock seams do not establish actual provider delivery or measured backlog latency. Also retire three preexisting unsupported full aliases (explicit-check reservation redrive, known-PTY-exit replacement, and filtered/wait later-page draining), absent from both the frozen21and retained17callbacks. These retire stale metadata with no additional source/removal credit. Existing aliases are retained only where independently mapped below; no equivalent replacement for removed callbacks. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1734 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Seed status, dispatch, and worker_done rows across direct-handle and canonical Run recipients in an isolated DB. Compare pointer count, RPC and built-CLI check output, direct SQLite rows, unread/peek/all/type filters, concurrent pollers, fixed Delivery IDs, explicit acknowledgment, restart, filtered check --wait, and coordinator remint. Route a 125-row old-handle backlog, inject a commit without notification, and require startup repair. Exercise duplicate Run/Dispatch owners, stale panes, 50-row pages, cancellation, lifecycle fencing, and absent PTYs. Drop a federation ACK, reconnect/restart v1/v2 peers, and require stable import plus no duplicate read-row wake. Hold a healthy SSH write past five seconds but below the 60-second settlement deadline, then distinguish the three settlement outcomes end to end: only a proven refusal releases the reservation and drains a delivery parked behind the watermark; a dropped in-flight settlement must surface as unverifiable with bytes handed to the transport, preserve the durable write-attempted reservation, and emit no duplicate pointer after restart; a settled write that throws mid-pointer is unverifiable, not a refusal; and an Enter whose settlement is lost stays at enter-attempted so restart emits no second Enter. Install the production PTY controller and verify that it routes settled writes through the owning provider and refuses before any byte when the routed provider cannot settle. Census every production PTY provider class and reject a settlement synthesized from the fire-and-forget write.", "commands": [ "pnpm run build:cli && pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-message-delivery-identity.test.ts --reporter=dot --testTimeout=5000", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-delivery.test.ts src/main/ipc/pty/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/db/schema/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/db/runs/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/mailbox/terminal-pointer/mailbox-pointer-stage.test.ts src/main/daemon/transport/client/testing/client.test.ts src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts", @@ -11328,6 +11341,7 @@ "Accumulate stable soak runs before considering blocking promotion." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1734 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.", @@ -11379,7 +11393,7 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos", "linux"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "Audit1983: Remove visible-presentation and renderer-reveal warning aliases, ordinary status-mail and mocked remote attachment claims. Retain bounded completion replay, attested takeover and wrong-pane fencing aliases. Retire4 whole dated changed-source receipts, including failures, preserving5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove private already-aborted listener bookkeeping and scalar/projection/mock examples. Retain actual queued settlement abort to operation_unknown, v1/v2 durable terminal/replay/atomic outcomes, stable coordinator/live-handle refusal and reminted-pane stable dispatch mail. Retire8 whole dated changed-source receipts, including failures and mixed suites; preserve9 independent receipt objects and existing partial protection without transferring counts, durations or intentional-break/performance claims. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 40): The complete formatter suite and its three formatting/legacy-affordance aliases are intentionally removed. The 2026-07-28 combined 34-case formatter/federation receipt is archived whole. Distinct RPC federation-lifecycle suites, their mixed-version red/green receipts, and independent Electron/CLI selectors remain unchanged; basename similarity to deleted source34 does not make those sources or receipts part of this removal. No formatter or legacy-affordance replacement is claimed. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, exact legacy Task/Dispatch/report-receipt verification, JSON rejection envelopes, and capability-negotiated Run-home settlement. The federation oracle drops the first terminal ACK, restarts Run-home twice, verifies replay through the existing polling path and the persisted acknowledgment watermark, races identical reports, accepts preexisting same-outcome ACK batches, rejects conflicting batches, and covers protocol v1/v2 completion across independently updated peers. A migration unit upgrades a v26 database with a zeroed watermark without replaying older migrations. Three isolated macOS Electron journeys launch fake Codex workers through the real RPC path. Distinct installed A/B artifacts plus live SSH, WSL, folder, Linux, and Windows cutover journeys remain explicit gaps. Test-value audit1293 removes src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1983: Remove visible-presentation and renderer-reveal warning aliases, ordinary status-mail and mocked remote attachment claims. Retain bounded completion replay, attested takeover and wrong-pane fencing aliases. Retire4 whole dated changed-source receipts, including failures, preserving5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove private already-aborted listener bookkeeping and scalar/projection/mock examples. Retain actual queued settlement abort to operation_unknown, v1/v2 durable terminal/replay/atomic outcomes, stable coordinator/live-handle refusal and reminted-pane stable dispatch mail. Retire8 whole dated changed-source receipts, including failures and mixed suites; preserve9 independent receipt objects and existing partial protection without transferring counts, durations or intentional-break/performance claims. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 40): The complete formatter suite and its three formatting/legacy-affordance aliases are intentionally removed. The 2026-07-28 combined 34-case formatter/federation receipt is archived whole. Distinct RPC federation-lifecycle suites, their mixed-version red/green receipts, and independent Electron/CLI selectors remain unchanged; basename similarity to deleted source34 does not make those sources or receipts part of this removal. No formatter or legacy-affordance replacement is claimed. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, exact legacy Task/Dispatch/report-receipt verification, JSON rejection envelopes, and capability-negotiated Run-home settlement. The federation oracle drops the first terminal ACK, restarts Run-home twice, verifies replay through the existing polling path and the persisted acknowledgment watermark, races identical reports, accepts preexisting same-outcome ACK batches, rejects conflicting batches, and covers protocol v1/v2 completion across independently updated peers. A migration unit upgrades a v26 database with a zeroed watermark without replaying older migrations. Three isolated macOS Electron journeys launch fake Codex workers through the real RPC path. Distinct installed A/B artifacts plus live SSH, WSL, folder, Linux, and Windows cutover journeys remain explicit gaps. Test-value audit1293 removes src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/pull/11107#discussion_r3663321387", "https://github.com/stablyai/orca/issues/13858", @@ -11389,7 +11403,7 @@ "https://linear.app/stably/issue/STA-4022" ], "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. A worker_done caller may report success only after the owning runtime returns an explicit lifecycle verdict or authoritative reads prove that the exact Task, Dispatch, and worker report receipt settled the expected outcome. Federated terminal settlement must remain replay-eligible until the worker durably acknowledges it, and identical same-outcome retries must converge idempotently. Independently updated clients and worker servers must preserve the negotiated protocol: current peers use Run-home lifecycle settlement, while protocol v1/v2 peers retain their legacy completion path without receiving newer-only fields. A federated worker may accept only the authority defined by its negotiated protocol. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.", - "oracle": "Audit1983: Remove visible-presentation and renderer-reveal warning aliases, ordinary status-mail and mocked remote attachment claims. Retain bounded completion replay, attested takeover and wrong-pane fencing aliases. Retire4 whole dated changed-source receipts, including failures, preserving5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove private already-aborted listener bookkeeping and scalar/projection/mock examples. Retain actual queued settlement abort to operation_unknown, v1/v2 durable terminal/replay/atomic outcomes, stable coordinator/live-handle refusal and reminted-pane stable dispatch mail. Retire8 whole dated changed-source receipts, including failures and mixed suites; preserve9 independent receipt objects and existing partial protection without transferring counts, durations or intentional-break/performance claims. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 40): The complete formatter suite and its three formatting/legacy-affordance aliases are intentionally removed. The 2026-07-28 combined 34-case formatter/federation receipt is archived whole. Distinct RPC federation-lifecycle suites, their mixed-version red/green receipts, and independent Electron/CLI selectors remain unchanged; basename similarity to deleted source34 does not make those sources or receipts part of this removal. No formatter or legacy-affordance replacement is claimed. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1983: Remove visible-presentation and renderer-reveal warning aliases, ordinary status-mail and mocked remote attachment claims. Retain bounded completion replay, attested takeover and wrong-pane fencing aliases. Retire4 whole dated changed-source receipts, including failures, preserving5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove private already-aborted listener bookkeeping and scalar/projection/mock examples. Retain actual queued settlement abort to operation_unknown, v1/v2 durable terminal/replay/atomic outcomes, stable coordinator/live-handle refusal and reminted-pane stable dispatch mail. Retire8 whole dated changed-source receipts, including failures and mixed suites; preserve9 independent receipt objects and existing partial protection without transferring counts, durations or intentional-break/performance claims. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1948 (Audit1946 sources 40): The complete formatter suite and its three formatting/legacy-affordance aliases are intentionally removed. The 2026-07-28 combined 34-case formatter/federation receipt is archived whole. Distinct RPC federation-lifecycle suites, their mixed-version red/green receipts, and independent Electron/CLI selectors remain unchanged; basename similarity to deleted source34 does not make those sources or receipts part of this removal. No formatter or legacy-affordance replacement is claimed. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.", "commands": [ "ORCA_BACKGROUND_LAUNCH=1 npx vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot", @@ -11617,6 +11631,7 @@ "Attach saved intentional-break artifacts for hidden local presentation and dropped stable-pane delivery." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "No distinct installed A/B headed or headless paired-runtime cutover is attached; the restart journey relaunches the same build while preserving the daemon and agent.", @@ -13449,14 +13464,14 @@ "providers": ["local", "remote-runtime", "ssh"], "coveredPlatforms": ["macos", "linux"], "coveredProviders": ["local", "remote-runtime", "ssh"], - "coverageNotes": "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1516 removes package-electron-runtime-contract.test.mjs, a copied release-workflow platform and marker matrix. Its workflow wiring alarm is intentionally retired; no actual packaged watcher delivery was exercised and no equivalent replacement is claimed. Unaffected dated execution receipts retain their original scope; changed optional selectors have no fresh full-gate execution result. This audit removes the paired-web stopped-during-outage and late-ready direct-branch examples. The retained pre-ready cancellation, failed-unwatch retry and replay-continuity cases are not equivalent replacements for those ordering alarms. Current web-runtime-client.test.ts assertions below name only its retained pre-ready callback case; replay cases remain in their separate suite. Historical commands and results remain historical. Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. The test-value audit corrects the active renderer watch command/file reference to the existing runtime-file-client-watch.test.ts, whose three cases are retained unchanged. They observe synthetic subscription retry/fanout and unsubscribe/unwatch calls, not actual preload/main bookkeeping or physical watcher-process cleanup. The separate read/preview client suite loses forwarding, supplied-error and negative-only examples, retaining binary detection and Unicode SVG decoding. Historical evidence commands/results are unchanged. Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/workspaces/removal/watcher-removal-gate.test.ts reduced. Loses exact removal-error compatibility with renderer predicate under shared message constants. Kept public refusal outcomes do not establish that renderer classification. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1516 removes package-electron-runtime-contract.test.mjs, a copied release-workflow platform and marker matrix. Its workflow wiring alarm is intentionally retired; no actual packaged watcher delivery was exercised and no equivalent replacement is claimed. Unaffected dated execution receipts retain their original scope; changed optional selectors have no fresh full-gate execution result. This audit removes the paired-web stopped-during-outage and late-ready direct-branch examples. The retained pre-ready cancellation, failed-unwatch retry and replay-continuity cases are not equivalent replacements for those ordering alarms. Current web-runtime-client.test.ts assertions below name only its retained pre-ready callback case; replay cases remain in their separate suite. Historical commands and results remain historical. Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. The test-value audit corrects the active renderer watch command/file reference to the existing runtime-file-client-watch.test.ts, whose three cases are retained unchanged. They observe synthetic subscription retry/fanout and unsubscribe/unwatch calls, not actual preload/main bookkeeping or physical watcher-process cleanup. The separate read/preview client suite loses forwarding, supplied-error and negative-only examples, retaining binary detection and Unicode SVG decoding. Historical evidence commands/results are unchanged. Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/workspaces/removal/watcher-removal-gate.test.ts reduced. Loses exact removal-error compatibility with renderer predicate under shared message constants. Kept public refusal outcomes do not establish that renderer classification. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/5308", "https://github.com/stablyai/orca/issues/7547", "https://github.com/stablyai/orca/issues/8212" ], "invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.", - "oracle": "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot", "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot", @@ -13818,6 +13833,7 @@ "Add a packaged orca serve pairing scenario that proves a connected client refreshes after child replacement." ], "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.", @@ -15528,14 +15544,14 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "Audit1991: Remove one-inventory/100-candidate and per-pass workspace lookup-count aliases, foreign-provider timer-call counts, and the ten-minute settled-worker/empty-batch budget sample. Narrow broad inventory/incarnation/probe aliases to retained missing-membership, restarted-relay uncertainty and explicit owning-host absence-verdict callbacks. Remove rollback clone/snapshot-call budgets and supplied persistence microvariants; retain the held-write failure rollback callback that preserves concurrent in-place edits at an injected writer seam, without claiming actual disk durability. Retain late provider recovery and host timer cancellation callbacks. Preserve the independent six-journey Electron restart receipt exactly; its result does not validate these reduced runtime selectors. Historical performance and red/green observations remain historical rather than fresh measurements. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove lower-level scalar lifecycle examples while retaining durable completion/restart/replay and the independent Electron recovery receipt. Existing broad prospective command remains prospective only. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1959 (sources 1955:2): Remove the diagnostic 100,000-assignment benchmark and its SQL-plan/scale aliases. Keep the actual 45-state durable reopen/idempotence, rollback, competing writer and older-writer reintroduction callbacks, within their modeled SQLite scope. The complete dated 2.29s safety/scale receipt is retired; earlier combined receipt objects already archived remain historical and byte-exact. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned settlement suite removes exact backlog probe count and requested-assignment indexed SQL-shape alarms. Retain actual transaction rollback, durable reopen, report outcome and failed-read recovery callbacks. Retire the indexed-lookup alias and complete dated combined47-case receipt without narrowing its selector, count or result; unaffected Electron and separate repair-safety receipts retain their independent unchanged scopes. SQLite/fault seams do not establish physical worker/provider exit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Temporary SQLite databases and fake-clock/provider contracts cover assignment repair, uncertain starts/stops, missing git/folder workspaces, owning SSH inventories, and rejection of foreign paired-runtime PTYs. Hidden macOS Electron journeys retain real daemon PTYs. A macOS client against a Debian ARM64 Docker SSH host proves historical repair preserves terminal ownership, the same live shell and background child, input and rendered output through app restart and SSH reconnect. Native Linux/Windows desktop, WSL and active-worker remote absence/deleted-folder journeys remain gaps; no execution commands or wire payloads change. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1390: src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts removed. Retires compile-count, SQL-shape and self-derived repeated-publication alarms. No independent dispatch/task outcome asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/runtime/orchestration/agent-facing-parity.test.ts reduced. Whole chat-versus-terminal preamble equality and incidental identity wording assertions no longer independently asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-abandon.test.ts reduced. Lose fallback attribution wording and repeat-abandon result characterization, preserving actual state/resource transition alarms. src/main/runtime/orchestration/crew/crew-read-model-invalidation.test.ts reduced. Lose SQL preparation optimization alarm for unrelated mailbox traffic. src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts reduced. Lose generic retry identity/default-generation example. First two cases seed replacement generation through fixture SQL; they do not prove a production reattach path. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/runtime/orchestration/crew/crew-runtime-cost.test.ts removed. Loses name/status/traffic propagation, pending-question preview and post-unsubscribe quiescence alarms along with internal clone, SQL and snapshot-read budgets. No replacement-equivalence claim. src/main/runtime/orchestration-mailbox-cold-park-idle.spec.ts removed. Loses fresh-output cold-park quiet continuation, same-incarnation deferred Enter, late pointer-write settlement and explicit-check batch-claim alarms, including durable delivered_at state checks mixed into registrations0/3. No equivalent coverage claim. src/main/runtime/orchestration-mailbox-delivery-recheck.test.ts removed. Loses draft/caret/readiness/foreground/quiet retry and final-frame delivery timing alarms. Real database and emulator use do not establish actual PTY acknowledgement, and no equivalent replacement is claimed. src/main/runtime/orchestration-dispatch-mailbox-delivery.spec.ts reduced. Loses dispatch wake dedup, restart unread guidance, legacy ack behavior and ambiguous pointer write/Enter crash retention alarms. DB-only stable delivery identity does not replace those paths. src/main/runtime/orchestration/crew/crew-federation-invalidation.test.ts removed. Loses meaningful relayed question publication/completion clearing, plus no-work federation metadata/heartbeat invalidation and exact SQL/read/acquisition/publication budgets. No equivalent replacement is claimed. src/main/runtime/orchestration-mailbox-delivery.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", + "coverageNotes": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1991: Remove one-inventory/100-candidate and per-pass workspace lookup-count aliases, foreign-provider timer-call counts, and the ten-minute settled-worker/empty-batch budget sample. Narrow broad inventory/incarnation/probe aliases to retained missing-membership, restarted-relay uncertainty and explicit owning-host absence-verdict callbacks. Remove rollback clone/snapshot-call budgets and supplied persistence microvariants; retain the held-write failure rollback callback that preserves concurrent in-place edits at an injected writer seam, without claiming actual disk durability. Retain late provider recovery and host timer cancellation callbacks. Preserve the independent six-journey Electron restart receipt exactly; its result does not validate these reduced runtime selectors. Historical performance and red/green observations remain historical rather than fresh measurements. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove lower-level scalar lifecycle examples while retaining durable completion/restart/replay and the independent Electron recovery receipt. Existing broad prospective command remains prospective only. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1959 (sources 1955:2): Remove the diagnostic 100,000-assignment benchmark and its SQL-plan/scale aliases. Keep the actual 45-state durable reopen/idempotence, rollback, competing writer and older-writer reintroduction callbacks, within their modeled SQLite scope. The complete dated 2.29s safety/scale receipt is retired; earlier combined receipt objects already archived remain historical and byte-exact. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned settlement suite removes exact backlog probe count and requested-assignment indexed SQL-shape alarms. Retain actual transaction rollback, durable reopen, report outcome and failed-read recovery callbacks. Retire the indexed-lookup alias and complete dated combined47-case receipt without narrowing its selector, count or result; unaffected Electron and separate repair-safety receipts retain their independent unchanged scopes. SQLite/fault seams do not establish physical worker/provider exit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Temporary SQLite databases and fake-clock/provider contracts cover assignment repair, uncertain starts/stops, missing git/folder workspaces, owning SSH inventories, and rejection of foreign paired-runtime PTYs. Hidden macOS Electron journeys retain real daemon PTYs. A macOS client against a Debian ARM64 Docker SSH host proves historical repair preserves terminal ownership, the same live shell and background child, input and rendered output through app restart and SSH reconnect. Native Linux/Windows desktop, WSL and active-worker remote absence/deleted-folder journeys remain gaps; no execution commands or wire payloads change. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1390: src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts removed. Retires compile-count, SQL-shape and self-derived repeated-publication alarms. No independent dispatch/task outcome asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/runtime/orchestration/agent-facing-parity.test.ts reduced. Whole chat-versus-terminal preamble equality and incidental identity wording assertions no longer independently asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-abandon.test.ts reduced. Lose fallback attribution wording and repeat-abandon result characterization, preserving actual state/resource transition alarms. src/main/runtime/orchestration/crew/crew-read-model-invalidation.test.ts reduced. Lose SQL preparation optimization alarm for unrelated mailbox traffic. src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts reduced. Lose generic retry identity/default-generation example. First two cases seed replacement generation through fixture SQL; they do not prove a production reattach path. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/runtime/orchestration/crew/crew-runtime-cost.test.ts removed. Loses name/status/traffic propagation, pending-question preview and post-unsubscribe quiescence alarms along with internal clone, SQL and snapshot-read budgets. No replacement-equivalence claim. src/main/runtime/orchestration-mailbox-cold-park-idle.spec.ts removed. Loses fresh-output cold-park quiet continuation, same-incarnation deferred Enter, late pointer-write settlement and explicit-check batch-claim alarms, including durable delivered_at state checks mixed into registrations0/3. No equivalent coverage claim. src/main/runtime/orchestration-mailbox-delivery-recheck.test.ts removed. Loses draft/caret/readiness/foreground/quiet retry and final-frame delivery timing alarms. Real database and emulator use do not establish actual PTY acknowledgement, and no equivalent replacement is claimed. src/main/runtime/orchestration-dispatch-mailbox-delivery.spec.ts reduced. Loses dispatch wake dedup, restart unread guidance, legacy ack behavior and ambiguous pointer write/Enter crash retention alarms. DB-only stable delivery identity does not replace those paths. src/main/runtime/orchestration/crew/crew-federation-invalidation.test.ts removed. Loses meaningful relayed question publication/completion clearing, plus no-work federation metadata/heartbeat invalidation and exact SQL/read/acquisition/publication budgets. No equivalent replacement is claimed. src/main/runtime/orchestration-mailbox-delivery.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", "motivatingLinks": [ "https://stablygroup.slack.com/archives/C0AK2T3JEF4/p1791225819076759", "https://github.com/stablyai/orca/pull/11271", "https://github.com/stablyai/orca/pull/22612" ], "invariant": "Completing an assignment settles its active worker bookkeeping in the same transaction without asserting process exit or releasing a terminal. Historical settled assignments converge on database open; an additive active-worker index excludes finished history, and healthy checks do not take a writer lock. Missing workspaces require owning-provider evidence before exact-incarnation retirement; a restarted relay's empty inventory and loss of contact are unverifiable. Automatic retries retain unresolved assignments without revisiting settled workers or persisting empty batches; late availability converges without user intervention.", - "oracle": "Audit1991: Remove one-inventory/100-candidate and per-pass workspace lookup-count aliases, foreign-provider timer-call counts, and the ten-minute settled-worker/empty-batch budget sample. Narrow broad inventory/incarnation/probe aliases to retained missing-membership, restarted-relay uncertainty and explicit owning-host absence-verdict callbacks. Remove rollback clone/snapshot-call budgets and supplied persistence microvariants; retain the held-write failure rollback callback that preserves concurrent in-place edits at an injected writer seam, without claiming actual disk durability. Retain late provider recovery and host timer cancellation callbacks. Preserve the independent six-journey Electron restart receipt exactly; its result does not validate these reduced runtime selectors. Historical performance and red/green observations remain historical rather than fresh measurements. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove lower-level scalar lifecycle examples while retaining durable completion/restart/replay and the independent Electron recovery receipt. Existing broad prospective command remains prospective only. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1959 (sources 1955:2): Remove the diagnostic 100,000-assignment benchmark and its SQL-plan/scale aliases. Keep the actual 45-state durable reopen/idempotence, rollback, competing writer and older-writer reintroduction callbacks, within their modeled SQLite scope. The complete dated 2.29s safety/scale receipt is retired; earlier combined receipt objects already archived remain historical and byte-exact. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned settlement suite removes exact backlog probe count and requested-assignment indexed SQL-shape alarms. Retain actual transaction rollback, durable reopen, report outcome and failed-read recovery callbacks. Retire the indexed-lookup alias and complete dated combined47-case receipt without narrowing its selector, count or result; unaffected Electron and separate repair-safety receipts retain their independent unchanged scopes. SQLite/fault seams do not establish physical worker/provider exit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Reopen historical completed/failed/circuit-broken PTY, structured and handle-less assignments and require no active recovery rows; preserve genuine report outcomes, pending unknown workers, diagnostics and terminal resources. Inject settlement failure and require complete transaction rollback. Resolve each workspace once per pass, recheck it on later passes, and query 100 missing-workspace candidates once per provider, preserve live/unidentified PTYs and wrong-host SSH evidence. Advance fake time ten minutes and require zero persistence for unresolved passes and no repeated settlement. Make a host verifiable after two minutes and require automatic convergence and timer cleanup. Require indexed SQL lookups for only the requested assignments, one query shape across batch sizes, and recovery after a failed SQL read. Require the actual startup query to use the active-worker partial index, let healthy repair finish under a competing writer lock, and repair stale rows introduced by an older SQL writer after the first repair. Check all 45 assignment/worker state combinations and idempotent reopen; inject failure on the second startup repair and require complete rollback. Measure 100,000 historical assignments with 1,000 stale workers and require zero writes on the next repair pass. On a real SSH host, require settled worker bookkeeping with unchanged terminal ownership, shell PID, background child PID, environment and working directory through restart and reconnect, with rendered input/output proof.", + "oracle": "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1991: Remove one-inventory/100-candidate and per-pass workspace lookup-count aliases, foreign-provider timer-call counts, and the ten-minute settled-worker/empty-batch budget sample. Narrow broad inventory/incarnation/probe aliases to retained missing-membership, restarted-relay uncertainty and explicit owning-host absence-verdict callbacks. Remove rollback clone/snapshot-call budgets and supplied persistence microvariants; retain the held-write failure rollback callback that preserves concurrent in-place edits at an injected writer seam, without claiming actual disk durability. Retain late provider recovery and host timer cancellation callbacks. Preserve the independent six-journey Electron restart receipt exactly; its result does not validate these reduced runtime selectors. Historical performance and red/green observations remain historical rather than fresh measurements. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove lower-level scalar lifecycle examples while retaining durable completion/restart/replay and the independent Electron recovery receipt. Existing broad prospective command remains prospective only. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1959 (sources 1955:2): Remove the diagnostic 100,000-assignment benchmark and its SQL-plan/scale aliases. Keep the actual 45-state durable reopen/idempotence, rollback, competing writer and older-writer reintroduction callbacks, within their modeled SQLite scope. The complete dated 2.29s safety/scale receipt is retired; earlier combined receipt objects already archived remain historical and byte-exact. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1943 (sources1934/1935/1938): Pruned settlement suite removes exact backlog probe count and requested-assignment indexed SQL-shape alarms. Retain actual transaction rollback, durable reopen, report outcome and failed-read recovery callbacks. Retire the indexed-lookup alias and complete dated combined47-case receipt without narrowing its selector, count or result; unaffected Electron and separate repair-safety receipts retain their independent unchanged scopes. SQLite/fault seams do not establish physical worker/provider exit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Reopen historical completed/failed/circuit-broken PTY, structured and handle-less assignments and require no active recovery rows; preserve genuine report outcomes, pending unknown workers, diagnostics and terminal resources. Inject settlement failure and require complete transaction rollback. Resolve each workspace once per pass, recheck it on later passes, and query 100 missing-workspace candidates once per provider, preserve live/unidentified PTYs and wrong-host SSH evidence. Advance fake time ten minutes and require zero persistence for unresolved passes and no repeated settlement. Make a host verifiable after two minutes and require automatic convergence and timer cleanup. Require indexed SQL lookups for only the requested assignments, one query shape across batch sizes, and recovery after a failed SQL read. Require the actual startup query to use the active-worker partial index, let healthy repair finish under a competing writer lock, and repair stale rows introduced by an older SQL writer after the first repair. Check all 45 assignment/worker state combinations and idempotent reopen; inject failure on the second startup repair and require complete rollback. Measure 100,000 historical assignments with 1,000 stale workers and require zero writes on the next repair pass. On a real SSH host, require settled worker bookkeeping with unchanged terminal ownership, shell PID, background child PID, environment and working directory through restart and reconnect, with rendered input/output proof.", "commands": [ "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts tests/e2e/cross-version-wire/orchestration-delivery-downgrade.unit.test.ts", "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration/db/dispatch-context/worker-dispatch-settlement.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/orchestration/terminal-authority/release/worker-dispatch-repair-safety.test.ts", @@ -15614,6 +15630,7 @@ "evidence": "Audit1991: Remove one-inventory/100-candidate and per-pass workspace lookup-count aliases, foreign-provider timer-call counts, and the ten-minute settled-worker/empty-batch budget sample. Narrow broad inventory/incarnation/probe aliases to retained missing-membership, restarted-relay uncertainty and explicit owning-host absence-verdict callbacks. Remove rollback clone/snapshot-call budgets and supplied persistence microvariants; retain the held-write failure rollback callback that preserves concurrent in-place edits at an injected writer seam, without claiming actual disk durability. Retain late provider recovery and host timer cancellation callbacks. Preserve the independent six-journey Electron restart receipt exactly; its result does not validate these reduced runtime selectors. Historical performance and red/green observations remain historical rather than fresh measurements. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): One startup SQL repair, one inventory query for 100 deleted-workspace candidates, one durable batch flush, and at most two full rollback snapshots per changed host. Timer passes query only still-deferred assignments through primary-key indexes with a stable parameterized SQL shape, perform zero foreground-process or foreground-agent probes, and skip empty persistence and release reconciliation. Explicit foreground status reads still work. Ten minutes of unchanged retries cause zero session writes and never revisit settled workers. Existing backoff remains capped at 30 seconds so late availability recovers automatically; timers stop on convergence or cancellation, and foreign identities never arm local timers. An additive partial index contains only the five potentially active worker states and is maintained by SQLite for old writers too. Repair queries avoid scanning finished history and return without a write transaction when no stale worker exists; actual repairs re-read under the writer lock and remain atomic. The index is built once per database and adds maintenance on worker-state changes. One recovery pass resolves each workspace once and keeps no lookup cache between passes. A same-machine 100,000-assignment before/after run observed repair 37.75ms to 17.89ms, no-op scan 25.62ms to 4.35ms with zero mutations, and subsequent database open 37.42ms to 17.11ms; The later partial-index/read-only revision observed no-op repair 0.016ms, complete healthy database open 12.44ms, and first index-build plus repair/open 63.14ms for 100,000 assignments and 1,000 stale workers. These local observations are not latency guarantees; index maintenance and fallback metadata work remain. Original customer latency and CI p95 remain unmeasured." }, "knownGaps": [ + "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.", "Native Linux/Windows desktop and WSL worker journeys, active-worker SSH absence/deleted-folder recovery, and stranded old-relay process discovery remain untested locally.", diff --git a/config/scripts/ci/sharding/ci-shard-timings.json b/config/scripts/ci/sharding/ci-shard-timings.json index d85eb0afd78..035146fcbab 100644 --- a/config/scripts/ci/sharding/ci-shard-timings.json +++ b/config/scripts/ci/sharding/ci-shard-timings.json @@ -4363,7 +4363,6 @@ "src/main/ssh/legacy-relay/ssh-host-relay-windows-inventory.test.ts": 178, "src/main/ssh/legacy-relay/ssh-host-relay-windows-pipe-access.test.ts": 211, "src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent-shell.integration.test.ts": 1546, - "src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts": 96, "src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.test.ts": 49, "src/main/ssh/legacy-relay/ssh-relay-incumbent-process.test.ts": 5357, "src/main/ssh/legacy-relay/ssh-relay-sentinel-copy-budget.test.ts": 74, @@ -4506,7 +4505,6 @@ "src/main/startup/gpu-fallback-marker.test.ts": 61, "src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts": 641, "src/main/startup/headless-serve-x11-reexec.test.ts": 76, - "src/main/startup/hydrate-shell-path.test.ts": 462, "src/main/startup/hydrate-shell-path.windows.test.ts": 426, "src/main/startup/legacy-worker-renderer-recovery.test.ts": 47, "src/main/startup/linux-keyring-backend-selection.test.ts": 62, @@ -4586,7 +4584,6 @@ "src/main/text-generation/commit-message-text-generation-remote-execution.test.ts": 469, "src/main/text-generation/conversation-name-generation-request.test.ts": 507, "src/main/text-generation/jira-issue-summary-requests.test.ts": 276, - "src/main/text-generation/jira-issue-summary-text-generation.test.ts": 543, "src/main/text-generation/kimi-generation-failure.test.ts": 151, "src/main/text-generation/pull-request-context.test.ts": 97, "src/main/text-generation/source-control-agent-cli-path.test.ts": 615, @@ -4665,7 +4662,6 @@ "src/main/window/createMainWindow-recovery-reload-watchdog.test.ts": 1251, "src/main/window/createMainWindow-renderer-crash-recovery.test.ts": 1613, "src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts": 2628, - "src/main/window/createMainWindow-tray-minimize-close.test.ts": 1140, "src/main/window/createMainWindow-user-quit-close.test.ts": 1592, "src/main/window/createMainWindow.test.ts": 1603, "src/main/window/darwin-user-temp-dir.test.ts": 51, @@ -4733,7 +4729,6 @@ "src/main/workspaces/creation/preparation/worktree-create-preparation-claim.test.ts": 52, "src/main/workspaces/creation/preparation/worktree-create-preparation-contention.test.ts": 426, "src/main/workspaces/creation/preparation/worktree-create-preparation-stale-cleanup.test.ts": 373, - "src/main/workspaces/creation/preparation/worktree-create-preparation-timing.test.ts": 357, "src/main/workspaces/creation/preparation/worktree-create-preparation-wsl-root.test.ts": 402, "src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts": 393, "src/main/workspaces/removal/worktree-failed-removal.test.ts": 749, @@ -4747,7 +4742,6 @@ "src/main/workspaces/removal/retirement/worktree-retirement-backfill-scan.test.ts": 55, "src/main/workspaces/removal/retirement/worktree-retirement-backfill-stall.test.ts": 365, "src/main/workspaces/removal/retirement/worktree-retirement-discovery-wsl.test.ts": 355, - "src/main/workspaces/removal/retirement/worktree-retirement-namespace.test.ts": 235, "src/main/workspaces/creation/worktree-root-preparation.test.ts": 180, "src/main/workspaces/removal/worktree-trash.test.ts": 126, "src/main/persistence/moving-wsl-projects/wsl-approved-root-race.wsl.test.ts": 102, @@ -4784,7 +4778,6 @@ "src/main/wsl/execution/wsl-guest-pane-processes.test.ts": 48, "src/main/wsl/execution/wsl-guest-process-identity.test.ts": 54, "src/main/wsl/host-lifecycle/wsl-host-automation-wake.test.ts": 288, - "src/main/wsl/host-lifecycle/wsl-host-gate.test.ts": 156, "src/main/wsl/host-lifecycle/wsl-host-kept-for-peers.test.ts": 159, "src/main/wsl/host-lifecycle/wsl-host-pending-removal.test.ts": 955, "src/main/wsl/host-lifecycle/wsl-host-server-stop.test.ts": 407, diff --git a/src/main/git/branch-switch-target.test.ts b/src/main/git/branch-switch-target.test.ts deleted file mode 100644 index 6bd2b63a1d4..00000000000 --- a/src/main/git/branch-switch-target.test.ts +++ /dev/null @@ -1,15 +0,0 @@ -import { beforeEach, expect, it, vi } from 'vitest' -import { resolveBranchSwitchTarget } from './branch-switch-target' -import { gitExecFileAsync } from './runner' -vi.mock('./runner', () => ({ gitExecFileAsync: vi.fn() })) -beforeEach(() => vi.mocked(gitExecFileAsync).mockReset()) -it('explains how to recover when remote settings cannot be read', async () => { - vi.mocked(gitExecFileAsync) - .mockResolvedValueOnce({ stdout: 'refs/remotes/origin/topic\t\t\n', stderr: '' }) - .mockRejectedValueOnce(new Error('raw remote command failure')) - await expect( - resolveBranchSwitchTarget('/repo', { kind: 'remote', name: 'origin/topic' }, {}) - ).rejects.toThrow( - "Orca couldn't read this repository's remotes. Check its remote settings in a terminal, then try again." - ) -}) diff --git a/src/main/git/checkout-fallback.test.ts b/src/main/git/checkout-fallback.test.ts deleted file mode 100644 index 49c6b8f8dd9..00000000000 --- a/src/main/git/checkout-fallback.test.ts +++ /dev/null @@ -1,58 +0,0 @@ -import { beforeEach, expect, it, vi } from 'vitest' -import { gitExecFileAsync } from './runner' -import { listLocalBranches } from './checkout' -vi.mock('./runner', () => ({ gitExecFileAsync: vi.fn() })) -vi.mock('./source-control/git-read-cache-invalidation', () => ({ - runWithGitReadCacheInvalidation: vi.fn() -})) -beforeEach(() => vi.mocked(gitExecFileAsync).mockReset()) -it.each(['unknown field: worktreepath', 'format failed on this host'])( - 'retries the original listing once after %s', - async (message) => { - vi.mocked(gitExecFileAsync) - .mockRejectedValueOnce(new Error(message)) - .mockResolvedValueOnce({ stdout: '*\tmain\n \tfeature\n', stderr: '' }) - expect(await listLocalBranches('/repo')).toEqual({ - current: 'main', - branches: ['main', 'feature'] - }) - expect(vi.mocked(gitExecFileAsync).mock.calls[1]?.[0]).toEqual([ - 'for-each-ref', - '--format=%(HEAD)%09%(refname:lstrip=2)', - 'refs/heads/' - ]) - expect(gitExecFileAsync).toHaveBeenCalledTimes(2) - } -) -it('propagates the retry error without a third attempt', async () => { - const failure = new Error('repository unreadable') - vi.mocked(gitExecFileAsync) - .mockRejectedValueOnce(new Error('first')) - .mockRejectedValueOnce(failure) - await expect(listLocalBranches('/repo')).rejects.toBe(failure) - expect(gitExecFileAsync).toHaveBeenCalledTimes(2) -}) -it('does not retry cancellation', async () => { - const abort = new Error('cancelled') - abort.name = 'AbortError' - vi.mocked(gitExecFileAsync).mockRejectedValueOnce(abort) - await expect(listLocalBranches('/repo')).rejects.toBe(abort) - expect(gitExecFileAsync).toHaveBeenCalledOnce() -}) - -it('translates occupied WSL branches into the owning workspace path namespace', async () => { - const platform = process.platform - Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) - try { - vi.mocked(gitExecFileAsync).mockResolvedValueOnce({ - stdout: ' \tfeature\t1700000000\t/home/alice/feature\n', - stderr: '' - }) - const result = await listLocalBranches(String.raw`\\wsl.localhost\Ubuntu\home\alice\repo`) - expect(result.worktreePaths).toEqual({ - feature: String.raw`\\wsl.localhost\Ubuntu\home\alice\feature` - }) - } finally { - Object.defineProperty(process, 'platform', { configurable: true, value: platform }) - } -}) diff --git a/src/main/git/repo-remote-ref-search.test.ts b/src/main/git/repo-remote-ref-search.test.ts deleted file mode 100644 index 991869ea097..00000000000 --- a/src/main/git/repo-remote-ref-search.test.ts +++ /dev/null @@ -1,60 +0,0 @@ -import { beforeEach, expect, it, vi } from 'vitest' -import { buildSearchBaseRefsArgv } from './repo-ref-search-command' -import { searchRemoteRefPage } from './repo-remote-ref-search' -import { gitExecFileAsync } from './runner' -import { clearGitCapabilityStateForTests } from './command-runner/git-capability-state' -vi.mock('./runner', () => ({ gitExecFileAsync: vi.fn() })) -beforeEach(() => { - vi.mocked(gitExecFileAsync).mockReset() - clearGitCapabilityStateForTests() -}) -it('applies the remote namespace before both modern and legacy candidate caps', () => { - for (const excludeRemoteHead of [true, false]) { - const args = buildSearchBaseRefsArgv('topic', 51, { namespace: 'remote', excludeRemoteHead }) - expect(args.filter((arg) => arg.startsWith('refs/'))).toEqual([ - 'refs/remotes/**/*topic*', - 'refs/remotes/**/*topic*/**' - ]) - expect(args).toContain(excludeRemoteHead ? '--count=204' : '--count=304') - } -}) -it.each([0, 1])( - 'propagates failure from read %i rather than returning empty discovery', - async (read) => { - const failure = new Error('read failed') - if (read === 1) { - vi.mocked(gitExecFileAsync).mockResolvedValueOnce({ stdout: 'origin\n', stderr: '' }) - } - vi.mocked(gitExecFileAsync).mockRejectedValueOnce(failure) - await expect(searchRemoteRefPage('/repo', 'topic', 50)).rejects.toBe(failure) - } -) -it('uses a sentinel and reports a saturated scan even after HEAD filtering', async () => { - vi.mocked(gitExecFileAsync) - .mockResolvedValueOnce({ stdout: 'origin\n', stderr: '' }) - .mockResolvedValueOnce({ - stdout: Array.from({ length: 204 }, () => 'refs/remotes/origin/HEAD\0origin/HEAD').join('\n'), - stderr: '' - }) - expect(await searchRemoteRefPage('/repo', '', 50)).toEqual({ refDetails: [], truncated: true }) -}) -it.each([100, 1000])( - 'retains only the requested 50 remote rows from %i candidates', - async (size) => { - vi.mocked(gitExecFileAsync) - .mockResolvedValueOnce({ stdout: 'origin\n', stderr: '' }) - .mockResolvedValueOnce({ - stdout: Array.from( - { length: size }, - (_, n) => `refs/remotes/origin/topic-${n}\0origin/topic-${n}` - ).join('\n'), - stderr: '' - }) - const page = await searchRemoteRefPage('/repo', 'topic', 50) - expect(page.refDetails).toHaveLength(50) - expect(page.truncated).toBe(true) - // The caller needs 50 choices plus a sentinel; Git bounds candidates before returning them. - expect(vi.mocked(gitExecFileAsync).mock.calls[1]?.[0]).toContain('--count=204') - expect(gitExecFileAsync).toHaveBeenCalledTimes(2) - } -) diff --git a/src/main/github/pr-watch/pr-pending-actions.test.ts b/src/main/github/pr-watch/pr-pending-actions.test.ts index 9cddcddb432..3d3023d419e 100644 --- a/src/main/github/pr-watch/pr-pending-actions.test.ts +++ b/src/main/github/pr-watch/pr-pending-actions.test.ts @@ -205,68 +205,6 @@ describe('pending PR actions', () => { expect(count('pr_chat_actions')).toBe(0) }) - it('starts each due row once when an expired row ends inside the pass', async () => { - const journal = await openJournal() - const call = (ordinal: number, pr: number) => - journal.appendItem( - { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }, - shellCall('gh pr create --fill', `https://github.com/acme/repo/pull/${pr}\n`), - { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE } - ) - await call(0, 7) - clock += 25 * 60 * 60_000 - await call(1, 8) - vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] }) - try { - // A, past its expiry, ends at once; recent B's workspace is not resolvable yet. - const chatWorkspace = vi.fn(async () => null) - const resume = resumeAfterRestart({ chatWorkspace }) - resume.drain() - await vi.waitFor(() => expect(count('pr_pending_actions')).toBe(1)) - for (let pass = 0; pass < 5; pass++) { - resume.drain() - } - await Promise.resolve() - expect(chatWorkspace).toHaveBeenCalledTimes(1) - expect(vi.getTimerCount()).toBe(1) - resume.clear() - } finally { - vi.useRealTimers() - } - }) - - it('backs off a row whose end cannot be saved instead of rerunning it at once', async () => { - const journal = await openJournal() - await journal.appendItem( - { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 }, - shellCall('gh pr create --fill', 'https://github.com/acme/repo/pull/7\n'), - { fence: 0, turnScope: AGENT_JOURNAL_THREAD_SCOPE } - ) - clock += 25 * 60 * 60_000 - vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] }) - try { - // The expired row ends at once, but the disk is full: its end commits nothing. A spinning - // drain is stopped after a few turns so this fails instead of hanging. - let resume: PRPendingActionResume | undefined - const settle = vi.fn(() => { - if (settle.mock.calls.length > 10) { - resume?.clear() - } - throw new Error('SQLITE_FULL') - }) - resume = resumeAfterRestart({ settle }) - resume.drain() - expect(settle).toHaveBeenCalledTimes(2) - settle.mockClear() - clock += 60_000 - vi.advanceTimersByTime(60_000) - expect(settle).toHaveBeenCalled() - resume.clear() - } finally { - vi.useRealTimers() - } - }) - it('captures nothing from an imported transcript', async () => { const journal = await openJournal() await journal.replaceEpochItems('legacy_import', 0, [ diff --git a/src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts b/src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts index 2a496c7fce4..19be6756be8 100644 --- a/src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts +++ b/src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts @@ -1,16 +1,10 @@ import { describe, expect, it, vi } from 'vitest' import './runtime-test-module-registration.spec' -import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../shared/constants' +import '../../../shared/constants' import { OrcaRuntimeService } from '../orca-runtime' -import { - electronMocks, - scanLocalRepoWorktreesForResolutionMock -} from '../orca-runtime-test-mocks/setup.spec' +import { scanLocalRepoWorktreesForResolutionMock } from '../orca-runtime-test-mocks/setup.spec' import { HEADLESS_LEAF_ID, - TEST_WINDOW_ID, - TEST_WORKTREE_ID, - createRuntime, makeHeadlessTerminalLayout, makeRuntimeStoreWithWorkspaceSession, makeWorkspaceSessionWithHeadlessTerminal, @@ -19,111 +13,6 @@ import { import type { RuntimeWorktreeScanResult } from '../workspaces/catalog/repo-worktree-resolution-scan' describe('OrcaRuntimeService', () => { - it('starts unavailable with no authoritative window', () => { - const runtime = createRuntime() - - expect(runtime.getStatus()).toMatchObject({ - graphStatus: 'unavailable', - authoritativeWindowId: null, - desktopWindowStatus: 'openable', - rendererGraphEpoch: 0 - }) - expect(runtime.getRuntimeId()).toBeTruthy() - }) - - it('reports the configured Windows terminal shell on status', () => { - const runtime = new OrcaRuntimeService({ - ...store, - getSettings: () => ({ - ...store.getSettings(), - terminalWindowsShell: 'wsl.exe' - }) - } as never) - - expect(runtime.getStatus().terminalWindowsShell).toBe('wsl.exe') - }) - - it('reports floating workspace availability from settings on status', () => { - expect(createRuntime().getStatus().floatingWorkspaceEnabled).toBe(true) - - const disabledRuntime = new OrcaRuntimeService({ - ...store, - getSettings: () => ({ - ...store.getSettings(), - floatingTerminalEnabled: false - }) - } as never) - expect(disabledRuntime.getStatus().floatingWorkspaceEnabled).toBe(false) - }) - - it('polls floating tabs with targeted PTY liveness and no repo/provider inventory', async () => { - const getRepos = vi.fn(store.getRepos) - const listProcesses = vi.fn().mockResolvedValue([]) - const floatingPtyId = `${FLOATING_TERMINAL_WORKTREE_ID}@@pty-1` - const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession( - makeWorkspaceSessionWithHeadlessTerminal({ - activeRepoId: null, - activeWorktreeId: FLOATING_TERMINAL_WORKTREE_ID, - activeTabIdByWorktree: { [FLOATING_TERMINAL_WORKTREE_ID]: 'floating-tab' }, - tabsByWorktree: { - [FLOATING_TERMINAL_WORKTREE_ID]: [ - { - id: 'floating-tab', - ptyId: floatingPtyId, - worktreeId: FLOATING_TERMINAL_WORKTREE_ID, - title: 'Floating Terminal', - customTitle: null, - color: null, - sortOrder: 0, - createdAt: 1 - } - ] - }, - terminalLayoutsByTabId: { - 'floating-tab': makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: floatingPtyId }) - } - }) - ) - const runtime = new OrcaRuntimeService({ ...runtimeStore, getRepos } as never) - const ptyController = { - livePtyIds: new Set([floatingPtyId]), - write: () => true, - kill: () => true, - getForegroundProcess: async () => null, - hasPty(this: { livePtyIds: Set }, ptyId: string) { - return this.livePtyIds.has(ptyId) - }, - listProcesses - } - const hasPty = vi.spyOn(ptyController, 'hasPty') - runtime.setPtyController(ptyController) - - const tabs = await runtime.listMobileSessionTabs(`id:${FLOATING_TERMINAL_WORKTREE_ID}`) - const terminals = await runtime.listTerminals(`id:${FLOATING_TERMINAL_WORKTREE_ID}`) - await runtime.listMobileSessionTabs(`id:${FLOATING_TERMINAL_WORKTREE_ID}`) - await runtime.listTerminals(`id:${FLOATING_TERMINAL_WORKTREE_ID}`) - - expect(tabs.tabs).toEqual([ - expect.objectContaining({ - type: 'terminal', - parentTabId: 'floating-tab', - status: 'ready', - terminal: expect.any(String) - }) - ]) - expect(terminals.terminals).toEqual([ - expect.objectContaining({ - worktreeId: FLOATING_TERMINAL_WORKTREE_ID, - connected: true - }) - ]) - expect(hasPty).toHaveBeenCalledTimes(4) - expect(hasPty).toHaveBeenCalledWith(floatingPtyId) - expect(listProcesses).not.toHaveBeenCalled() - // Floating tabs have no repoId and must not trigger repository hydration (#9343). - expect(getRepos).not.toHaveBeenCalled() - }) - it('does not block a targeted mobile session tab list on an unrelated worktree scan', async () => { const remoteWorktreeId = 'repo-ssh::/remote/worktree' const remotePtyId = 'ssh:ssh-target@@remote-pty' @@ -214,142 +103,4 @@ describe('OrcaRuntimeService', () => { } } }) - - it('hydrates persisted tabs when the store cannot report repos', async () => { - // An unavailable repo inventory must not masquerade as an empty one and prune every tab (#9343). - const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession( - makeWorkspaceSessionWithHeadlessTerminal() - ) - const runtime = new OrcaRuntimeService({ - ...runtimeStore, - getRepos: () => undefined - } as never) - - const tabs = await runtime.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`) - - expect(tabs.tabs).toEqual([ - expect.objectContaining({ type: 'terminal', parentTabId: 'host-tab' }) - ]) - }) - - it('advertises browser screencast only when a renderer window is available', () => { - const runtime = createRuntime() - electronMocks.BrowserWindow.fromId.mockReturnValue({ isDestroyed: () => false } as never) - - runtime.attachWindow(TEST_WINDOW_ID) - - expect(runtime.getStatus().capabilities).toContain('browser.screencast.v1') - }) - - it('routes mobile Codex reset consumption through the account mutation coordinator', async () => { - const runtime = createRuntime() - const expectedScope = { - target: { runtime: 'host' as const, wslDistro: null }, - accountId: 'codex-account', - accountRevision: 42, - offerRevision: 'v1:offer' - } - const capturedCodex = { - accounts: [], - activeAccountId: expectedScope.accountId, - activeAccountIdsByRuntime: { host: expectedScope.accountId, wsl: {} } - } - const capturedRateLimits = { - codexTarget: expectedScope.target, - marker: 'captured-before-queue-advanced' - } - const codexAccounts = { - consumeRateLimitResetCredit: vi.fn().mockResolvedValue({ - outcome: 'reset', - scope: expectedScope, - codex: capturedCodex, - rateLimits: capturedRateLimits - }), - listAccounts: vi.fn(() => ({ - accounts: [], - activeAccountId: 'queued-next-account', - activeAccountIdsByRuntime: { host: 'queued-next-account', wsl: {} } - })) - } - const rateLimits = { - consumeCodexRateLimitResetCredit: vi.fn(), - getState: vi.fn(() => ({ - codexTarget: expectedScope.target, - marker: 'after-queue-advanced' - })) - } - runtime.setAccountServices({ - claudeAccounts: { - listAccounts: vi.fn(() => ({ accounts: [], activeAccountId: null })) - }, - codexAccounts, - rateLimits - } as never) - - const result = await runtime.consumeCodexRateLimitResetCredit( - '11111111-1111-4111-8111-111111111111', - expectedScope - ) - - expect(result).toMatchObject({ - outcome: 'reset', - scope: expectedScope, - snapshot: { codex: capturedCodex, rateLimits: capturedRateLimits } - }) - expect(codexAccounts.listAccounts).not.toHaveBeenCalled() - expect(rateLimits.getState).not.toHaveBeenCalled() - expect(codexAccounts.consumeRateLimitResetCredit).toHaveBeenCalledWith( - '11111111-1111-4111-8111-111111111111', - expectedScope - ) - expect(rateLimits.consumeCodexRateLimitResetCredit).not.toHaveBeenCalled() - }) - - it('maps a definite pre-provider rejection into an authoritative current snapshot', async () => { - const runtime = createRuntime() - const expectedScope = { - target: { runtime: 'host' as const, wslDistro: null }, - accountId: 'codex-account', - accountRevision: 42, - offerRevision: 'v1:stale' - } - const codex = { - accounts: [], - activeAccountId: null, - activeAccountIdsByRuntime: { host: null, wsl: {} } - } - const rateLimitState = { - codexTarget: expectedScope.target, - marker: 'current-after-rejection' - } - runtime.setAccountServices({ - claudeAccounts: { - listAccounts: vi.fn(() => ({ accounts: [], activeAccountId: null })) - }, - codexAccounts: { - consumeRateLimitResetCredit: vi.fn().mockResolvedValue({ - status: 'rejectedBeforeProvider', - retryDisposition: 'discardAttempt', - reason: 'offerChanged', - scope: expectedScope, - codex, - rateLimits: rateLimitState - }) - }, - rateLimits: {} - } as never) - - await expect( - runtime.consumeCodexRateLimitResetCredit( - '11111111-1111-4111-8111-111111111111', - expectedScope - ) - ).resolves.toMatchObject({ - status: 'rejectedBeforeProvider', - retryDisposition: 'discardAttempt', - reason: 'offerChanged', - scope: expectedScope, - snapshot: { codex, rateLimits: rateLimitState } - }) - }) }) diff --git a/src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts index f9ae9e8b4f1..cda936e93ce 100644 --- a/src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts +++ b/src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts @@ -5,13 +5,11 @@ import { TEST_WINDOW_ID, TEST_WORKTREE_ID, createRuntime, - createRuntimeWithSshLease, - store + createRuntimeWithSshLease } from './orca-runtime-test-fixtures.spec' import './runtime-test-module-registration.spec' import { makePaneKey } from '../../../shared/workspace-layout/stable-pane-id' -import { OrcaRuntimeService } from '../orca-runtime' -import type { SshRemotePtyLease } from '../../../shared/ssh-types' +import '../orca-runtime' describe('OrcaRuntimeService', () => { it('keeps a no-incarnation handle across an in-graph pane remint', async () => { @@ -150,39 +148,6 @@ describe('OrcaRuntimeService', () => { await waiting expect(settled).toBe('rejected') }) - it('recovers a moved SSH pane through the tab it now sits in, not the one its lease froze', async () => { - // A moved pane's current coordinates override the lease's frozen old tabId. - const leaseTabId = 'tab-before-move' - const currentTabId = 'tab-after-move' - const appPtyId = 'ssh:ssh-target@@pty-8' - const runtime = createRuntimeWithSshLease(appPtyId, leaseTabId) - const paneKey = makePaneKey(currentTabId, HEADLESS_LEAF_ID) - registerBoundPty(runtime, appPtyId, TEST_WORKTREE_ID, 'ssh-target', { - tabId: currentTabId, - leafId: HEADLESS_LEAF_ID - }) - const handle = runtime.resolveTerminalPane(paneKey, TEST_WORKTREE_ID).handle - runtime.onPtyExit(appPtyId, -1, undefined, { hostExitConfirmed: true }) - const createTerminal = vi.spyOn(runtime, 'createTerminal').mockResolvedValue({ - handle: 'term-replacement', - tabId: currentTabId, - paneKey, - ptyId: 'pty-replacement', - worktreeId: TEST_WORKTREE_ID, - title: null, - surface: 'background' - }) - - await expect( - runtime.recoverTerminalPane(paneKey, TEST_WORKTREE_ID, handle) - ).resolves.toMatchObject({ handle: 'term-replacement' }) - expect(createTerminal).toHaveBeenCalledWith(`id:${TEST_WORKTREE_ID}`, { - tabId: currentTabId, - leafId: HEADLESS_LEAF_ID, - focus: false, - reopensPane: true - }) - }) it('refuses a moved SSH pane addressed through the tab it left', async () => { // Old-tab coordinates must refuse the moved leaf; otherwise one PTY binds into two tabs. @@ -224,128 +189,3 @@ describe('OrcaRuntimeService', () => { expect(createTerminal).not.toHaveBeenCalled() }) }) - -// Several leases can share pane coordinates; select an eligible orphan rather than the first match. - -const TARGET = 'ssh-target' -const TAB_ID = 'tab-candidacy' - -type LeaseReader = { - workspaceSessionWorktreeHasRuntimeOwnedPtyCandidate: ( - session: { terminalLayoutsByTabId?: Record }, - worktreeId: string, - tabs: { id: string; ptyId: string | null }[] - ) => boolean - collectRecentExpiredSshLeaseTabIds: (worktreeId: string) => ReadonlySet - getRecentExpiredSshLease: ( - worktreeId: string, - tabId: string, - leafId: string | undefined, - ptyId?: string - ) => SshRemotePtyLease | null - hasRecentExpiredSshLeasePane: ( - worktreeId: string, - tab: { parentTabId: string; leafId: string } - ) => boolean -} - -function leaseFor(ptyId: string, marks: Partial = {}): SshRemotePtyLease { - const now = Date.now() - return { - targetId: TARGET, - ptyId, - worktreeId: TEST_WORKTREE_ID, - tabId: TAB_ID, - leafId: HEADLESS_LEAF_ID, - state: 'expired', - createdAt: now, - updatedAt: now, - ...marks - } -} - -function readerWithLeases(leases: SshRemotePtyLease[]): LeaseReader { - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The runtime implements these protected lease readers. - return new OrcaRuntimeService({ - ...store, - getSshRemotePtyLeases: () => leases - }) as unknown as LeaseReader -} - -const pane = { parentTabId: TAB_ID, leafId: HEADLESS_LEAF_ID } - -describe('recent expired SSH lease candidacy', () => { - it('reports a plain expired orphan', () => { - const reader = readerWithLeases([leaseFor('pty-1')]) - - expect(reader.hasRecentExpiredSshLeasePane(TEST_WORKTREE_ID, pane)).toBe(true) - }) - - it('does not report a pane whose only recent lease was superseded', () => { - // A superseded lease no longer routes to its original shell and cannot offer recovery. - const reader = readerWithLeases([leaseFor('pty-1', { supersededBy: 'pty-2' })]) - - expect(reader.hasRecentExpiredSshLeasePane(TEST_WORKTREE_ID, pane)).toBe(false) - }) - - it('does not report a pane whose only recent lease had its relay id recycled', () => { - // A recycled relay id belongs to another shell and must never be adopted. - const reader = readerWithLeases([leaseFor('pty-1', { relayIdRecycled: true })]) - - expect(reader.hasRecentExpiredSshLeasePane(TEST_WORKTREE_ID, pane)).toBe(false) - }) - - it('picks the eligible orphan over a superseded predecessor that matches first', () => { - // Store the superseded lease first to catch first-match recovery. - const reader = readerWithLeases([ - leaseFor('pty-1', { supersededBy: 'pty-2' }), - leaseFor('pty-2') - ]) - - expect(reader.getRecentExpiredSshLease(TEST_WORKTREE_ID, TAB_ID, HEADLESS_LEAF_ID)?.ptyId).toBe( - 'pty-2' - ) - expect(reader.hasRecentExpiredSshLeasePane(TEST_WORKTREE_ID, pane)).toBe(true) - }) - - it('collects the same tabs the per-tab reader reports, in one sweep of the leases', () => { - const leases = [leaseFor('pty-1', { supersededBy: 'pty-2' }), leaseFor('pty-2')] - let sweeps = 0 - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The runtime implements these protected lease readers. - const reader = new OrcaRuntimeService({ - ...store, - getSshRemotePtyLeases: () => { - sweeps += 1 - return leases - } - }) as unknown as LeaseReader - const tabs = Array.from({ length: 8 }, (_, index) => ({ - id: index === 7 ? TAB_ID : `tab-${index}`, - ptyId: null - })) - - expect( - reader.workspaceSessionWorktreeHasRuntimeOwnedPtyCandidate( - { terminalLayoutsByTabId: {} }, - TEST_WORKTREE_ID, - tabs - ) - ).toBe(true) - expect(sweeps).toBe(1) - expect([...reader.collectRecentExpiredSshLeaseTabIds(TEST_WORKTREE_ID)]).toEqual([TAB_ID]) - }) - - it('reports no candidate when no lease names any of the worktree tabs', () => { - const reader = readerWithLeases([ - leaseFor('pty-1', { tabId: 'somewhere-else', leafId: undefined }) - ]) - - expect( - reader.workspaceSessionWorktreeHasRuntimeOwnedPtyCandidate( - { terminalLayoutsByTabId: {} }, - TEST_WORKTREE_ID, - [{ id: TAB_ID, ptyId: null }] - ) - ).toBe(false) - }) -}) diff --git a/src/main/skills/skill-install-discovery-wsl.test.ts b/src/main/skills/skill-install-discovery-wsl.test.ts index dfebf98de14..165189e71ca 100644 --- a/src/main/skills/skill-install-discovery-wsl.test.ts +++ b/src/main/skills/skill-install-discovery-wsl.test.ts @@ -1,6 +1,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest' import type { SkillInstallResult } from '../../shared/skill-install-contract' -import type { SkillDiscoveryResult } from '../../shared/skills' + import type { WslResult, WslSpec } from '../wsl/execution/wsl-runner' import type { discoverSkills } from './discovery' @@ -11,15 +11,12 @@ const transport = vi.hoisted(() => ({ vi.mock('../wsl/execution/wsl-runner', () => ({ runWslProcess: transport.run })) vi.mock('./discovery', () => ({ discoverSkills: transport.native })) -import { discoverSkillsInWsl } from './skill-discovery-wsl' +import './skill-discovery-wsl' import { verifySkillInstallDiscovery } from './skill-install-discovery-verification' const home = '/home/alice' -const workspace = '/work/project' const homeAgents = `${home}/.agents/skills` const homeClaude = `${home}/.claude/skills` -const repoAgents = `${workspace}/.agents/skills` -const repoClaude = `${workspace}/.claude/skills` const pluginRoot = `${home}/.claude/plugins/cache/example/1/skills` type ScanRow = { root: string; directory: string; canonical: string; name: string } @@ -94,14 +91,6 @@ function interceptScan(rows: ScanRow[]): void { }) } -function scanScript(): string { - const script = transport.run.mock.calls.at(-1)?.[0].script - if (!script) { - throw new Error('Expected a mandatory scan') - } - return script -} - const input = { scope: 'global', homeDirectory: home, @@ -123,81 +112,6 @@ beforeEach(() => { }) describe('WSL install verification at the discovery transport boundary', () => { - it.each(['global', 'workspace'] as const)( - 'uses one fresh scan instead of two processes for a %s install with co-owners', - async (scope) => { - const canonicalRoot = scope === 'global' ? homeAgents : repoAgents - const aliasRoot = scope === 'global' ? homeClaude : repoClaude - const coownerRoot = scope === 'global' ? repoAgents : homeClaude - const canonical = `${canonicalRoot}/review` - const result = installResult([canonical, `${aliasRoot}/review`]) - interceptScan([ - skillRow(canonicalRoot), - skillRow(aliasRoot, canonical), - skillRow(coownerRoot, canonical), - skillRow(pluginRoot, canonical) - ]) - const args = { ...input, scope, workspaceDirectory: workspace, result } - const broad = await verifySkillInstallDiscovery({ - ...args, - discover: () => discoverSkillsInWsl({ distro: 'Ubuntu', homeDir: home, cwd: workspace }) - }) - expect(broad).toEqual(result) - expect(transport.run).toHaveBeenCalledTimes(2) - expect(scanScript()).toContain(`'${pluginRoot}'`) - transport.run.mockClear() - - expect(await verifySkillInstallDiscovery(args)).toEqual(broad) - expect(transport.run).toHaveBeenCalledTimes(1) - expect(transport.native).not.toHaveBeenCalled() - expect(transport.run).toHaveBeenCalledWith( - expect.objectContaining({ - distro: 'Ubuntu', - shell: 'bash', - loginPath: 'none', - timeoutMs: 10_000, - maxOutputBytes: 128 * 1024 * 1024 - }) - ) - expect(scanScript()).toContain(`'${homeAgents}'`) - expect(scanScript()).toContain(`'${repoAgents}'`) - expect(scanScript()).toContain("'review') return 0 ;;") - expect(scanScript()).not.toContain('read_metadata()') - expect(scanScript()).not.toContain(`'${pluginRoot}'`) - expect(scanScript()).not.toContain(`'${home}/.codex/plugins/cache'`) - } - ) - - it('keeps an overridden provider root even when it is also an enabled plugin root', async () => { - const canonical = `${homeAgents}/review` - const result = installResult([canonical, `${pluginRoot}/review`]) - interceptScan([skillRow(homeAgents), skillRow(pluginRoot, canonical)]) - const args = { - ...input, - result, - providerRootOverrides: { - claude: - '\\\\wsl.localhost\\Ubuntu\\home\\alice\\.claude\\plugins\\cache\\example\\1\\skills' - } - } - const broad = await verifySkillInstallDiscovery({ - ...args, - discover: () => - discoverSkillsInWsl({ - distro: 'Ubuntu', - homeDir: home, - providerRootOverrides: { claude: pluginRoot } - }) - }) - expect(broad).toEqual(result) - expect(transport.run).toHaveBeenCalledTimes(2) - transport.run.mockClear() - expect(await verifySkillInstallDiscovery(args)).toEqual(broad) - expect(transport.run).toHaveBeenCalledTimes(1) - expect(scanScript()).toContain(`'${pluginRoot}'`) - expect(scanScript()).not.toContain('read_metadata()') - }) - it('reads again for each item and fails if its canonical placement disappears', async () => { const result = installResult([`${homeAgents}/review`]) interceptScan([skillRow(homeAgents)]) @@ -232,20 +146,6 @@ describe('WSL install verification at the discovery transport boundary', () => { expect(transport.run).toHaveBeenCalledTimes(1) }) - it.each(['review', 'Review', 'réview'])( - 'verifies frontmatter name %s in a different directory without accepting unrelated siblings', - async (name) => { - const result = installResult([`${homeAgents}/review`], name) - interceptScan([ - { ...skillRow(homeAgents, `${homeAgents}/renamed`, 'renamed'), name }, - { ...skillRow(homeAgents, `${homeAgents}/other`, 'other'), name: 'other' } - ]) - expect(await verifySkillInstallDiscovery({ ...input, result })).toEqual(result) - expect(transport.run).toHaveBeenCalledTimes(1) - expect(scanScript()).toContain('matches_requested_name()') - } - ) - it.each([ { ...wslResult(''), code: 1 }, { ...wslResult(''), timedOut: true }, @@ -265,50 +165,4 @@ describe('WSL install verification at the discovery transport boundary', () => { }) expect(transport.run).toHaveBeenCalledTimes(1) }) - - it('leaves native fresh discovery arguments and answered co-owner proof unchanged', async () => { - const result = installResult([`${homeAgents}/review`, `${homeClaude}/review`]) - const discovery: SkillDiscoveryResult = { - scannedAt: 1, - skills: [ - { - id: 'review', - name: 'review', - description: null, - providers: ['agent-skills', 'claude'], - sourceKind: 'home', - sourceLabel: 'Home', - rootPath: homeAgents, - rootPaths: [homeAgents, homeClaude], - directoryPath: `${homeAgents}/review`, - skillFilePath: `${homeAgents}/review/SKILL.md`, - installed: true, - updatedAt: null - } - ], - sources: [ - { - id: 'home-agents', - label: 'Home', - path: homeAgents, - sourceKind: 'home', - providers: ['agent-skills'], - owner: null, - exists: true, - skippedReason: 'unavailable' - } - ] - } - transport.native.mockResolvedValue(discovery) - expect( - await verifySkillInstallDiscovery({ result, scope: 'global', homeDirectory: home }) - ).toEqual(result) - expect(transport.native).toHaveBeenCalledExactlyOnceWith({ - homeDir: home, - repos: [], - refresh: true, - includeCwd: false - }) - expect(transport.run).not.toHaveBeenCalled() - }) }) diff --git a/src/main/skills/skill-install-lock.test.ts b/src/main/skills/skill-install-lock.test.ts index b575387c8e9..a33eb1dfe86 100644 --- a/src/main/skills/skill-install-lock.test.ts +++ b/src/main/skills/skill-install-lock.test.ts @@ -7,7 +7,7 @@ import { reclaimDeadSkillInstallLocks, skillInstallLockPath } from './skill-install-lock' -import { readSkillInstallLockOwner } from './skill-install-lock-owner' +import './skill-install-lock-owner' const roots: string[] = [] @@ -24,15 +24,6 @@ async function readPublishedOwner(lockPath: string): Promise { - it.each([0, -1])('rejects a non-positive owner pid (%s)', async (pid) => { - const root = await mkdtemp(join(tmpdir(), 'orca-skill-lock-test-')) - roots.push(root) - const ownerPath = join(root, 'owner.json') - await writeFile(ownerPath, JSON.stringify({ token: 'invalid-pid', pid, createdAt: Date.now() })) - - await expect(readSkillInstallLockOwner(ownerPath)).resolves.toBeNull() - }) - it('reclaims a fresh legacy lock whose process was killed', async () => { const root = await mkdtemp(join(tmpdir(), 'orca-skill-lock-test-')) roots.push(root) @@ -147,32 +138,6 @@ describe('skill install lock', () => { await release() }) - it('retries when the current owner releases after a contended rename', async () => { - const root = await mkdtemp(join(tmpdir(), 'orca-skill-lock-test-')) - roots.push(root) - const lockPath = skillInstallLockPath(join(root, 'state'), join(root, 'skills', 'alpha')) - const firstRelease = await acquireSkillInstallLock({ path: lockPath }) - let attempts = 0 - - const secondRelease = await acquireSkillInstallLock({ - path: lockPath, - timeoutMs: 500, - publishLock: async (candidatePath, targetPath) => { - attempts += 1 - if (attempts === 1) { - await firstRelease() - const error = new Error('injected-contention') as NodeJS.ErrnoException - error.code = 'ENOTEMPTY' - throw error - } - await rename(candidatePath, targetPath) - } - }) - - expect(attempts).toBe(2) - await secondRelease() - }) - it('reclaims abandoned legacy owner files at startup', async () => { const root = await mkdtemp(join(tmpdir(), 'orca-skill-lock-test-')) roots.push(root) diff --git a/src/main/ssh/connection/ssh-connection-manager.test.ts b/src/main/ssh/connection/ssh-connection-manager.test.ts index b079db8fc05..d2a1092a63d 100644 --- a/src/main/ssh/connection/ssh-connection-manager.test.ts +++ b/src/main/ssh/connection/ssh-connection-manager.test.ts @@ -55,7 +55,7 @@ import { resetSshCredentialDeclinesForTests } from '../ssh-credential-decline' import { isAuthError } from '../ssh-reconnect-error-classification' -import { isSshSessionStartFailure } from '../ssh-session-start-failure' +import '../ssh-session-start-failure' import { recordSshUserDisconnected, resetSshUserDisconnectsForTests } from '../ssh-user-disconnect' const target = { @@ -84,30 +84,6 @@ describe('SshConnectionManager', () => { await rejected }) - it('tears a failed startup down quietly, so its error is not replaced by a disconnect', async () => { - mockState.connectResults.push(Promise.reject(new Error('auth failed'))) - const manager = new SshConnectionManager({ onStateChange: vi.fn() }) - await expect(manager.connect(target)).rejects.toThrow('auth failed') - expect(mockState.instances.at(-1)?.disconnect).toHaveBeenCalledWith({ quiet: true }) - expect(manager.getConnection(target.id)).toBeUndefined() - }) - - it('marks a dial that never reached the host, so setup reports SSH’s reason', async () => { - const refused = new Error('connect ECONNREFUSED 10.0.0.1:22') - mockState.connectResults.push(Promise.reject(refused)) - const manager = new SshConnectionManager({ onStateChange: vi.fn() }) - await expect(manager.connect(target)).rejects.toBe(refused) - expect(isSshSessionStartFailure(new Error('Deploy failed', { cause: refused }))).toBe(true) - }) - - it('removes the registration when bulk teardown fails', async () => { - const manager = new SshConnectionManager({ onStateChange: vi.fn() }) - await manager.connect(target) - mockState.instances[0].disconnect.mockRejectedValueOnce(new Error('close unconfirmed')) - await manager.disconnectAll() - expect(manager.getConnection(target.id)).toBeUndefined() - }) - beforeEach(() => { mockState.connectResults.length = 0 mockState.instances.length = 0 @@ -203,32 +179,6 @@ describe('SshConnectionManager', () => { expect(mockState.instances).toHaveLength(1) expect(manager.getConnection(target.id)).toBeUndefined() }) - - it('leaves a connection whose own reconnect is asking the user alone', async () => { - const manager = new SshConnectionManager({ onStateChange: vi.fn() }) - const conn = await manager.connect(target) - const opened = mockState.instances.at(-1)! - const openedCount = mockState.instances.length - // Its reconnect after a drop has the credential dialog open. - opened.status = 'connecting' - opened.awaitingCredential = true - - await expect(manager.connect(target)).rejects.toThrow('already in progress') - - expect(opened.disconnect).not.toHaveBeenCalled() - expect(mockState.instances).toHaveLength(openedCount) - expect(manager.getConnection(target.id)).toBe(conn) - }) - - it('clears the pool entry when the closed connection is still the registered one', async () => { - const manager = new SshConnectionManager({ onStateChange: vi.fn() }) - const conn = await manager.connect(target) - - await manager.disconnectConnection(target.id, conn) - - expect(mockState.instances[0].disconnect).toHaveBeenCalledOnce() - expect(manager.getConnection(target.id)).toBeUndefined() - }) }) describe('SshConnectionManager after a cancelled sign-in', () => { @@ -248,14 +198,6 @@ describe('SshConnectionManager after a cancelled sign-in', () => { expect(mockState.instances).toHaveLength(0) }) - it('still reuses a connection that is already up', async () => { - const manager = new SshConnectionManager({ onStateChange: vi.fn() }) - const conn = await manager.connect(target) - recordSshCredentialDeclined(target.id) - - await expect(manager.connect(target)).resolves.toBe(conn) - }) - it('refuses a background dial to a host awaiting its first sign-in, saying so', async () => { const manager = new SshConnectionManager({ onStateChange: vi.fn() }) recordSshSignInAwaited(target.id) @@ -311,11 +253,4 @@ describe('SshConnectionManager after a user Disconnect', () => { await expect(manager.connect(target)).rejects.toThrow('was disconnected') }) - - it("dials a user's connection test", async () => { - const manager = new SshConnectionManager({ onStateChange: vi.fn() }) - recordSshUserDisconnected(target.id) - - await expect(manager.connect(target, { probe: true })).resolves.toBeDefined() - }) }) diff --git a/src/main/ssh/legacy-relay/legacy-relay-cli-legacy-records.test.ts b/src/main/ssh/legacy-relay/legacy-relay-cli-legacy-records.test.ts index df86998e416..4477d1eb6e0 100644 --- a/src/main/ssh/legacy-relay/legacy-relay-cli-legacy-records.test.ts +++ b/src/main/ssh/legacy-relay/legacy-relay-cli-legacy-records.test.ts @@ -129,17 +129,6 @@ async function run( } describe('the relay-era orca CLI on migrated legacy orchestration records', () => { - it('attests the bridge-verified worker instead of answering read-only', async () => { - const { runtime, database } = legacyRuntime() - expect(database.getLegacyAdoption()).toBeTruthy() - const check = await run(runtime, ['orchestration', 'check', '--json']) - expect(check.exitCode).toBe(0) - expect(check.body).toMatchObject({ - ok: true, - result: { legacyCompatibility: { readOnly: false } } - }) - }) - it('never lets a host pane adopt the unbound legacy coordinator by naming its handle', async () => { const { runtime, database, taskId, dispatchId } = legacyRuntime() const escalation = await run(runtime, escalationArgv(taskId, dispatchId)) @@ -266,26 +255,4 @@ describe('the relay-era orca CLI on migrated legacy orchestration records', () = ] await expect(run(runtime, fresh)).rejects.toThrow(LEGACY_RELAY_CLI_UNVERIFIED) }) - - it('vouches only for the exact terminal its attachment carries', () => { - const runtime = new OrcaRuntimeService() - const terminal = { handle: WORKER, paneKey: WORKER_PANE, processIncarnation: `${PTY_ID}:inc-1` } - const host = runtime.registerOrchestrationCompatibilitySshAttachment(TARGET, 'c-1', terminal) - const evidence = { terminalHandle: WORKER, paneKey: WORKER_PANE, launchToken: 't', host } - expect(runtime.verifyOrchestrationCompatibilityCaller(evidence)).toMatchObject({ - terminalHandle: WORKER, - processIncarnation: `${PTY_ID}:inc-1`, - hostScope: { kind: 'ssh', targetId: TARGET } - }) - for (const forged of [ - { ...evidence, terminalHandle: 'term_other' }, - { ...evidence, paneKey: 'tab_x:55555555-5555-4555-8555-555555555555' }, - { ...evidence, host: { ...host, targetId: 'other-target' } }, - { ...evidence, host: { ...host, connectionIncarnation: 'c-2' } } - ]) { - expect(runtime.verifyOrchestrationCompatibilityCaller(forged)).toBeNull() - } - runtime.releaseOrchestrationCompatibilitySshAttachment(host.attachmentId) - expect(runtime.verifyOrchestrationCompatibilityCaller(evidence)).toBeNull() - }) }) diff --git a/src/main/ssh/legacy-relay/legacy-relay-cli-server.test.ts b/src/main/ssh/legacy-relay/legacy-relay-cli-server.test.ts index 188005ff57f..b55412daba8 100644 --- a/src/main/ssh/legacy-relay/legacy-relay-cli-server.test.ts +++ b/src/main/ssh/legacy-relay/legacy-relay-cli-server.test.ts @@ -4,7 +4,7 @@ import { join } from 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import { CONNECTOR_REPLY_UNAVAILABLE } from '../../../shared/rpc-contract/connector-params' import { toAppSshPtyId } from '../../../shared/ssh-pty-id' -import { isRemoteCliControlAllowed } from '../../../shared/ssh-remote-cli-control' +import '../../../shared/ssh-remote-cli-control' import { OrcaRuntimeService } from '../../runtime/orca-runtime' import { OrchestrationDb } from '../../runtime/orchestration/db/orchestration-db' import '../../runtime/orchestration/db/contract-constants' @@ -143,20 +143,6 @@ describe('the relay-era orca CLI on the desktop runtime', () => { expect(db.getTask(ids.taskId)?.status).toBe('dispatched') }) - it.each([ - ['no saved value', {}, true], - ['an explicit true', { allowRemoteCliControl: true }, true], - ['an explicit false', { allowRemoteCliControl: false }, false] - ])('admits per the saved switch: %s', async (_label, saved, admitted) => { - allowed = isRemoteCliControlAllowed(saved) - const check = run(['orchestration', 'check', '--json']) - if (admitted) { - expect((await check).exitCode).toBe(0) - } else { - await expect(check).rejects.toThrow(LEGACY_RELAY_CLI_CONTROL_OFF) - } - }) - it('refuses commands outside orchestration', async () => { await expect(run(['worktree', 'list'])).rejects.toThrow(LEGACY_RELAY_CLI_UNSUPPORTED) await expect(run(['terminal', 'send', '--terminal', COORDINATOR])).rejects.toThrow( @@ -238,25 +224,6 @@ describe('the relay-era orca CLI on the desktop runtime', () => { expect(db.getInbox(100)).toHaveLength(1) }) - it('sends to its own coordinator', async () => { - const sent = await run([ - 'orchestration', - 'send', - '--to', - COORDINATOR, - '--subject', - 'progress', - '--json' - ]) - expect(json(sent)).toMatchObject({ ok: true }) - }) - - it('refuses a malformed post-output action', async () => { - await expect( - server().postOutput({ env: ENV, postOutput: { kind: 'other' } }, new AbortController().signal) - ).rejects.toThrow('Invalid SSH CLI post-output action.') - }) - it('replays a completed worker_done after its Dispatch settled, and nothing new', async () => { const retry = ['--retry-request', '11111111-1111-4111-8111-111111111111'] const first = await run([...workerDone(), ...retry]) @@ -269,23 +236,6 @@ describe('the relay-era orca CLI on the desktop runtime', () => { ).rejects.toThrow(LEGACY_RELAY_CLI_UNVERIFIED) }) - it('answers --help without running the command', async () => { - for (const flag of ['--help', '-h']) { - expect(await run([...workerDone(), flag])).toMatchObject({ exitCode: 0, stderr: '' }) - } - expect(db.getTask(ids.taskId)?.status).toBe('dispatched') - }) - - it('refuses an emptied --retry-request instead of starting a new mutation', async () => { - for (const argv of [ - [...workerDone(), '--retry-request='], - [...workerDone(), '--retry-request'] - ]) { - await expect(run(argv)).rejects.toThrow(/--retry-request/) - } - expect(db.getTask(ids.taskId)?.status).toBe('dispatched') - }) - it('replays a completed worker_done after the terminal took a new assignment', async () => { const retry = ['--retry-request', '44444444-4444-4444-8444-444444444444'] const first = await run([...workerDone(), ...retry]) diff --git a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts b/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts deleted file mode 100644 index efb6a179130..00000000000 --- a/src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts +++ /dev/null @@ -1,310 +0,0 @@ -import type * as ExecCommandModule from '../remote-exec/remote-exec-command' -import { describe, expect, it, vi } from 'vitest' -import { RELAY_LSOF_PROBE_JS } from '@orca/process-host/posix-lsof-probe' - -const execCommand = vi.fn() -vi.mock('../remote-exec/remote-exec-command', async (importOriginal) => ({ - ...(await importOriginal()), - execCommand: (...args: unknown[]) => execCommand(...args), - isUnconfirmedSshCommandTermination: (error: unknown) => - (error as { sshChannelCloseConfirmed?: boolean } | null)?.sshChannelCloseConfirmed === false -})) - -import { - isReapableRelayHusk, - parseRelayEndpointIncumbentProbe, - probeRelayEndpointIncumbent, - relayEndpointIncumbentProbeCommand -} from './ssh-relay-endpoint-incumbent' -import { getRemoteHostPlatform } from '../ssh-remote-platform' -import { unusedSshConnection } from '../unused-host-transport.test-fixture' - -const connection = unusedSshConnection() - -const SOCK = '/home/u/.orca-remote/relay-0.1.0+aaaa/relay-deadbeef.sock' -const POSIX_HOST = getRemoteHostPlatform('linux-x64') -const WINDOWS_HOST = getRemoteHostPlatform('win32-x64') - -function probeOutput(lines: string[]): string { - return ['ORCA-INCUMBENT-BEGIN', ...lines, 'ORCA-INCUMBENT-END'].join('\n') -} - -describe('parseRelayEndpointIncumbentProbe', () => { - it('reports live when the socket accepted a connection', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput([ - 'PRESENT=yes', - 'LISTEN=accepted', - 'HOLDERS_SOURCE=lsof', - 'HOLDER=4242 yes 13 11' - ]) - ) - expect(incumbent.verdict).toBe('live') - expect(incumbent.evidence).toBe('accepted-connection') - expect(incumbent.holders).toEqual([ - { pid: 4242, matchesRelayArgv: true, childCount: 13, unrecognizedChildCount: 11 } - ]) - }) - - it('reports live when a process still holds an inode that refuses connections', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof', 'HOLDER=91 yes 2 2']) - ) - expect(incumbent.verdict).toBe('live') - expect(incumbent.evidence).toBe('holder-process') - }) - - it('reports exited only when the connect was refused AND nothing holds the socket', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput([ - 'PRESENT=yes', - 'LISTEN=refused', - 'FS_TYPE=linux ef53 ef53', - 'HOLDERS_SOURCE=lsof' - ]) - ) - expect(incumbent.verdict).toBe('exited') - expect(incumbent.evidence).toBe('no-holder') - expect(incumbent.socketPresent).toBe(true) - }) - - it('reports exited for a refused socket on a macOS boot-volume filesystem or Linux tmpfs', () => { - for (const fsType of ['darwin 1a 1a', 'Linux 1021994 ef53', 'darwin-mount apfs']) { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=refused', `FS_TYPE=${fsType}`, 'HOLDERS_SOURCE=lsof']) - ) - expect(incumbent.verdict).toBe('exited') - } - }) - - // Shared-home sockets may be held on another kernel; local refusal/no-holder evidence cannot prove exit. - it('reports unverifiable for a refused socket that another machine may hold', () => { - for (const fsType of [ - 'linux 6969 ef53', // nfs - 'linux ff534d42 ef53', // cifs - 'linux 65735546 ef53', // fuse (sshfs) - 'darwin 1c 1a', // macOS nfs/smbfs - 'darwin-mount nfs', - 'darwin-mount smbfs', - 'darwin-mount ', // no mount line matched - 'linux ', // statfs unavailable - 'freebsd 35 35' - ]) { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=refused', `FS_TYPE=${fsType}`, 'HOLDERS_SOURCE=lsof']) - ) - expect(incumbent.verdict).toBe('unverifiable') - } - const withoutType = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof']) - ) - expect(withoutType.verdict).toBe('unverifiable') - }) - - it('still reports exited for a socket path that no longer exists, on any filesystem', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=no', 'LISTEN=absent', 'FS_TYPE=linux 6969 ef53', 'HOLDERS_SOURCE=lsof']) - ) - expect(incumbent.verdict).toBe('exited') - }) - - it('reports unverifiable when the host cannot enumerate socket holders', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=unavailable']) - ) - expect(incumbent.verdict).toBe('unverifiable') - expect(incumbent.holdersEnumerable).toBe(false) - }) - - it('reports unverifiable when the connect probe timed out', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=unknown', 'HOLDERS_SOURCE=lsof']) - ) - expect(incumbent.verdict).toBe('unverifiable') - }) - - it('reports unverifiable for truncated or garbled probe output', () => { - expect(parseRelayEndpointIncumbentProbe(SOCK, 'PRESENT=yes\nLISTEN=refused').verdict).toBe( - 'unverifiable' - ) - expect(parseRelayEndpointIncumbentProbe(SOCK, '').verdict).toBe('unverifiable') - }) - - it('drops holder lines that do not carry a usable pid', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput([ - 'PRESENT=yes', - 'LISTEN=refused', - 'FS_TYPE=linux ef53 ef53', - 'HOLDERS_SOURCE=lsof', - 'HOLDER=- no unknown unknown' - ]) - ) - expect(incumbent.holders).toEqual([]) - expect(incumbent.verdict).toBe('exited') - }) - - it('keeps an unreadable child count as null rather than zero', () => { - const [holder] = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput([ - 'PRESENT=yes', - 'LISTEN=accepted', - 'HOLDERS_SOURCE=lsof', - 'HOLDER=7 yes unknown unknown' - ]) - ).holders - expect(holder.childCount).toBeNull() - expect(holder.unrecognizedChildCount).toBeNull() - }) - - it('keeps a holder line with no unrecognized-child field unreapable', () => { - const incumbent = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=7 yes 0']) - ) - expect(incumbent.holders[0].unrecognizedChildCount).toBeNull() - expect(isReapableRelayHusk(incumbent)).toBe(false) - }) -}) - -describe('probeRelayEndpointIncumbent', () => { - it('keeps the whole probe alive long enough to return a bounded lsof result', async () => { - execCommand.mockResolvedValueOnce( - probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=unavailable']) - ) - - await probeRelayEndpointIncumbent(connection, POSIX_HOST, '/usr/bin/node', SOCK) - - expect(execCommand).toHaveBeenCalledWith(expect.anything(), expect.any(String), { - wrapCommand: true, - signal: undefined - }) - }) - - it('keeps a confirmed timeout or rejection unverifiable and unenumerable', async () => { - execCommand.mockRejectedValueOnce( - Object.assign(new Error('lsof timed out after 5s'), { sshChannelCloseConfirmed: true }) - ) - const incumbent = await probeRelayEndpointIncumbent( - connection, - POSIX_HOST, - '/usr/bin/node', - SOCK - ) - expect(incumbent.verdict).toBe('unverifiable') - expect(incumbent.holdersEnumerable).toBe(false) - expect(incumbent.holders).toEqual([]) - }) - - it('rethrows an unconfirmed termination instead of masking it as unverifiable', async () => { - const unconfirmed = Object.assign(new Error('remote channel close was not confirmed'), { - sshChannelCloseConfirmed: false - }) - execCommand.mockRejectedValueOnce(unconfirmed) - - await expect( - probeRelayEndpointIncumbent(connection, POSIX_HOST, '/usr/bin/node', SOCK) - ).rejects.toBe(unconfirmed) - }) - - it('does not shell out on Windows hosts, where the endpoint is a named pipe', async () => { - execCommand.mockClear() - const incumbent = await probeRelayEndpointIncumbent(connection, WINDOWS_HOST, 'node.exe', SOCK) - expect(execCommand).not.toHaveBeenCalled() - expect(incumbent.verdict).toBe('unverifiable') - }) -}) - -describe('relayEndpointIncumbentProbeCommand', () => { - it('ANDs the lsof selectors so it cannot match unrelated unix-socket holders', () => { - expect(RELAY_LSOF_PROBE_JS).toContain("['-t', '-a', '-U', process.argv[1]]") - }) - - it('never unlinks the relay endpoint', () => { - const command = relayEndpointIncumbentProbeCommand('/usr/bin/node', SOCK) - expect(command).not.toMatch(/\brm\b/) - }) - - it('bounds only lsof and keeps the connect-probe output available', () => { - const command = relayEndpointIncumbentProbeCommand('/usr/bin/node', SOCK) - expect(RELAY_LSOF_PROBE_JS).toContain("spawn('lsof'") - expect(command).toContain('}, 5000)') - expect(command).toContain("printf 'HOLDERS_SOURCE=unavailable\\n'") - expect(command.indexOf("printf 'LISTEN=%s\\n'")).toBeLessThan(command.indexOf('child = spawn(')) - }) -}) - -describe('isReapableRelayHusk', () => { - const husk = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 0 0']) - ) - - it('accepts a single proven relay holder with no unaccounted-for children', () => { - expect(isReapableRelayHusk(husk)).toBe(true) - }) - - it('accepts a relay whose only children are its own service processes (#13614)', () => { - const withServices = parseRelayEndpointIncumbentProbe( - SOCK, - probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 2 0']) - ) - expect(withServices.holders[0].childCount).toBe(2) - expect(isReapableRelayHusk(withServices)).toBe(true) - }) - - it('refuses a relay that still holds children it could not account for', () => { - expect( - isReapableRelayHusk({ - ...husk, - holders: [{ pid: 500, matchesRelayArgv: true, childCount: 3, unrecognizedChildCount: 1 }] - }) - ).toBe(false) - }) - - it('refuses a holder whose unrecognized-child count could not be read', () => { - expect( - isReapableRelayHusk({ - ...husk, - holders: [{ pid: 500, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: null }] - }) - ).toBe(false) - }) - - it('refuses a holder whose argv is not this relay at this socket', () => { - expect( - isReapableRelayHusk({ - ...husk, - holders: [{ pid: 500, matchesRelayArgv: false, childCount: 0, unrecognizedChildCount: 0 }] - }) - ).toBe(false) - }) - - it('refuses when more than one process holds the socket', () => { - expect( - isReapableRelayHusk({ - ...husk, - holders: [ - { pid: 500, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: 0 }, - { pid: 501, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: 0 } - ] - }) - ).toBe(false) - }) - - it('refuses an unverifiable endpoint however empty it looks', () => { - expect(isReapableRelayHusk({ ...husk, verdict: 'unverifiable' })).toBe(false) - expect(isReapableRelayHusk({ ...husk, holdersEnumerable: false })).toBe(false) - }) -}) diff --git a/src/main/startup/hydrate-shell-path.test.ts b/src/main/startup/hydrate-shell-path.test.ts deleted file mode 100644 index 6f0728cee9c..00000000000 --- a/src/main/startup/hydrate-shell-path.test.ts +++ /dev/null @@ -1,361 +0,0 @@ -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import { EventEmitter } from 'node:events' -import { delimiter } from 'node:path' -import type { ChildProcessWithoutNullStreams } from 'node:child_process' -import { - _resetHydrateShellPathCache, - hydrateShellPath, - mergePathSegments, - _setLaunchPathForTests, - type HydrationResult -} from './hydrate-shell-path' - -const { spawnMock } = vi.hoisted(() => ({ - spawnMock: vi.fn() -})) - -vi.mock('child_process', () => ({ - spawn: spawnMock -})) - -type HydrationSpawner = (shell: string) => Promise - -function createMockShellProcess(): ChildProcessWithoutNullStreams { - const proc = new EventEmitter() as ChildProcessWithoutNullStreams - Object.assign(proc, { - stdout: new EventEmitter(), - stderr: new EventEmitter(), - stdin: new EventEmitter(), - kill: vi.fn() - }) - return proc -} - -describe('hydrateShellPath', () => { - const originalPath = process.env.PATH - - beforeEach(() => { - _resetHydrateShellPathCache() - spawnMock.mockReset() - }) - - afterEach(() => { - vi.restoreAllMocks() - if (originalPath === undefined) { - delete process.env.PATH - } else { - process.env.PATH = originalPath - } - }) - - it('invokes the provided shell with a custom spawner and returns its segments', async () => { - let capturedShell = '' - const result = await hydrateShellPath({ - shellOverride: '/bin/zsh', - spawner: async (shell) => { - capturedShell = shell - return { - segments: ['/Users/tester/.opencode/bin', '/Users/tester/.cargo/bin'], - ok: true, - failureReason: 'none' - } - } - }) - - expect(capturedShell).toBe('/bin/zsh') - expect(result.ok).toBe(true) - expect(result.segments).toEqual(['/Users/tester/.opencode/bin', '/Users/tester/.cargo/bin']) - expect(result.failureReason).toBe('none') - }) - - it('caches the hydration result so repeated calls do not re-spawn', async () => { - let spawnCount = 0 - const spawner: HydrationSpawner = async () => { - spawnCount += 1 - return { segments: ['/a'], ok: true, failureReason: 'none' } - } - - await hydrateShellPath({ shellOverride: '/bin/zsh', spawner }) - await hydrateShellPath({ shellOverride: '/bin/zsh', spawner }) - await hydrateShellPath({ shellOverride: '/bin/zsh', spawner }) - - expect(spawnCount).toBe(1) - }) - - it('re-spawns when force:true is passed — matches the Refresh button contract', async () => { - let spawnCount = 0 - const spawner: HydrationSpawner = async () => { - spawnCount += 1 - return { segments: ['/a'], ok: true, failureReason: 'none' } - } - - await hydrateShellPath({ shellOverride: '/bin/zsh', spawner }) - await hydrateShellPath({ shellOverride: '/bin/zsh', spawner, force: true }) - - expect(spawnCount).toBe(2) - }) - - it('continues the probe queue after a rejected hydration', async () => { - const rejectedSpawner = vi.fn(async () => { - throw new Error('profile failed') - }) - const successfulSpawner = vi.fn(async () => ({ - segments: ['/current'], - ok: true, - failureReason: 'none' - })) - - await expect( - hydrateShellPath({ shellOverride: '/bin/zsh', spawner: rejectedSpawner, force: true }) - ).rejects.toThrow('profile failed') - await expect( - hydrateShellPath({ shellOverride: '/bin/bash', spawner: successfulSpawner, force: true }) - ).resolves.toEqual({ segments: ['/current'], ok: true, failureReason: 'none' }) - - expect(successfulSpawner).toHaveBeenCalledWith('/bin/bash') - }) - - it('re-probes after a rejected hydration instead of serving the cached rejection', async () => { - const spawner = vi.fn() - spawner - .mockRejectedValueOnce(new Error('profile failed')) - .mockResolvedValueOnce({ segments: ['/retried'], ok: true, failureReason: 'none' }) - - await expect(hydrateShellPath({ shellOverride: '/bin/zsh', spawner })).rejects.toThrow( - 'profile failed' - ) - await expect(hydrateShellPath({ shellOverride: '/bin/zsh', spawner })).resolves.toEqual({ - segments: ['/retried'], - ok: true, - failureReason: 'none' - }) - expect(spawner).toHaveBeenCalledTimes(2) - }) - - it('reports spawn_error instead of rejecting when spawn throws synchronously', async () => { - spawnMock.mockImplementation(() => { - throw Object.assign(new Error('spawn EACCES'), { code: 'EACCES' }) - }) - - await expect(hydrateShellPath({ shellOverride: '/bin/zsh', force: true })).resolves.toEqual({ - segments: [], - ok: false, - failureReason: 'spawn_error' - }) - }) - - it('returns failureReason:no_shell when no shell is available (Windows path)', async () => { - const result = await hydrateShellPath({ - shellOverride: null, - spawner: async () => { - throw new Error('spawner must not run when shell is null') - } - }) - - expect(result).toEqual({ segments: [], ok: false, failureReason: 'no_shell' }) - }) - - // Keep failure classifications distinct; the spawner override isolates propagation from real-shell classification. - it('propagates failureReason:timeout from the spawner', async () => { - const result = await hydrateShellPath({ - shellOverride: '/bin/zsh', - spawner: async () => ({ segments: [], ok: false, failureReason: 'timeout' }) - }) - expect(result).toEqual({ segments: [], ok: false, failureReason: 'timeout' }) - }) - - it('propagates failureReason:spawn_error from the spawner', async () => { - const result = await hydrateShellPath({ - shellOverride: '/bin/zsh', - spawner: async () => ({ segments: [], ok: false, failureReason: 'spawn_error' }) - }) - expect(result).toEqual({ segments: [], ok: false, failureReason: 'spawn_error' }) - }) - - it('propagates failureReason:empty_path from the spawner', async () => { - const result = await hydrateShellPath({ - shellOverride: '/bin/zsh', - spawner: async () => ({ segments: [], ok: false, failureReason: 'empty_path' }) - }) - expect(result).toEqual({ segments: [], ok: false, failureReason: 'empty_path' }) - }) - - it('cleans up shell listeners when hydration times out', async () => { - vi.useFakeTimers() - const proc = createMockShellProcess() - spawnMock.mockReturnValue(proc) - - try { - const resultPromise = hydrateShellPath({ shellOverride: '/bin/zsh', force: true }) - const assertion = expect(resultPromise).resolves.toEqual({ - segments: [], - ok: false, - failureReason: 'timeout' - }) - - await vi.advanceTimersByTimeAsync(10_000) - - await assertion - expect(proc.kill).toHaveBeenCalledWith('SIGKILL') - expect(proc.stdout.listenerCount('data')).toBe(0) - expect(proc.listenerCount('error')).toBe(0) - expect(proc.listenerCount('close')).toBe(0) - } finally { - vi.useRealTimers() - } - }) - - async function captureProbeEnv(shell = '/bin/bash'): Promise { - const proc = createMockShellProcess() - spawnMock.mockReturnValue(proc) - const resultPromise = hydrateShellPath({ shellOverride: shell, force: true }) - await vi.waitFor(() => expect(spawnMock).toHaveBeenCalled()) - proc.emit('close', 0) - await resultPromise - return spawnMock.mock.calls[0][2].env - } - - it('probes with the launch PATH so seeded fallbacks cannot pin nvm', async () => { - process.env.PATH = `/home/u/.nvm/versions/node/v26.7.0/bin${delimiter}/usr/bin` - _setLaunchPathForTests('/usr/bin') - - expect((await captureProbeEnv()).PATH).toBe('/usr/bin') - }) - - it('uses the PATH captured at module load, not a later mutation of process.env', async () => { - // The probe must retain launch PATH even after packaged seeding mutates process.env. - const seeded = `/seeded/newest-nvm/bin${delimiter}/usr/bin` - process.env.PATH = seeded - - expect((await captureProbeEnv()).PATH).not.toBe(seeded) - }) - - it('sets a probe marker so rc files can take a fast path', async () => { - expect((await captureProbeEnv()).ORCA_SHELL_PATH_PROBE).toBe('1') - }) - - it.skipIf(process.platform === 'win32').each(['/bin/bash', '/bin/zsh'])( - 'keeps the POSIX login probe for %s', - async (shell) => { - await captureProbeEnv(shell) - - expect(spawnMock.mock.calls[0][1]).toEqual([ - '-ilc', - `printf '%s' '__ORCA_SHELL_PATH__'; printf '%s' "$PATH"; printf '%s' '__ORCA_SHELL_PATH__'` - ]) - } - ) - - it.skipIf(process.platform === 'win32')( - 'reads Nushell PATH while preserving interactive login configuration', - async () => { - const proc = createMockShellProcess() - spawnMock.mockReturnValue(proc) - const resultPromise = hydrateShellPath({ - shellOverride: '/run/current-system/sw/bin/nu', - force: true - }) - await vi.waitFor(() => expect(spawnMock).toHaveBeenCalled()) - - expect(spawnMock.mock.calls[0][1]).toEqual([ - '-ilc', - [ - "print -n '__ORCA_SHELL_PATH__';", - 'print -n ($env.PATH | str join (char esep));', - "print -n '__ORCA_SHELL_PATH__'" - ].join(' ') - ]) - proc.stdout.emit( - 'data', - Buffer.from('__ORCA_SHELL_PATH__/etc/profiles/per-user/me/bin:/usr/bin__ORCA_SHELL_PATH__') - ) - proc.emit('close', 0) - - await expect(resultPromise).resolves.toEqual({ - segments: ['/etc/profiles/per-user/me/bin', '/usr/bin'], - ok: true, - failureReason: 'none' - }) - } - ) - - it('overwrites the captured key in place so Windows never carries both Path and PATH', async () => { - vi.spyOn(process, 'platform', 'get').mockReturnValue('win32') - const originalWindowsPath = process.env.Path - delete process.env.PATH - process.env.PATH = 'C:\\Users\\u\\.nvm\\versions\\node\\v22.9.0\\bin;C:\\Windows' - process.env.Path = 'C:\\Users\\u\\.nvm\\versions\\node\\v22.9.0\\bin;C:\\Windows' - _setLaunchPathForTests('C:\\Windows', 'Path') - - try { - const env = await captureProbeEnv('C:/Git/bin/bash.exe') - expect(env.Path).toBe('C:\\Windows') - expect(env.PATH).toBeUndefined() - } finally { - if (originalWindowsPath === undefined) { - delete process.env.Path - } else { - process.env.Path = originalWindowsPath - } - } - }) -}) - -describe('mergePathSegments', () => { - const originalPath = process.env.PATH - - beforeEach(() => { - _resetHydrateShellPathCache() - }) - - afterEach(() => { - if (originalPath === undefined) { - delete process.env.PATH - } else { - process.env.PATH = originalPath - } - }) - - // Use the host delimiter so this suite also runs on Windows. - const joinPath = (...segments: string[]): string => segments.join(delimiter) - - it('prepends new segments ahead of existing PATH entries', () => { - process.env.PATH = joinPath('/usr/bin', '/bin') - - const added = mergePathSegments(['/Users/tester/.opencode/bin', '/Users/tester/.cargo/bin']) - - expect(added).toEqual(['/Users/tester/.opencode/bin', '/Users/tester/.cargo/bin']) - expect(process.env.PATH).toBe( - joinPath('/Users/tester/.opencode/bin', '/Users/tester/.cargo/bin', '/usr/bin', '/bin') - ) - }) - - it('promotes shell segments already on PATH so shell ordering wins', () => { - process.env.PATH = joinPath('/Users/tester/.cargo/bin', '/usr/bin') - - const added = mergePathSegments(['/Users/tester/.cargo/bin', '/Users/tester/.opencode/bin']) - - expect(added).toEqual(['/Users/tester/.opencode/bin']) - expect(process.env.PATH).toBe( - joinPath('/Users/tester/.cargo/bin', '/Users/tester/.opencode/bin', '/usr/bin') - ) - }) - - it('moves user-local shell paths ahead of packaged Homebrew fallbacks', () => { - process.env.PATH = joinPath('/opt/homebrew/bin', '/Users/tester/.local/bin', '/usr/bin', '/bin') - - const added = mergePathSegments(['/Users/tester/.local/bin', '/opt/homebrew/bin']) - - expect(added).toEqual([]) - expect(process.env.PATH).toBe( - joinPath('/Users/tester/.local/bin', '/opt/homebrew/bin', '/usr/bin', '/bin') - ) - }) - - it('returns [] and leaves PATH untouched when given nothing', () => { - process.env.PATH = joinPath('/usr/bin', '/bin') - - expect(mergePathSegments([])).toEqual([]) - expect(process.env.PATH).toBe(joinPath('/usr/bin', '/bin')) - }) -}) diff --git a/src/main/startup/hydrate-shell-path.windows.test.ts b/src/main/startup/hydrate-shell-path.windows.test.ts index 681890115d4..6e6d17932ed 100644 --- a/src/main/startup/hydrate-shell-path.windows.test.ts +++ b/src/main/startup/hydrate-shell-path.windows.test.ts @@ -1,6 +1,6 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import { EventEmitter } from 'node:events' -import type { ChildProcessWithoutNullStreams } from 'node:child_process' +import 'node:events' + import { _resetHydrateShellPathCache, configureWindowsShellPathHydration, @@ -32,17 +32,6 @@ function deferred(): Deferred { return { promise, resolve } } -function createMockShellProcess(): ChildProcessWithoutNullStreams { - const proc = new EventEmitter() as ChildProcessWithoutNullStreams - Object.assign(proc, { - stdout: new EventEmitter(), - stderr: new EventEmitter(), - stdin: new EventEmitter(), - kill: vi.fn() - }) - return proc -} - describe('Windows shell PATH hydration', () => { const originalPath = process.env.PATH @@ -61,171 +50,6 @@ describe('Windows shell PATH hydration', () => { } }) - it('hydrates the default PowerShell profile PATH on Windows (#13328)', async () => { - const spawner = vi.fn(async () => ({ - segments: ['C:\\Users\\tester\\AppData\\Local\\fnm'], - ok: true, - failureReason: 'none' - })) - - await expect(hydrateShellPath({ spawner })).resolves.toEqual({ - segments: ['C:\\Users\\tester\\AppData\\Local\\fnm'], - ok: true, - failureReason: 'none' - }) - expect(spawner).toHaveBeenCalledWith('powershell.exe') - }) - - it('uses the configured PowerShell executable', async () => { - const spawner = vi.fn(async () => ({ - segments: ['C:\\tools'], - ok: true, - failureReason: 'none' - })) - - configureWindowsShellPathHydration('C:\\Program Files\\PowerShell\\7\\pwsh.exe') - await hydrateShellPath({ spawner }) - - expect(spawner).toHaveBeenCalledWith('C:\\Program Files\\PowerShell\\7\\pwsh.exe') - }) - - it('falls back to Windows PowerShell when preferred pwsh cannot spawn', async () => { - const spawner = vi.fn() - spawner - .mockResolvedValueOnce({ segments: [], ok: false, failureReason: 'spawn_error' }) - .mockResolvedValueOnce({ - segments: ['C:\\WindowsPowerShell-profile'], - ok: true, - failureReason: 'none' - }) - configureWindowsShellPathHydration('pwsh.exe', null, 'powershell.exe') - - await expect(hydrateShellPath({ spawner })).resolves.toEqual({ - segments: ['C:\\WindowsPowerShell-profile'], - ok: true, - failureReason: 'none' - }) - expect(spawner.mock.calls).toEqual([['pwsh.exe'], ['powershell.exe']]) - }) - - it('falls back to Windows PowerShell when pwsh throws synchronously at spawn', async () => { - const proc = createMockShellProcess() - spawnMock - .mockImplementationOnce(() => { - throw Object.assign(new Error('spawn EPERM'), { code: 'EPERM' }) - }) - .mockReturnValueOnce(proc) - configureWindowsShellPathHydration('pwsh.exe', null, 'powershell.exe') - - const resultPromise = hydrateShellPath() - await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(2)) - proc.stdout.emit('data', Buffer.from('__ORCA_SHELL_PATH__C:\\inbox-ps__ORCA_SHELL_PATH__')) - proc.emit('close', 0, null) - - await expect(resultPromise).resolves.toEqual({ - segments: ['C:\\inbox-ps'], - ok: true, - failureReason: 'none' - }) - expect(spawnMock.mock.calls.map((call) => call[0])).toEqual(['pwsh.exe', 'powershell.exe']) - }) - - it('reports spawn_error when every shell throws synchronously at spawn', async () => { - spawnMock.mockImplementation(() => { - throw Object.assign(new Error('spawn EPERM'), { code: 'EPERM' }) - }) - configureWindowsShellPathHydration('pwsh.exe', null, 'powershell.exe') - - await expect(hydrateShellPath()).resolves.toEqual({ - segments: [], - ok: false, - failureReason: 'spawn_error' - }) - }) - - it('uses the resolved Git Bash executable for the configured sentinel', async () => { - const spawner = vi.fn(async () => ({ - segments: ['C:\\tools'], - ok: true, - failureReason: 'none' - })) - - configureWindowsShellPathHydration('git-bash', 'C:\\Program Files\\Git\\bin\\bash.exe') - await hydrateShellPath({ spawner }) - - expect(spawner).toHaveBeenCalledWith('C:\\Program Files\\Git\\bin\\bash.exe') - }) - - it('loads PowerShell profiles and parses their Windows PATH', async () => { - const proc = createMockShellProcess() - spawnMock.mockReturnValue(proc) - const resultPromise = hydrateShellPath({ force: true }) - await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledOnce()) - - proc.stdout.emit( - 'data', - Buffer.from( - 'profile banner\r\n__ORCA_SHELL_PATH__C:\\profile-node;C:\\Windows__ORCA_SHELL_PATH__' - ) - ) - proc.emit('close', 0, null) - - await expect(resultPromise).resolves.toEqual({ - segments: ['C:\\profile-node', 'C:\\Windows'], - ok: true, - failureReason: 'none' - }) - expect(spawnMock).toHaveBeenCalledWith( - 'powershell.exe', - ['-NoLogo', '-Command', expect.stringContaining('$env:Path')], - expect.objectContaining({ windowsHide: true }) - ) - expect(spawnMock.mock.calls[0]?.[1]).not.toContain('-NoProfile') - }) - - it('converts a Git Bash PATH to Windows segments before parsing it', async () => { - const proc = createMockShellProcess() - spawnMock.mockReturnValue(proc) - const resultPromise = hydrateShellPath({ - shellOverride: 'C:\\Program Files\\Git\\bin\\bash.exe', - force: true - }) - await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledOnce()) - - proc.stdout.emit( - 'data', - Buffer.from('__ORCA_SHELL_PATH__C:\\git-node;C:\\Windows__ORCA_SHELL_PATH__') - ) - proc.emit('close', 0, null) - - await expect(resultPromise).resolves.toEqual({ - segments: ['C:\\git-node', 'C:\\Windows'], - ok: true, - failureReason: 'none' - }) - expect(spawnMock).toHaveBeenCalledWith( - 'C:\\Program Files\\Git\\bin\\bash.exe', - ['-ilc', expect.stringContaining('cygpath -wp "$PATH"')], - expect.objectContaining({ windowsHide: true }) - ) - }) - - it.each(['cmd.exe', 'wsl.exe', 'git-bash', 'C:\\Tools\\zsh.exe'])( - 'does not merge %s guest or profile-less paths', - async (shell) => { - const spawner = vi.fn() - - configureWindowsShellPathHydration(shell) - - await expect(hydrateShellPath({ spawner })).resolves.toEqual({ - segments: [], - ok: false, - failureReason: 'no_shell' - }) - expect(spawner).not.toHaveBeenCalled() - } - ) - it('serializes shell changes, discards stale results, and caches the newest request', async () => { const powerShellResult = deferred() const gitBashResult = deferred() @@ -297,20 +121,6 @@ describe('Windows shell PATH hydration', () => { expect(spawner).toHaveBeenCalledOnce() }) - it('deduplicates PATH entries case-insensitively', () => { - process.env.PATH = 'C:\\Tools;C:\\Windows' - - expect(mergePathSegments(['c:\\tools', 'C:\\profile-node'])).toEqual(['C:\\profile-node']) - expect(process.env.PATH).toBe('c:\\tools;C:\\profile-node;C:\\Windows') - }) - - it('deduplicates PATH entries with trailing slashes', () => { - process.env.PATH = 'C:\\Windows\\;C:\\Tools' - - expect(mergePathSegments(['C:\\Windows', 'C:\\profile-node\\'])).toEqual(['C:\\profile-node\\']) - expect(process.env.PATH).toBe('C:\\Windows;C:\\profile-node\\;C:\\Tools') - }) - it('removes profile entries when switching to a shell without a profile', () => { process.env.PATH = 'C:\\Inherited;C:\\Windows' mergePathSegments(['C:\\PowerShell-profile', 'C:\\Inherited']) diff --git a/src/main/text-generation/commit-message-agent-environment.test.ts b/src/main/text-generation/commit-message-agent-environment.test.ts index cf5f5b2b0d8..a3aba7e4e0d 100644 --- a/src/main/text-generation/commit-message-agent-environment.test.ts +++ b/src/main/text-generation/commit-message-agent-environment.test.ts @@ -1,7 +1,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' -import { afterEach, describe, expect, it, vi } from 'vitest' +import { afterEach, describe, expect, it } from 'vitest' import { prepareLocalCommitMessageAgentEnv } from './commit-message-agent-environment' import { ManagedCodexHomeTemporarilyUnavailableError } from '../codex-accounts/host-codex-managed-home-ownership' @@ -51,20 +51,6 @@ describe('prepareLocalCommitMessageAgentEnv', () => { }) }) - it('prefers the original OpenCode config root over inherited PTY overlays', async () => { - process.env.OPENCODE_CONFIG_DIR = '/tmp/orca-opencode-overlay' - process.env.ORCA_OPENCODE_SOURCE_CONFIG_DIR = '/Users/tester/company/opencode' - - const result = await prepareLocalCommitMessageAgentEnv('opencode', undefined) - - expect(result).toEqual({ - ok: true, - env: expect.objectContaining({ - OPENCODE_CONFIG_DIR: '/Users/tester/company/opencode' - }) - }) - }) - it('hydrates Pi agent dir from shell startup files for headless generation', async () => { const home = makeHome() delete process.env.PI_CODING_AGENT_DIR @@ -80,51 +66,6 @@ describe('prepareLocalCommitMessageAgentEnv', () => { }) }) - it('prefers the original Pi agent root over inherited PTY overlays', async () => { - process.env.PI_CODING_AGENT_DIR = '/tmp/orca-pi-overlay' - process.env.ORCA_PI_SOURCE_AGENT_DIR = '/Users/tester/.pi/agent' - - const result = await prepareLocalCommitMessageAgentEnv('pi', undefined) - - expect(result).toEqual({ - ok: true, - env: expect.objectContaining({ - PI_CODING_AGENT_DIR: '/Users/tester/.pi/agent' - }) - }) - }) - - it('does not synthesize env for agents without shell-scoped auth or config roots', async () => { - makeHome() - - await expect(prepareLocalCommitMessageAgentEnv('cursor', undefined)).resolves.toEqual({ - ok: true - }) - }) - - it('falls back to inherited env when managed account resolvers are unavailable', async () => { - await expect(prepareLocalCommitMessageAgentEnv('codex', undefined)).resolves.toEqual({ - ok: true - }) - await expect(prepareLocalCommitMessageAgentEnv('claude', undefined)).resolves.toEqual({ - ok: true - }) - }) - - it('sets CODEX_HOME for host managed Codex accounts', async () => { - const result = await prepareLocalCommitMessageAgentEnv('codex', { - prepareForCodexLaunch: () => - 'C:\\Users\\tester\\AppData\\Roaming\\Orca\\codex-accounts\\a\\home' - }) - - expect(result).toEqual({ - ok: true, - env: expect.objectContaining({ - CODEX_HOME: 'C:\\Users\\tester\\AppData\\Roaming\\Orca\\codex-accounts\\a\\home' - }) - }) - }) - // STA-4422: failed managed-home preparation must not fall through to the user's real account while UI shows a managed account. it('fails commit generation instead of building a system-account env when the managed home is unreadable', async () => { process.env.CODEX_HOME = '/home/me/.config/codex' @@ -157,180 +98,4 @@ describe('prepareLocalCommitMessageAgentEnv', () => { expect(env?.CODEX_HOME).toBeUndefined() expect(env?.ORCA_CODEX_HOME).toBeUndefined() }) - - it('preserves a user-owned CODEX_HOME when the launch resolves to the real home', async () => { - process.env.CODEX_HOME = '/home/me/.config/codex' - delete process.env.ORCA_CODEX_HOME - - const result = await prepareLocalCommitMessageAgentEnv('codex', { - prepareForCodexLaunch: () => null - }) - - expect(result.ok).toBe(true) - const env = (result as { ok: true; env?: NodeJS.ProcessEnv }).env - expect(env?.CODEX_HOME).toBe('/home/me/.config/codex') - }) - - it('does not pass WSL managed Codex homes to host-local commit generation', async () => { - process.env.CODEX_HOME = 'C:\\Users\\tester\\.codex' - - const result = await prepareLocalCommitMessageAgentEnv('codex', { - prepareForCodexLaunch: () => - '\\\\wsl.localhost\\Ubuntu\\home\\tester\\.local\\share\\orca\\codex-accounts\\a\\home' - }) - - expect(result).toEqual({ ok: true }) - }) - - it('passes WSL managed Codex homes as Linux paths for WSL-local commit generation', async () => { - const result = await prepareLocalCommitMessageAgentEnv( - 'codex', - { - prepareForCodexLaunch: (target) => { - expect(target).toEqual({ runtime: 'wsl', wslDistro: 'Ubuntu' }) - return '\\\\wsl.localhost\\Ubuntu\\home\\tester\\.codex' - } - }, - { runtime: 'wsl', wslDistro: 'Ubuntu' } - ) - - expect(result).toEqual({ - ok: true, - env: expect.objectContaining({ - CODEX_HOME: '/home/tester/.codex' - }) - }) - }) - - it('does not hydrate host shell config roots for WSL-local commit generation', async () => { - process.env.OPENCODE_CONFIG_DIR = 'C:\\Users\\tester\\opencode' - - const result = await prepareLocalCommitMessageAgentEnv('opencode', undefined, { - runtime: 'wsl', - wslDistro: 'Ubuntu' - }) - - expect(result).toEqual({ ok: true }) - }) - - describe('login-shell base environment', () => { - const envOf = ( - result: Awaited> - ): NodeJS.ProcessEnv | undefined => (result.ok ? result.env : undefined) - const shellBase = { - PATH: '/shell/bin', - ANTHROPIC_BASE_URL: 'https://proxy.example', - ANTHROPIC_AUTH_TOKEN: 'shell-token' - } - - it('gives Claude the shell-exported variables Orca was launched without', async () => { - delete process.env.ANTHROPIC_BASE_URL - delete process.env.ANTHROPIC_AUTH_TOKEN - - const result = await prepareLocalCommitMessageAgentEnv('claude', { - resolveBaseEnvironment: async () => shellBase, - prepareForClaudeLaunch: async () => ({ - configDir: '/home/me/.claude', - envPatch: {}, - provenance: 'system' - }) - }) - - expect(result).toEqual({ ok: true, env: shellBase }) - }) - - it('lets the selected Claude account set its folder and keeps the shell auth', async () => { - const result = await prepareLocalCommitMessageAgentEnv('claude', { - resolveBaseEnvironment: async () => shellBase, - prepareForClaudeLaunch: async () => ({ - configDir: '/managed/claude', - envPatch: { CLAUDE_CONFIG_DIR: '/managed/claude' }, - provenance: 'managed:account-1' - }) - }) - - const env = envOf(result) - expect(env?.CLAUDE_CONFIG_DIR).toBe('/managed/claude') - expect(env?.ANTHROPIC_AUTH_TOKEN).toBe('shell-token') - expect(env?.PATH).toBe('/shell/bin') - }) - - it('lets the managed Codex home override a shell CODEX_HOME', async () => { - const result = await prepareLocalCommitMessageAgentEnv('codex', { - resolveBaseEnvironment: async () => ({ ...shellBase, CODEX_HOME: '/shell/codex' }), - prepareForCodexLaunch: () => '/managed/codex-home' - }) - - expect(result).toEqual({ - ok: true, - env: { ...shellBase, CODEX_HOME: '/managed/codex-home' } - }) - }) - - it('gives agents without an account resolver the shell environment', async () => { - makeHome() - delete process.env.OPENCODE_CONFIG_DIR - - await expect( - prepareLocalCommitMessageAgentEnv('cursor', { - resolveBaseEnvironment: async () => shellBase - }) - ).resolves.toEqual({ ok: true, env: shellBase }) - await expect( - prepareLocalCommitMessageAgentEnv('opencode', { - resolveBaseEnvironment: async () => shellBase - }) - ).resolves.toEqual({ ok: true, env: shellBase }) - }) - - it("prefers the login shell's config dir over Orca's inherited one", async () => { - makeHome() - process.env.OPENCODE_CONFIG_DIR = '/old/opencode' - delete process.env.ORCA_OPENCODE_SOURCE_CONFIG_DIR - - const result = await prepareLocalCommitMessageAgentEnv('opencode', { - resolveBaseEnvironment: async () => ({ ...shellBase, OPENCODE_CONFIG_DIR: '/new/opencode' }) - }) - - expect(envOf(result)?.OPENCODE_CONFIG_DIR).toBe('/new/opencode') - }) - - it('keeps Orca env for WSL-local generation instead of the host shell', async () => { - delete process.env.ANTHROPIC_BASE_URL - const resolveBaseEnvironment = vi.fn(async () => shellBase) - - const codex = await prepareLocalCommitMessageAgentEnv( - 'codex', - { resolveBaseEnvironment, prepareForCodexLaunch: () => null }, - { runtime: 'wsl', wslDistro: 'Ubuntu' } - ) - const cursor = await prepareLocalCommitMessageAgentEnv( - 'cursor', - { resolveBaseEnvironment }, - { runtime: 'wsl', wslDistro: 'Ubuntu' } - ) - - expect(resolveBaseEnvironment).not.toHaveBeenCalled() - expect(envOf(codex)?.ANTHROPIC_BASE_URL).toBeUndefined() - expect(cursor).toEqual({ ok: true }) - }) - - it('falls back to Orca env when the shell environment cannot be read', async () => { - process.env.ORCA_COMMIT_ENV_MARKER = 'process' - - const result = await prepareLocalCommitMessageAgentEnv('codex', { - resolveBaseEnvironment: async () => { - throw new Error('settings unavailable') - }, - prepareForCodexLaunch: () => '/managed/codex-home' - }) - - expect(envOf(result)).toEqual( - expect.objectContaining({ - ORCA_COMMIT_ENV_MARKER: 'process', - CODEX_HOME: '/managed/codex-home' - }) - ) - }) - }) }) diff --git a/src/main/text-generation/jira-issue-summary-text-generation.test.ts b/src/main/text-generation/jira-issue-summary-text-generation.test.ts deleted file mode 100644 index 554fbe795e0..00000000000 --- a/src/main/text-generation/jira-issue-summary-text-generation.test.ts +++ /dev/null @@ -1,327 +0,0 @@ -import { sourceShapedKimiOutput } from '../../shared/__fixtures__/kimi-generation-source-shaped' -import { describe, expect, it } from 'vitest' -import { ChildProcess } from 'node:child_process' -import { PassThrough } from 'node:stream' -import { generateCommitMessage } from './source-control-text-generation-requests' -import type { - CommitMessageGenerationTarget, - SpawnSourceControlAgent -} from './source-control-text-generation-types' -import { getAgentModelProbeSpec } from '../../shared/agent-model-probe-spec' -import { planModelDiscovery } from './commit-message-model-discovery-policy' -import { planCommitMessageGeneration } from '../../shared/source-control/ai/generation/commit-message-plan' -import type { CommitMessagePlan } from '../../shared/source-control/ai/generation/commit-message-plan' -import { generateJiraIssueSummaryFromContext } from './jira-issue-summary-text-generation' - -function remoteTarget(execute: (plan: CommitMessagePlan) => Promise) { - return { - kind: 'remote' as const, - cwd: '/home/user', - missingBinaryLocation: 'remote PATH', - execute: async (plan: CommitMessagePlan) => ({ - stdout: await execute(plan), - stderr: '', - exitCode: 0, - timedOut: false - }) - } -} - -describe('generateJiraIssueSummaryFromContext', () => { - it.each(['custom', 'kimi'] as const)('%s Jira summary', async (agentId) => { - const result = await generateJiraIssueSummaryFromContext( - { description: 'Login crashes when retried offline.' }, - { agentId, model: agentId === 'kimi' ? 'default' : '', customAgentCommand: 'agent' }, - remoteTarget(async () => - agentId === 'kimi' - ? sourceShapedKimiOutput('"Fix offline login retry crash"\nextra commentary') - : '"Fix offline login retry crash"\nextra commentary' - ) - ) - - expect(result).toEqual({ - success: true, - summary: 'Fix offline login retry crash', - agentLabel: agentId === 'kimi' ? 'Kimi' : 'agent' - }) - }) - - it('sends its own Jira prompt and ignores source-control templates and instructions', async () => { - let prompt = '' - await generateJiraIssueSummaryFromContext( - { - description: 'Crash on save', - projectName: 'Mobile App', - issueTypeName: 'Bug' - }, - { - agentId: 'custom', - model: '', - customAgentCommand: 'agent', - customPrompt: 'Prefer kebab-case names.', - commandInputTemplate: 'Prefer kebab-case names.\n\n{basePrompt}' - }, - remoteTarget(async (plan) => { - prompt = plan.stdinPayload ?? '' - return 'Fix crash on save' - }) - ) - - expect(prompt).toContain('Generate a concise Jira issue summary') - expect(prompt).toContain('Project: Mobile App') - expect(prompt).toContain('Issue type: Bug') - expect(prompt).toContain('Crash on save') - expect(prompt).not.toContain('kebab-case') - }) - - it('fails when the output sanitizes to an empty summary', async () => { - const result = await generateJiraIssueSummaryFromContext( - { description: 'Crash on save' }, - { agentId: 'custom', model: '', customAgentCommand: 'agent' }, - remoteTarget(async () => '""\n') - ) - - expect(result).toMatchObject({ - success: false, - error: 'Generated summary was empty after sanitization.' - }) - }) - - it('propagates agent failures', async () => { - const result = await generateJiraIssueSummaryFromContext( - { description: 'Crash on save' }, - { agentId: 'custom', model: '', customAgentCommand: 'agent' }, - { - kind: 'remote', - cwd: '/home/user', - missingBinaryLocation: 'remote PATH', - execute: async () => ({ - stdout: '', - stderr: 'No API key found.', - exitCode: 1, - timedOut: false - }) - } - ) - - expect(result).toMatchObject({ - success: false, - error: 'agent CLI command failed with code 1: No API key found.' - }) - }) -}) - -// One owner must cover Jira and ordinary generation through both existing transports. -it.each(['local', 'remote'] as const)( - 'retries the same Claude invocation for Jira and commits on %s', - async (kind) => { - for (const operation of ['jira-issue-summary', 'commit-message'] as const) { - const calls: { args: string[]; other: unknown }[] = [] - const response = (args: string[]) => { - const refused = args.includes('--strict-mcp-config') - return { - stdout: refused ? '' : 'Fix crash', - stderr: refused - ? 'You cannot use --strict-mcp-config when an enterprise MCP config is present' - : '', - exitCode: refused ? 1 : 0, - timedOut: false - } - } - const spawnAgent: SpawnSourceControlAgent = ({ args, ...other }) => { - calls.push({ args, other }) - const child = new (class extends ChildProcess { - override stdin = new PassThrough() - override stdout = new PassThrough() - override stderr = new PassThrough() - })() - queueMicrotask(() => { - const output = response(args) - child.stdout.emit('data', Buffer.from(output.stdout)) - child.stderr.emit('data', Buffer.from(output.stderr)) - child.emit('close', output.exitCode) - }) - return child - } - const target: CommitMessageGenerationTarget = - kind === 'local' - ? { kind, cwd: '/repo' } - : { - kind, - cwd: '/repo', - missingBinaryLocation: 'remote PATH', - execute: async ({ args, ...other }, cwd, timeout, op) => { - expect(op).toBe(operation) - calls.push({ args, other: { ...other, cwd, timeout, op } }) - return response(args) - } - } - const params = { agentId: 'claude' as const, model: 'haiku' } - const result = - operation === 'jira-issue-summary' - ? await generateJiraIssueSummaryFromContext( - { description: 'Crash on save' }, - params, - target, - spawnAgent - ) - : await generateCommitMessage({ - context: { branch: 'main', stagedSummary: 'M file', stagedPatch: '+fix' }, - params, - target, - spawnAgent - }) - expect(result.success).toBe(true) - expect(calls).toHaveLength(2) - // The retry loads managed MCP servers, so it denies their tools; nothing else changes. - const retryArgs = calls[0].args.filter((arg) => arg !== '--strict-mcp-config') - retryArgs.splice(retryArgs.indexOf('--permission-mode'), 0, '--disallowedTools', 'mcp__*') - expect(calls[1]).toEqual({ ...calls[0], args: retryArgs }) - } - } -) - -it('keeps the picked model and a non-plan mode on an old CLI under enterprise MCP', async () => { - const calls: CommitMessagePlan[] = [] - const params = { agentId: 'claude' as const, model: 'haiku' } - const result = await generateCommitMessage({ - context: { branch: 'main', stagedSummary: 'M file', stagedPatch: '+fix' }, - params, - target: { - kind: 'remote', - cwd: '/repo', - missingBinaryLocation: 'remote PATH', - // Answers like CLI 2.0.30 with a managed MCP config. - execute: async (plan) => { - calls.push(plan) - const stderr = plan.args.includes('dontAsk') - ? "error: option '--permission-mode ' argument 'dontAsk' is invalid. Allowed choices are acceptEdits, bypassPermissions, default, plan.\n" - : plan.args.includes('--strict-mcp-config') - ? 'You cannot use --strict-mcp-config when an enterprise MCP config is present' - : '' - return { - stdout: stderr ? '' : 'Fix crash', - stderr, - exitCode: stderr ? 1 : 0, - timedOut: false - } - } - }, - spawnAgent: () => { - throw new Error('A remote target spawns nothing locally') - } - }) - expect(result).toMatchObject({ success: true, message: 'Fix crash' }) - const prompt = calls[0].stdinPayload ?? '' - const expected = [ - planCommitMessageGeneration(params, prompt), - planCommitMessageGeneration(params, prompt, { legacyToolPolicy: true }), - planCommitMessageGeneration(params, prompt, { legacyToolPolicy: true, strictMcp: false }) - ].map((planned) => (planned.ok ? planned.plan : null)) - expect(calls).toEqual(expected) - for (const plan of calls) { - expect(plan.args[plan.args.indexOf('--model') + 1]).toBe('haiku') - expect(plan.args).not.toContain('plan') - } - expect(calls[2].args[calls[2].args.indexOf('--permission-mode') + 1]).toBe('default') - // Every rebuilt attempt keeps its read grant. - expect(calls.map((plan) => plan.args[plan.args.indexOf('--allowedTools') + 1])).toEqual([ - 'Read,Grep,Glob', - 'Read(//**),Grep(//**),Glob(//**)', - 'Read(//**),Grep(//**),Glob(//**)' - ]) -}) - -it('preserves Jira custom output and OpenCode one-attempt behavior', async () => { - expect( - await generateJiraIssueSummaryFromContext( - { description: 'Crash' }, - { agentId: 'custom', model: '', customAgentCommand: 'agent' }, - remoteTarget(async () => 'Draft thought\nFix crash') - ) - ).toMatchObject({ summary: 'Draft thought' }) - let attempts = 0 - const result = await generateJiraIssueSummaryFromContext( - { description: 'Crash' }, - { agentId: 'opencode', model: 'provider/model', thinkingLevel: 'high' }, - { - kind: 'remote', - cwd: '/repo', - missingBinaryLocation: 'remote PATH', - execute: async () => { - attempts++ - return { stdout: '', stderr: 'Unknown argument: variant', exitCode: 1, timedOut: false } - } - } - ) - expect(result.success).toBe(false) - expect(attempts).toBe(1) -}) - -it.each(['\'{"model":"haiku"}\'', 'provider-settings.json'])( - 'uses existing settings override for generation and discovery: %s', - (settings) => { - const override = `claude --settings ${settings}` - const spec = getAgentModelProbeSpec('claude') - if (!spec) { - throw new Error('Missing Claude spec') - } - const requests = [ - planModelDiscovery(spec, override), - planCommitMessageGeneration( - { agentId: 'claude', model: 'haiku', agentCommandOverride: override }, - 'prompt' - ), - planCommitMessageGeneration( - { agentId: 'claude', model: 'haiku', agentArgs: `--settings ${settings}` }, - 'prompt' - ) - ] - for (const planned of requests) { - if (!planned.ok) { - throw new Error(planned.error) - } - expect(planned.plan.args.filter((arg) => arg === '--settings')).toHaveLength(1) - expect(planned.plan.args[planned.plan.args.indexOf('--settings') + 1]).toBe( - settings.replaceAll("'", '') - ) - expect(planned.plan.args).not.toContain('{"disableAllHooks":true}') - } - } -) - -it('rebuilds without inspecting prompt-like, optional or user strict tokens', async () => { - for (const agentArgs of [ - "--append-subagent-system-prompt '--strict-mcp-config'", - '--resume --strict-mcp-config saved-session', - '--mcp-config custom.json --strict-mcp-config' - ]) { - const calls: CommitMessagePlan[] = [] - const params = { agentId: 'claude' as const, model: 'haiku', agentArgs } - const result = await generateJiraIssueSummaryFromContext({ description: 'Crash' }, params, { - kind: 'remote', - cwd: '/repo', - missingBinaryLocation: 'remote PATH', - execute: async (plan) => { - calls.push(plan) - return { - stdout: '', - stderr: 'You cannot use --strict-mcp-config when an enterprise MCP config is present', - exitCode: 1, - timedOut: false - } - } - }) - expect(result.success).toBe(false) - expect(calls).toHaveLength(2) - const first = planCommitMessageGeneration(params, calls[0].stdinPayload ?? '') - const second = planCommitMessageGeneration(params, calls[0].stdinPayload ?? '', { - strictMcp: false - }) - if (!first.ok || !second.ok) { - throw new Error('Invalid fixture') - } - expect(calls).toEqual([first.plan, second.plan]) - expect(calls[1].args).toContain('--strict-mcp-config') - } -}) diff --git a/src/main/updater/updater.install-failure-cause.test.ts b/src/main/updater/updater.install-failure-cause.test.ts index b5194dd0fb5..724b10c5cf2 100644 --- a/src/main/updater/updater.install-failure-cause.test.ts +++ b/src/main/updater/updater.install-failure-cause.test.ts @@ -132,12 +132,6 @@ vi.mock('./linux-package/linux-update-package-type', () => ({ isExternallyManagedLinuxInstall: () => false })) -const DEB_ELEVATION_ERROR = - 'Error: Command failed: /usr/bin/pkexec --disable-internal-agent "/bin/bash" "-c" "dpkg -i \'/home/u/.cache/orca-updater/pending/orca-ide_1.4.163_amd64.deb\'"\npkexec must be setuid root' - -const WINDOWS_SIGNATURE_MISMATCH_ERROR = - 'New version 1.4.163 is not signed by the application owner: publisherNames: Orca, Inc.' - type CapturedSpan = { readonly name: string readonly exit: { readonly _tag: string; readonly cause?: string } @@ -162,10 +156,6 @@ function capturingSink(): TracerModule.TracerSink { } } -function installSpan(): CapturedSpan | undefined { - return spans.find((span) => span.name === 'updater.install') -} - async function reachDownloaded(): Promise { const mainWindow = updaterMainWindow(vi.fn()) autoUpdaterMock.checkForUpdates.mockResolvedValue(undefined) @@ -225,100 +215,6 @@ describe('quitAndInstall failure carries the updater cause', () => { tracer = null }) - it('reports the underlying elevation failure rather than a generic restart message', async () => { - const { quitAndInstall, getUpdateStatus } = await reachDownloaded() - - autoUpdaterMock.quitAndInstall.mockImplementation(() => { - autoUpdaterMock.emit('error', new Error(DEB_ELEVATION_ERROR)) - }) - - quitAndInstall() - await vi.advanceTimersByTimeAsync(100) - await vi.waitFor(() => { - expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) - }) - - const status = getUpdateStatus() - expect(status.state).toBe('error') - const message = status.state === 'error' ? status.message : '' - expect(message).toContain('pkexec') - expect(message).toContain('Could not start the update installer.') - }) - - it('keeps the durable breadcrumb to classification only', async () => { - const { quitAndInstall } = await reachDownloaded() - - autoUpdaterMock.quitAndInstall.mockImplementation(() => { - autoUpdaterMock.emit('error', new Error(DEB_ELEVATION_ERROR)) - }) - - quitAndInstall() - await vi.advanceTimersByTimeAsync(100) - await vi.waitFor(() => { - expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) - }) - - expect(recordUpdaterLifecycleMock).toHaveBeenCalledWith( - 'quit_and_install_failed_via_event', - { errorType: 'Error' }, - expect.anything() - ) - }) - - it('exits the install span Failure with the cause', async () => { - const { quitAndInstall } = await reachDownloaded() - - autoUpdaterMock.quitAndInstall.mockImplementation(() => { - autoUpdaterMock.emit('error', new Error(DEB_ELEVATION_ERROR)) - }) - - quitAndInstall() - await vi.advanceTimersByTimeAsync(100) - await vi.waitFor(() => { - expect(installSpan()).toBeDefined() - }) - - expect(installSpan()?.exit._tag).toBe('Failure') - expect(installSpan()?.exit.cause).toContain('pkexec') - }) - - it('exits the install span Success when the installer takes over', async () => { - const { quitAndInstall } = await reachDownloaded() - - autoUpdaterMock.quitAndInstall.mockImplementation(() => { - // The installer runs and the old process is left to exit; no 'error' comes back. - }) - - quitAndInstall() - await vi.advanceTimersByTimeAsync(100) - await vi.waitFor(() => { - expect(installSpan()).toBeDefined() - }) - - expect(installSpan()?.exit._tag).toBe('Success') - }) - - it('keeps a Windows signature verdict unprefixed so its own card still renders', async () => { - Object.defineProperty(process, 'platform', { - value: 'win32', - configurable: true - }) - const { quitAndInstall, getUpdateStatus } = await reachDownloaded() - - autoUpdaterMock.quitAndInstall.mockImplementation(() => { - autoUpdaterMock.emit('error', new Error(WINDOWS_SIGNATURE_MISMATCH_ERROR)) - }) - - quitAndInstall() - await vi.advanceTimersByTimeAsync(100) - await vi.waitFor(() => { - expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) - }) - - const status = getUpdateStatus() - expect(status.state === 'error' ? status.message : '').toBe(WINDOWS_SIGNATURE_MISMATCH_ERROR) - }) - it('redacts the cause the same way the retained-package card does', async () => { const { quitAndInstall, getUpdateStatus } = await reachDownloaded() const home = os.homedir() @@ -343,23 +239,4 @@ describe('quitAndInstall failure carries the updater cause', () => { expect(message).not.toContain(escape) expect(message).toContain("/.cache/orca-updater/pending/orca.deb'") }) - - it('carries the cause when quitAndInstall throws instead of dispatching an error event', async () => { - const { quitAndInstall, getUpdateStatus } = await reachDownloaded() - - autoUpdaterMock.quitAndInstall.mockImplementation(() => { - throw new Error('Squirrel.framework is missing from the app bundle') - }) - - quitAndInstall() - await vi.advanceTimersByTimeAsync(100) - await vi.waitFor(() => { - expect(getUpdateStatus().state).toBe('error') - }) - - const status = getUpdateStatus() - const message = status.state === 'error' ? status.message : '' - expect(message).toContain('Squirrel.framework is missing from the app bundle') - expect(message).toContain('Could not start the update installer.') - }) }) diff --git a/src/main/usage/agent-token-usage-reporter.test.ts b/src/main/usage/agent-token-usage-reporter.test.ts index 13c2d95cf55..02df9436965 100644 --- a/src/main/usage/agent-token-usage-reporter.test.ts +++ b/src/main/usage/agent-token-usage-reporter.test.ts @@ -3,7 +3,7 @@ import { tmpdir } from 'node:os' import { join } from 'node:path' import { PostHog } from 'posthog-node' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import { agentTokenUsageSchema } from '../../shared/telemetry-agent-token-usage-schema' +import '../../shared/telemetry-agent-token-usage-schema' import { _enableTransportForTests, _setPostHogClientForTests, @@ -112,31 +112,6 @@ describe('agent token usage', () => { expect(captures()).toEqual([]) }) - it('resolves every session identity in one batch', async () => { - const write = vi.spyOn(UsageCacheSnapshotWriter.prototype, 'write') - const second = '00000000-0000-4000-8000-000000000002' - identity.mockImplementation(async (ids) => - ids.map((id) => (id === 'second-session' ? second : ID)) - ) - const instance = reporter() - await instance.report([ - row, - { ...row, providerSessionId: 'invalid-session', input_tokens: -1 }, - { ...row, providerSessionId: 'second-session', input_tokens: 7 } - ]) - expect(identity).toHaveBeenCalledOnce() - expect(identity).toHaveBeenCalledWith([row.providerSessionId, 'second-session']) - expect(captures()).toEqual([ - expect.objectContaining({ analytics_session_id: ID, input_tokens: 100 }), - expect.objectContaining({ analytics_session_id: second, input_tokens: 7 }) - ]) - expect(write).toHaveBeenCalledTimes(1) - write.mockClear() - await instance.report([]) - expect(captures()).toHaveLength(2) - expect(write).not.toHaveBeenCalled() - }) - it('does not publish a revision whose write failed and retries it', async () => { const instance = reporter() const write = vi @@ -168,45 +143,6 @@ describe('agent token usage', () => { } ) - it('deduplicates acceptance in memory when only part of a batch is accepted', async () => { - vi.spyOn(Date, 'now').mockReturnValue(1_800_000_000_000) - identity.mockImplementation(async (ids) => - ids.map((_, index) => `00000000-0000-4000-8000-${String(index + 1).padStart(12, '0')}`) - ) - const rows = Array.from({ length: 31 }, (_, index) => ({ - ...row, - providerSessionId: `session-${index}` - })) - const instance = reporter() - const write = vi.spyOn(UsageCacheSnapshotWriter.prototype, 'write') - await instance.report(rows) - expect(captures()).toHaveLength(30) - expect(write).toHaveBeenCalledTimes(1) - const persisted = readFileSync(file, 'utf8') - resetBurstCapsForSession() - await instance.report([]) - expect(write).toHaveBeenCalledTimes(1) - expect(readFileSync(file, 'utf8')).toBe(persisted) - expect(captures()).toHaveLength(31) - expect(captures().at(-1)).toMatchObject({ - analytics_session_id: '00000000-0000-4000-8000-000000000031', - revision: 1 - }) - }) - - it('retries a throwing capture without inventing a new revision', async () => { - telemetry.mock.capture.mockImplementationOnce(() => { - throw new Error('enqueue failed') - }) - const instance = reporter() - await expect(instance.report([row])).rejects.toThrow('enqueue failed') - await instance.report([row]) - expect(captures()).toHaveLength(2) - expect(captures()[1]).toMatchObject({ revision: 1 }) - await instance.report([row]) - expect(captures()).toHaveLength(2) - }) - it.each(['offline send', 'exit before send'])( 'retries after %s with the installed SDK', async (failure) => { @@ -286,15 +222,4 @@ describe('agent token usage', () => { expect(readFileSync(file, 'utf8')).toBe('{broken') expect(captures()).toEqual([]) }) - - it('rejects invalid counts and unexpected content fields', async () => { - await reporter().report([{ ...row, input_tokens: -1 }]) - const payload = { ...row, analytics_session_id: ID, revision: 1, provider: 'claude' } - expect(agentTokenUsageSchema.safeParse(payload).success).toBe(false) - const { providerSessionId: _, ...valid } = payload - expect(agentTokenUsageSchema.safeParse(valid).success).toBe(true) - for (const field of ['prompt', 'path', 'model', 'activity_timestamp', 'estimated_cost']) { - expect(agentTokenUsageSchema.safeParse({ ...valid, [field]: 'private' }).success).toBe(false) - } - }) }) diff --git a/src/main/window/createMainWindow-tray-minimize-close.test.ts b/src/main/window/createMainWindow-tray-minimize-close.test.ts deleted file mode 100644 index 43a47b8db10..00000000000 --- a/src/main/window/createMainWindow-tray-minimize-close.test.ts +++ /dev/null @@ -1,328 +0,0 @@ -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' - -const { recordAgentSessionRuntimeEndMock } = vi.hoisted(() => ({ - recordAgentSessionRuntimeEndMock: vi.fn() -})) - -vi.mock('electron', async () => - (await import('./createMainWindow-test-harness')).electronModuleMock() -) -vi.mock('./macos-tahoe-release', async () => - (await import('./createMainWindow-test-harness')).macosTahoeReleaseMock() -) -vi.mock('./desktop-integration/app-icon', async () => - (await import('./createMainWindow-test-harness')).appIconMock() -) -vi.mock('../browser/browser-manager', async () => - (await import('./createMainWindow-test-harness')).browserManagerMock() -) -vi.mock('../runtime/agent-session/records/agent-session-runtime-end-record', () => ({ - recordAgentSessionRuntimeEnd: recordAgentSessionRuntimeEndMock -})) - -import { createMainWindow } from './createMainWindow' -import { ipcMain } from 'electron' -import { - resetExpectedTeardownStateForTest, - resolveExpectedTeardownScope, - WINDOWS_SESSION_END_CRASH_SUPPRESSION_WINDOW_MS -} from '../crash-reporting/expected-teardown-state' -import { - clearCrashBreadcrumbsForTest, - getCrashBreadcrumbSnapshot -} from '../crash-reporting/crash-breadcrumb-store' -import { - browserWindowMock, - notificationMock, - notificationShowMock, - resetMainWindowMocks -} from './createMainWindow-test-harness' - -describe('createMainWindow', () => { - beforeEach(() => { - resetMainWindowMocks() - resetExpectedTeardownStateForTest() - clearCrashBreadcrumbsForTest() - vi.useRealTimers() - }) - - describe('minimize to tray on close (win32)', () => { - const originalPlatform = process.platform - - function setPlatform(platform: NodeJS.Platform): void { - Object.defineProperty(process, 'platform', { value: platform, configurable: true }) - } - - type CloseFixture = { - windowHandlers: Record void> - webContents: { send: ReturnType } - instance: { hide: ReturnType; isMinimized: ReturnType } - } - - function setupCloseWindow(): CloseFixture { - const windowHandlers: Record void> = {} - const webContents = { - on: vi.fn((event, handler) => { - windowHandlers[event] = handler - }), - setZoomLevel: vi.fn(), - setBackgroundThrottling: vi.fn(), - setWebRTCIPHandlingPolicy: vi.fn(), - invalidate: vi.fn(), - setWindowOpenHandler: vi.fn(), - send: vi.fn(), - isCrashed: vi.fn(() => false), - id: 1 - } - const instance = { - webContents, - on: vi.fn((event, handler) => { - windowHandlers[event] = handler - }), - isDestroyed: vi.fn(() => false), - isMaximized: vi.fn(() => false), - isFullScreen: vi.fn(() => false), - isMinimized: vi.fn(() => false), - getSize: vi.fn(() => [1200, 800]), - setSize: vi.fn(), - maximize: vi.fn(), - show: vi.fn(), - hide: vi.fn(), - loadFile: vi.fn(() => Promise.resolve()), - loadURL: vi.fn(() => Promise.resolve()) - } - browserWindowMock.mockImplementation(function () { - return instance - }) - return { windowHandlers, webContents, instance } - } - - function makeStore(minimizeToTrayOnClose: boolean, trayMinimizeNoticeShown: boolean) { - return { - getUI: vi.fn(() => ({ trayMinimizeNoticeShown })), - getSettings: vi.fn(() => ({ windowBackgroundBlur: false, minimizeToTrayOnClose })), - updateUI: vi.fn() - } - } - - afterEach(() => { - setPlatform(originalPlatform) - clearCrashBreadcrumbsForTest() - }) - - it('marks production teardown state on irrevocable Windows session end', () => { - setPlatform('win32') - resetExpectedTeardownStateForTest(() => 1_000) - const { windowHandlers } = setupCloseWindow() - - createMainWindow(null) - windowHandlers['session-end']?.({} as never) - - expect( - resolveExpectedTeardownScope({ - isQuitting: false, - isQuittingForUpdate: false, - isExpectedRendererReload: false - }) - ).toBe('app-shutdown') - }) - - it('durably records the session-end reasons so bundles can identify OS shutdown', () => { - setPlatform('win32') - const { windowHandlers } = setupCloseWindow() - - createMainWindow(null) - windowHandlers['session-end']?.({ reasons: ['shutdown', 'critical'] } as never) - windowHandlers['session-end']?.({} as never) - - expect(getCrashBreadcrumbSnapshot()).toEqual([ - expect.objectContaining({ - name: 'system_session_end', - data: expect.objectContaining({ reasons: 'shutdown,critical' }) - }), - expect.objectContaining({ - name: 'system_session_end', - data: expect.objectContaining({ reasons: '' }) - }) - ]) - }) - - it("records the Orca runtime's end, since Windows emits no will-quit for it", () => { - setPlatform('win32') - recordAgentSessionRuntimeEndMock.mockClear() - const { windowHandlers } = setupCloseWindow() - - createMainWindow(null) - windowHandlers['session-end']?.({ reasons: ['logoff'] }) - - expect(recordAgentSessionRuntimeEndMock).toHaveBeenCalledExactlyOnceWith('quit') - }) - - it.each(['darwin', 'linux'] as const)( - 'does not mark session teardown state on %s', - (platform) => { - setPlatform(platform) - const { windowHandlers } = setupCloseWindow() - - createMainWindow(null) - - expect(windowHandlers['session-end']).toBeUndefined() - expect( - resolveExpectedTeardownScope({ - isQuitting: false, - isQuittingForUpdate: false, - isExpectedRendererReload: false - }) - ).toBe('none') - } - ) - - it('still minimizes to tray after the session-end reporting window expires', () => { - setPlatform('win32') - let now = 1_000 - resetExpectedTeardownStateForTest(() => now) - const { windowHandlers, webContents, instance } = setupCloseWindow() - const store = makeStore(true, true) - - createMainWindow(store as never) - windowHandlers['session-end']?.({} as never) - now += WINDOWS_SESSION_END_CRASH_SUPPRESSION_WINDOW_MS - const preventDefault = vi.fn() - windowHandlers.close({ preventDefault } as never) - - expect(preventDefault).toHaveBeenCalledOnce() - expect(instance.hide).toHaveBeenCalledOnce() - expect(webContents.send).not.toHaveBeenCalledWith('window:close-requested', expect.anything()) - }) - - it('hides to the tray instead of closing when the setting is on', () => { - setPlatform('win32') - const { windowHandlers, webContents, instance } = setupCloseWindow() - const store = makeStore(true, true) - - createMainWindow(store as never, { getIsQuitting: () => false }) - const preventDefault = vi.fn() - windowHandlers.close({ preventDefault } as never) - - expect(preventDefault).toHaveBeenCalled() - expect(instance.hide).toHaveBeenCalledTimes(1) - expect(webContents.send).not.toHaveBeenCalledWith('window:close-requested', expect.anything()) - expect(notificationMock).not.toHaveBeenCalled() - }) - - it('keeps the normal close flow when the setting is off', () => { - setPlatform('win32') - const { windowHandlers, webContents, instance } = setupCloseWindow() - const store = makeStore(false, true) - - createMainWindow(store as never, { getIsQuitting: () => false }) - windowHandlers.close({ preventDefault: vi.fn() } as never) - - expect(instance.hide).not.toHaveBeenCalled() - expect(webContents.send).toHaveBeenCalledWith('window:close-requested', { - isQuitting: false, - requestId: expect.any(Number) - }) - }) - - it('does not hide on a real quit even with the setting on', () => { - setPlatform('win32') - const { windowHandlers, webContents, instance } = setupCloseWindow() - const store = makeStore(true, true) - - createMainWindow(store as never, { getIsQuitting: () => true }) - windowHandlers.close({ preventDefault: vi.fn() } as never) - - expect(instance.hide).not.toHaveBeenCalled() - expect(webContents.send).toHaveBeenCalledWith('window:close-requested', { - isQuitting: true, - requestId: expect.any(Number) - }) - }) - - it('does not hide when the renderer process is gone', () => { - setPlatform('win32') - const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {}) - const { windowHandlers, instance } = setupCloseWindow() - const store = makeStore(true, true) - - createMainWindow(store as never, { getIsQuitting: () => false }) - windowHandlers['render-process-gone']?.( - {} as never, - { reason: 'crashed', exitCode: 5 } as never - ) - const preventDefault = vi.fn() - windowHandlers.close({ preventDefault } as never) - - expect(instance.hide).not.toHaveBeenCalled() - expect(preventDefault).not.toHaveBeenCalled() - consoleError.mockRestore() - }) - - it('shows the first-run notification once and persists the flag', () => { - setPlatform('win32') - const { windowHandlers } = setupCloseWindow() - const store = makeStore(true, false) - - createMainWindow(store as never, { getIsQuitting: () => false }) - windowHandlers.close({ preventDefault: vi.fn() } as never) - - expect(notificationMock).toHaveBeenCalledTimes(1) - expect(notificationShowMock).toHaveBeenCalledTimes(1) - expect(store.updateUI).toHaveBeenCalledWith({ trayMinimizeNoticeShown: true }) - }) - - it('leaves the close handler unchanged off win32', () => { - setPlatform('darwin') - const { windowHandlers, webContents, instance } = setupCloseWindow() - const store = makeStore(true, true) - - createMainWindow(store as never, { getIsQuitting: () => false }) - windowHandlers.close({ preventDefault: vi.fn() } as never) - - expect(instance.hide).not.toHaveBeenCalled() - expect(webContents.send).toHaveBeenCalledWith('window:close-requested', { - isQuitting: false, - requestId: expect.any(Number) - }) - }) - - // Windows custom X uses window:request-close; the native close guard alone would quit instead of hide. - function captureIpcHandlers(): Record void> { - const ipcHandlers: Record void> = {} - vi.mocked(ipcMain.on).mockImplementation((channel, handler) => { - ipcHandlers[channel] = handler as (...args: any[]) => void - return ipcMain - }) - return ipcHandlers - } - - it('hides to the tray when the renderer-drawn X requests close', () => { - setPlatform('win32') - const ipcHandlers = captureIpcHandlers() - const { webContents, instance } = setupCloseWindow() - const store = makeStore(true, true) - - createMainWindow(store as never, { getIsQuitting: () => false }) - ipcHandlers['window:request-close']?.() - - expect(instance.hide).toHaveBeenCalledTimes(1) - expect(webContents.send).not.toHaveBeenCalledWith('window:close-requested', expect.anything()) - }) - - it('forwards window:request-close to the renderer when the setting is off', () => { - setPlatform('win32') - const ipcHandlers = captureIpcHandlers() - const { webContents, instance } = setupCloseWindow() - const store = makeStore(false, true) - - createMainWindow(store as never, { getIsQuitting: () => false }) - ipcHandlers['window:request-close']?.() - - expect(instance.hide).not.toHaveBeenCalled() - expect(webContents.send).toHaveBeenCalledWith('window:close-requested', { - isQuitting: false - }) - }) - }) -}) diff --git a/src/main/worker-thread-child-process/worker-thread-child-process.test.ts b/src/main/worker-thread-child-process/worker-thread-child-process.test.ts index 9c79fbae9e6..cd0375b3a8c 100644 --- a/src/main/worker-thread-child-process/worker-thread-child-process.test.ts +++ b/src/main/worker-thread-child-process/worker-thread-child-process.test.ts @@ -4,9 +4,8 @@ import { existsSync } from 'node:fs' import { join } from 'node:path' import { MessageChannel, Worker, type MessagePort } from 'node:worker_threads' import { runProcess } from '@orca/process-host' -import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest' +import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest' import { - IDLE_TEARDOWN_MS, WorkerThreadChildProcessHost, type WorkerThreadChildProcess } from './worker-thread-child-process' @@ -15,7 +14,6 @@ import { createWorkerThreadChildProcessTestEntry } from './worker-thread-child-p // Use a real MessageChannel so protocol tests include structured-clone behavior. const openPorts: MessagePort[] = [] -const terminations: number[] = [] function makeConnectedHost(): WorkerThreadChildProcessHost { return new WorkerThreadChildProcessHost(() => { @@ -28,7 +26,6 @@ function makeConnectedHost(): WorkerThreadChildProcessHost { postMessage: (message: unknown) => port1.postMessage(message), unref: () => port1.unref(), terminate: async () => { - terminations.push(Date.now()) port1.close() return 0 } @@ -81,9 +78,6 @@ process.stdin.on('end', () => { process.stderr.write('bye'); process.exit(7) }) const IDLE_SCRIPT = 'setInterval(() => {}, 1000)' afterEach(() => { - vi.useRealTimers() - vi.restoreAllMocks() - terminations.length = 0 for (const port of openPorts.splice(0)) { port.close() } @@ -184,16 +178,6 @@ describe('WorkerThreadChildProcessHost over a message channel', () => { await expect(waitForClose(child)).resolves.toEqual([expect.any(Number), null]) }, 20_000) - it('closes a child whose creation threw on the worker', async () => { - const child = makeConnectedHost().spawn({ program: '', args: [] }) - const errors: NodeJS.ErrnoException[] = [] - child.on('error', (error) => errors.push(error)) - - await expect(waitForClose(child)).resolves.toEqual([-1, null]) - expect(errors).toMatchObject([{ code: 'ERR_INVALID_ARG_VALUE' }]) - expect(child.exitCode).toBe(-1) - }, 20_000) - it('kills a running child on request', async () => { const child = makeConnectedHost().spawn({ program: process.execPath, @@ -207,62 +191,6 @@ describe('WorkerThreadChildProcessHost over a message channel', () => { const [code, signal] = await closed expect(code !== 0 || signal !== null).toBe(true) }, 20_000) - - it('fails closed, after listeners can attach, when no worker can be started', async () => { - vi.spyOn(console, 'warn').mockImplementation(() => {}) - const host = new WorkerThreadChildProcessHost(() => { - throw new Error('entry missing') - }) - - const child = host.spawn({ program: process.execPath, args: [] }) - const events: unknown[][] = [] - child.on('error', (error: Error) => events.push(['error', error.message])) - child.on('exit', (code) => events.push(['exit', code])) - child.on('close', (code) => events.push(['close', code])) - expect(events).toEqual([]) - await new Promise((resolve) => process.nextTick(resolve)) - - expect(events).toEqual([ - ['error', 'Child process worker is unavailable'], - ['exit', -1], - ['close', -1] - ]) - expect(child.kill()).toBe(false) - }) - - it('tears the idle worker down only after the last child closes', async () => { - vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] }) - const host = makeConnectedHost() - const first = host.spawn({ program: process.execPath, args: ['-e', ''] }) - const second = host.spawn({ program: process.execPath, args: ['-e', IDLE_SCRIPT] }) - await waitForSpawn(second) - await waitForClose(first) - await vi.advanceTimersByTimeAsync(IDLE_TEARDOWN_MS) - expect(terminations).toHaveLength(0) - - const secondClosed = waitForClose(second) - second.kill() - await secondClosed - await vi.advanceTimersByTimeAsync(IDLE_TEARDOWN_MS - 1) - expect(terminations).toHaveLength(0) - await vi.advanceTimersByTimeAsync(1) - expect(terminations).toHaveLength(1) - }, 20_000) - - it('cancels a pending idle teardown when a new child spawns', async () => { - vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] }) - const host = makeConnectedHost() - await waitForClose(host.spawn({ program: process.execPath, args: ['-e', ''] })) - - await vi.advanceTimersByTimeAsync(IDLE_TEARDOWN_MS - 1) - const next = host.spawn({ program: process.execPath, args: ['-e', IDLE_SCRIPT] }) - await vi.advanceTimersByTimeAsync(IDLE_TEARDOWN_MS) - expect(terminations).toHaveLength(0) - - const closed = waitForClose(next) - next.kill() - await closed - }, 20_000) }) // Real thread death closes child pipes; abandoned probes depend on that graceful stop instead of PID-addressed killing. diff --git a/src/main/workspaces/creation/preparation/worktree-create-preparation-timing.test.ts b/src/main/workspaces/creation/preparation/worktree-create-preparation-timing.test.ts deleted file mode 100644 index d5a819cc4c3..00000000000 --- a/src/main/workspaces/creation/preparation/worktree-create-preparation-timing.test.ts +++ /dev/null @@ -1,334 +0,0 @@ -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import type { AddWorktreeResult } from '../../../git/worktrees/worktree-operation-options' - -const mocks = vi.hoisted(() => ({ - mkdir: vi.fn(), - prepare: vi.fn(), - finalize: vi.fn(), - discard: vi.fn(), - listWorktreeGraph: vi.fn(), - resolveBaseRef: vi.fn() -})) - -vi.mock('node:fs/promises', () => ({ mkdir: mocks.mkdir })) - -vi.mock('../../../git/worktrees/catalog/worktree-scan-cache', async (importOriginal) => ({ - ...(await importOriginal>()), - listWorktreeGraph: mocks.listWorktreeGraph -})) -vi.mock('../../../git/worktrees/creation/worktree-create-preparation', () => ({ - prepareWorktreeCreateCheckout: mocks.prepare, - finalizePreparedWorktree: mocks.finalize, - discardPreparedWorktree: mocks.discard, - unlockPreparedWorktree: vi.fn() -})) -vi.mock('../../../git/worktrees/creation/worktree-base-ref-probe', () => ({ - resolveLocalWorktreeBaseRef: mocks.resolveBaseRef -})) -vi.mock('../../../git/worktrees/creation/worktree-base-divergence', () => ({ - measureRetargetDivergence: vi.fn() -})) -vi.mock('../../execution-host/project-runtime-git-options', () => ({ - getLocalProjectWorktreeGitOptions: vi.fn(), - getWorktreeMirrorDistro: vi.fn() -})) -vi.mock('../../../ipc/worktree-logic', () => ({ - computeWorkspaceRootAsync: vi.fn(), - getWorktreePathSettings: vi.fn() -})) - -import { - _resetWorktreeCreatePreparationsForTests, - consumePreparedWorktreeCreate -} from './worktree-create-preparation' -import { startPreparation } from './worktree-create-preparation-pool' -import { createWorktreeCreateTimingRecorder } from '../worktree-create-timing' -import { - _resetWorktreeCreateConcurrencyForTests, - beginWorktreeCreate -} from '../worktree-create-concurrency' - -const request = { - repoPath: '/repo', - workspaceRoot: '/workspace', - worktreePath: '/workspace/feature', - branch: 'feature', - baseBranch: 'origin/main' -} - -function prepare() { - return startPreparation({ - repoPath: request.repoPath, - workspaceRoot: request.workspaceRoot, - baseBranch: request.baseBranch, - canonicalBase: 'refs/remotes/origin/main', - options: {} - }) -} - -/** Lets the claim's own phase settle before the test clock moves on to the wait. */ -function settleClaim(): Promise { - return new Promise((resolve) => setImmediate(resolve)) -} - -beforeEach(() => { - mocks.mkdir.mockReset().mockResolvedValue(undefined) - mocks.prepare.mockReset().mockResolvedValue(undefined) - mocks.finalize.mockReset().mockResolvedValue({}) - mocks.discard.mockReset().mockResolvedValue(undefined) - mocks.listWorktreeGraph.mockReset().mockResolvedValue([]) - mocks.resolveBaseRef.mockReset() -}) - -afterEach(async () => { - await _resetWorktreeCreatePreparationsForTests() - _resetWorktreeCreateConcurrencyForTests() - vi.restoreAllMocks() -}) - -describe('prepared checkout create timing', () => { - it('separates the remaining preparation wait from finalization', async () => { - const checkoutStarted = Promise.withResolvers() - const checkout = Promise.withResolvers() - const finalizeStarted = Promise.withResolvers() - const finalize = Promise.withResolvers() - mocks.prepare.mockImplementation(() => { - checkoutStarted.resolve() - return checkout.promise - }) - mocks.finalize.mockImplementation(() => { - finalizeStarted.resolve() - return finalize.promise - }) - const preparation = prepare() - await checkoutStarted.promise - - let now = 40 - const timing = createWorktreeCreateTimingRecorder(() => now) - const create = timing.time('git_worktree_add', () => - consumePreparedWorktreeCreate({ ...request, timing }) - ) - await settleClaim() - now = 150 - checkout.resolve() - await finalizeStarted.promise - now = 180 - finalize.resolve({}) - - expect(await create).toMatchObject({ status: 'hit', retargeted: false, reset: 'none' }) - await preparation - expect(timing.finish()).toEqual({ - totalDurationMs: 140, - preparedCheckout: { - status: 'hit', - reset: 'none', - origin: 'prefetch', - buildMs: expect.any(Number), - idleMs: 0 - }, - phases: [ - { phase: 'prepared_checkout_claim', startedAtMs: 0, durationMs: 0 }, - { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 110 }, - { phase: 'prepared_checkout_finalize', startedAtMs: 110, durationMs: 30 }, - { phase: 'git_worktree_add', startedAtMs: 0, durationMs: 140 } - ] - }) - }) - - it('records the wait when preparation fails and the create must fall back', async () => { - const checkoutStarted = Promise.withResolvers() - const checkout = Promise.withResolvers() - mocks.prepare.mockImplementation(() => { - checkoutStarted.resolve() - return checkout.promise - }) - const preparation = Promise.allSettled([prepare()]) - await checkoutStarted.promise - let now = 0 - const timing = createWorktreeCreateTimingRecorder(() => now) - const create = consumePreparedWorktreeCreate({ ...request, timing }) - await settleClaim() - now = 250 - checkout.reject(new Error('checkout failed')) - - expect(await create).toEqual({ - status: 'miss', - reason: 'prepare_failed', - rearm: expect.any(Function) - }) - await preparation - expect(timing.finish().phases).toEqual([ - { phase: 'prepared_checkout_claim', startedAtMs: 0, durationMs: 0 }, - { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 250 } - ]) - expect(mocks.finalize).not.toHaveBeenCalled() - }) - - it('times the cleanup of a failed finalization apart from the finalization', async () => { - vi.spyOn(console, 'warn').mockImplementation(() => {}) - await prepare() - let now = 0 - const timing = createWorktreeCreateTimingRecorder(() => now) - mocks.finalize.mockImplementation(async () => { - now = 80 - throw new Error('move failed') - }) - mocks.discard.mockImplementation(async () => { - now = 100 - }) - - expect(await consumePreparedWorktreeCreate({ ...request, timing })).toEqual({ - status: 'miss', - reason: 'finalize_failed', - rearm: expect.any(Function) - }) - expect(timing.finish().phases).toEqual([ - { phase: 'prepared_checkout_claim', startedAtMs: 0, durationMs: 0 }, - { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 0 }, - { phase: 'prepared_checkout_finalize', startedAtMs: 0, durationMs: 80 }, - { phase: 'prepared_checkout_discard', startedAtMs: 80, durationMs: 20 } - ]) - }) - - it('reports only the claim, and the miss, when no checkout was armed', async () => { - const timing = createWorktreeCreateTimingRecorder(() => 0) - expect(await consumePreparedWorktreeCreate({ ...request, timing })).toEqual({ - status: 'miss', - reason: 'none_armed' - }) - expect(timing.finish()).toMatchObject({ - phases: [{ phase: 'prepared_checkout_claim', startedAtMs: 0, durationMs: 0 }], - preparedCheckout: { status: 'miss', reason: 'none_armed' } - }) - }) - - it('times a miss probe as the claim, not as the plain add after it', async () => { - await startPreparation({ - repoPath: request.repoPath, - workspaceRoot: request.workspaceRoot, - baseBranch: 'origin/release', - canonicalBase: 'refs/remotes/origin/release', - options: {} - }) - let now = 0 - const timing = createWorktreeCreateTimingRecorder(() => now) - mocks.resolveBaseRef.mockImplementation(async () => { - now = 400 - return 'refs/remotes/origin/main' - }) - - const attempt = await timing.time('git_worktree_add', async () => { - const result = await consumePreparedWorktreeCreate({ ...request, timing }) - now = 500 - return result - }) - - expect(attempt).toMatchObject({ status: 'miss', reason: 'base_mismatch' }) - expect(timing.finish().phases).toEqual([ - { phase: 'prepared_checkout_claim', startedAtMs: 0, durationMs: 400 }, - { phase: 'git_worktree_add', startedAtMs: 0, durationMs: 500 } - ]) - }) - - it('reports the reset a hit needed and who armed it', async () => { - await startPreparation( - { - repoPath: request.repoPath, - workspaceRoot: request.workspaceRoot, - baseBranch: request.baseBranch, - canonicalBase: 'refs/remotes/origin/main', - options: {} - }, - 'automatic' - ) - mocks.finalize.mockResolvedValue({ preparedHeadReset: true }) - const timing = createWorktreeCreateTimingRecorder(() => 0) - - const attempt = await consumePreparedWorktreeCreate({ ...request, timing }) - - expect(attempt).toMatchObject({ status: 'hit', reset: 'base_moved', origin: 'rearm' }) - expect(attempt.status === 'hit' && attempt.result).toEqual({}) - expect(timing.finish().preparedCheckout).toMatchObject({ - status: 'hit', - reset: 'base_moved', - origin: 'rearm' - }) - }) - - it('reports a re-arm the new-worktree UI then asked for as well', async () => { - const args = { - repoPath: request.repoPath, - workspaceRoot: request.workspaceRoot, - baseBranch: request.baseBranch, - canonicalBase: 'refs/remotes/origin/main', - options: {} - } - await startPreparation(args, 'automatic') - await startPreparation(args, 'explicit') - expect(mocks.prepare).toHaveBeenCalledOnce() - - const attempt = await consumePreparedWorktreeCreate({ ...request }) - - expect(attempt).toMatchObject({ status: 'hit', origin: 'rearm_then_prefetch' }) - }) - - it('reports how long the build took and how long it sat ready before the claim', async () => { - let now = 1_000 - vi.spyOn(performance, 'now').mockImplementation(() => now) - const checkout = Promise.withResolvers() - mocks.prepare.mockReturnValue(checkout.promise) - const preparation = prepare() - now = 4_000 - checkout.resolve() - await preparation - now = 9_000 - - const attempt = await consumePreparedWorktreeCreate({ ...request }) - - expect(attempt).toMatchObject({ status: 'hit', buildMs: 3_000, idleMs: 5_000 }) - }) - - it('reports no idle time when the create waited for the build', async () => { - let now = 1_000 - vi.spyOn(performance, 'now').mockImplementation(() => now) - const checkoutStarted = Promise.withResolvers() - const checkout = Promise.withResolvers() - mocks.prepare.mockImplementation(() => { - checkoutStarted.resolve() - return checkout.promise - }) - const preparation = prepare() - await checkoutStarted.promise - now = 2_000 - const create = consumePreparedWorktreeCreate({ ...request }) - await settleClaim() - now = 6_000 - checkout.resolve() - await preparation - - expect(await create).toMatchObject({ status: 'hit', buildMs: 5_000, idleMs: 0 }) - }) - - it('counts a building prepared checkout against other creates but not the one that used it', async () => { - const checkoutStarted = Promise.withResolvers() - const checkout = Promise.withResolvers() - mocks.prepare.mockImplementation(() => { - checkoutStarted.resolve() - return checkout.promise - }) - const bystander = beginWorktreeCreate() - const preparation = prepare() - await checkoutStarted.promise - const inFlight = beginWorktreeCreate() - const timing = createWorktreeCreateTimingRecorder(undefined, inFlight) - - const create = consumePreparedWorktreeCreate({ ...request, timing }) - await settleClaim() - checkout.resolve() - await preparation - - expect(await create).toMatchObject({ status: 'hit', origin: 'prefetch' }) - expect(inFlight.end().preparations).toBe(0) - expect(bystander.end().preparations).toBe(1) - }) -}) diff --git a/src/main/workspaces/creation/worktree-create-base-prefetch.test.ts b/src/main/workspaces/creation/worktree-create-base-prefetch.test.ts index 0807bc35eb0..306d0304d3e 100644 --- a/src/main/workspaces/creation/worktree-create-base-prefetch.test.ts +++ b/src/main/workspaces/creation/worktree-create-base-prefetch.test.ts @@ -45,10 +45,6 @@ function resolveOnly(present: string[]): void { }) } -function revParse(ref: string): string[] { - return ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`] -} - beforeEach(() => { for (const mock of Object.values(mocks)) { mock.mockReset() @@ -61,117 +57,6 @@ beforeEach(() => { mocks.fetchRemoteWithCache.mockResolvedValue(undefined) }) -describe('prefetchWorktreeCreateBase local git routing', () => { - it('resolves the default base and its ref probes inside the selected WSL distro', async () => { - resolveOnly(['refs/remotes/origin/main']) - - await expect( - prefetchWorktreeCreateBase({ repo, runtime: runtime(), gitOptions: WSL }) - ).resolves.toBe('origin/main') - - expect(mocks.getBaseRefDefault).toHaveBeenCalledWith(repo.path, WSL) - expect(mocks.resolveRemoteTrackingBase).toHaveBeenCalledWith(repo.path, 'origin/main', WSL) - expect(mocks.gitExecFileAsync).toHaveBeenCalledWith(revParse('refs/remotes/origin/main'), { - cwd: repo.path, - ...WSL - }) - expect(mocks.fetchRemoteWithCache).not.toHaveBeenCalled() - }) - - it('probes a full commit object inside the selected WSL distro', async () => { - const sha = 'a'.repeat(40) - resolveOnly([sha]) - - await expect( - prefetchWorktreeCreateBase({ repo, baseBranch: sha, runtime: runtime(), gitOptions: WSL }) - ).resolves.toBe(sha) - - expect(mocks.gitExecFileAsync).toHaveBeenCalledWith(revParse(sha), { - cwd: repo.path, - ...WSL - }) - expect(mocks.fetchRemoteWithCache).not.toHaveBeenCalled() - }) - - it('routes the exact remote-base refresh through the selected WSL distro', async () => { - const remoteTrackingBase = { - remote: 'origin', - branch: 'main', - ref: 'refs/remotes/origin/main', - base: 'origin/main' - } - mocks.resolveRemoteTrackingBase.mockResolvedValue(remoteTrackingBase) - mocks.hasRemoteTrackingRef.mockResolvedValue(true) - - await expect( - prefetchWorktreeCreateBase({ - repo, - baseBranch: 'origin/main', - runtime: runtime(), - gitOptions: WSL - }) - ).resolves.toBe('origin/main') - - expect(mocks.hasRemoteTrackingRef).toHaveBeenCalledWith(repo.path, remoteTrackingBase, WSL) - expect(mocks.getOrStartRemoteTrackingBaseRefresh).toHaveBeenCalledWith( - repo.path, - remoteTrackingBase, - WSL - ) - }) - - it('routes the broad remote-fetch fallback through the selected WSL distro', async () => { - await expect( - prefetchWorktreeCreateBase({ - repo, - baseBranch: 'feature/topic', - runtime: runtime(), - gitOptions: WSL - }) - ).resolves.toBe('feature/topic') - - expect(mocks.fetchRemoteWithCache).toHaveBeenCalledWith(repo.path, 'origin', WSL) - }) - - it('leaves host-routed probes on the git host they used before routing existed', async () => { - await expect( - prefetchWorktreeCreateBase({ - repo, - baseBranch: 'feature/topic', - runtime: runtime(), - gitOptions: {} - }) - ).resolves.toBe('feature/topic') - - expect(mocks.gitExecFileAsync).toHaveBeenCalledWith(revParse('refs/remotes/feature/topic'), { - cwd: repo.path - }) - for (const call of mocks.gitExecFileAsync.mock.calls) { - expect(call[1]).toEqual({ cwd: repo.path }) - } - expect(mocks.resolveRemoteTrackingBase).toHaveBeenCalledWith(repo.path, 'feature/topic') - expect(mocks.fetchRemoteWithCache).toHaveBeenCalledWith(repo.path, 'origin') - }) - - it('does not resolve a local base for SSH repos', async () => { - const prepareCheckout = vi.fn() - - await expect( - prefetchWorktreeCreateBase({ - repo: { ...repo, connectionId: 'conn-1' }, - prepareCheckout, - baseBranch: 'origin/main', - runtime: runtime(), - gitOptions: WSL - }) - ).resolves.toBeUndefined() - - expect(mocks.gitExecFileAsync).not.toHaveBeenCalled() - expect(mocks.resolveRemoteTrackingBase).not.toHaveBeenCalled() - expect(prepareCheckout).not.toHaveBeenCalled() - }) -}) - describe('checkout and refresh overlap', () => { it.each([{}, WSL])( 'starts one checkout with a shared refresh barrier before fetch settles on %j', @@ -221,58 +106,6 @@ describe('checkout and refresh overlap', () => { } ) - it('waits for refresh when the selected base is not local', async () => { - mocks.resolveRemoteTrackingBase.mockResolvedValue({ - remote: 'origin', - branch: 'main', - ref: 'refs/remotes/origin/main', - base: 'origin/main' - }) - let release!: () => void - mocks.getOrStartRemoteTrackingBaseRefresh.mockImplementation( - () => - new Promise<{ ok: boolean }>((resolve) => { - release = () => resolve({ ok: true }) - }) - ) - const prepareCheckout = vi.fn().mockResolvedValue(undefined) - const result = prefetchWorktreeCreateBase({ - repo, - baseBranch: 'origin/main', - runtime: runtime(), - gitOptions: {}, - prepareCheckout - }) - await vi.waitFor(() => - expect(mocks.getOrStartRemoteTrackingBaseRefresh).toHaveBeenCalledTimes(1) - ) - expect(prepareCheckout).not.toHaveBeenCalled() - release() - await result - expect(prepareCheckout).toHaveBeenCalledTimes(1) - }) - - it('does not fail a successful refresh because preparation fails', async () => { - mocks.resolveRemoteTrackingBase.mockResolvedValue({ - remote: 'origin', - branch: 'main', - ref: 'refs/remotes/origin/main', - base: 'origin/main' - }) - mocks.hasRemoteTrackingRef.mockResolvedValue(true) - const prepareCheckout = vi.fn().mockRejectedValue(new Error('checkout failed')) - await expect( - prefetchWorktreeCreateBase({ - repo, - baseBranch: 'origin/main', - runtime: runtime(), - gitOptions: {}, - prepareCheckout - }) - ).resolves.toBe('origin/main') - expect(prepareCheckout).toHaveBeenCalledTimes(1) - }) - it('settles preparation before propagating refresh failure', async () => { mocks.resolveRemoteTrackingBase.mockResolvedValue({ remote: 'origin', @@ -336,17 +169,3 @@ describe('checkout and refresh overlap', () => { expect(mocks.getOrStartRemoteTrackingBaseRefresh).toHaveBeenCalledOnce() }) }) - -it('does not prepare folder repositories', async () => { - const prepareCheckout = vi.fn() - await expect( - prefetchWorktreeCreateBase({ - repo: { ...repo, kind: 'folder' }, - runtime: runtime(), - gitOptions: {}, - prepareCheckout - }) - ).resolves.toBeUndefined() - expect(prepareCheckout).not.toHaveBeenCalled() - expect(mocks.gitExecFileAsync).not.toHaveBeenCalled() -}) diff --git a/src/main/workspaces/removal/retirement/worktree-retirement-namespace.test.ts b/src/main/workspaces/removal/retirement/worktree-retirement-namespace.test.ts deleted file mode 100644 index c4d59619eb6..00000000000 --- a/src/main/workspaces/removal/retirement/worktree-retirement-namespace.test.ts +++ /dev/null @@ -1,305 +0,0 @@ -import { describe, expect, it } from 'vitest' -import type { RetiredNameRegistry } from '../../../../shared/worktree/retired-name-registry' -import { - MAX_RETIREMENT_NAMESPACES, - migrateRetirementNamespaceHostIdentity, - recordRetirementNamespaceRegistry, - retirementHostIdentity, - retirementNamespaceKey, - UNKNOWN_SSH_HOST_IDENTITY -} from './worktree-retirement-namespace' - -function registry(...names: string[]): RetiredNameRegistry { - return { exhaustedTiers: 0, names } -} - -const TARGET = { - configHost: 'builder', - host: 'builder.example.com', - port: 22, - username: 'dev' -} - -describe('recordRetirementNamespaceRegistry', () => { - it('evicts the least recently recorded namespace once the map is full', () => { - const namespaces: Record = {} - for (let index = 0; index < MAX_RETIREMENT_NAMESPACES; index += 1) { - recordRetirementNamespaceRegistry(namespaces, `local:posix:/w/${index}`, registry('nautilus')) - } - - recordRetirementNamespaceRegistry(namespaces, 'local:posix:/w/new', registry('seahorse')) - - expect(Object.keys(namespaces)).toHaveLength(MAX_RETIREMENT_NAMESPACES) - expect(namespaces['local:posix:/w/0']).toBeUndefined() - expect(namespaces['local:posix:/w/1']).toEqual(registry('nautilus')) - expect(namespaces['local:posix:/w/new']).toEqual(registry('seahorse')) - }) - - it('refreshes a namespace it rewrites so an actively used repo is never the eviction victim', () => { - const namespaces: Record = {} - for (let index = 0; index < MAX_RETIREMENT_NAMESPACES; index += 1) { - recordRetirementNamespaceRegistry(namespaces, `local:posix:/w/${index}`, registry('nautilus')) - } - - recordRetirementNamespaceRegistry(namespaces, 'local:posix:/w/0', registry('nautilus', 'orca')) - recordRetirementNamespaceRegistry(namespaces, 'local:posix:/w/new', registry('seahorse')) - - expect(namespaces['local:posix:/w/0']).toEqual(registry('nautilus', 'orca')) - expect(namespaces['local:posix:/w/1']).toBeUndefined() - }) - - it('stays at one entry per namespace no matter how often it is rewritten', () => { - const namespaces: Record = {} - for (let index = 0; index < MAX_RETIREMENT_NAMESPACES * 2; index += 1) { - recordRetirementNamespaceRegistry(namespaces, 'local:posix:/w/a', registry(`name-${index}`)) - } - - expect(Object.keys(namespaces)).toEqual(['local:posix:/w/a']) - }) -}) - -describe('migrateRetirementNamespaceHostIdentity', () => { - it('folds a migrated namespace into one the new identity already owns', () => { - const namespaces = { - 'ssh:old-id:posix:/srv/a': registry('nautilus'), - 'ssh:new|22|dev:posix:/srv/a': registry('seahorse') - } - - expect( - migrateRetirementNamespaceHostIdentity(namespaces, { - moveFrom: ['ssh:old-id'], - to: 'ssh:new|22|dev' - }) - ).toBe(true) - expect(Object.keys(namespaces)).toEqual(['ssh:new|22|dev:posix:/srv/a']) - expect(namespaces['ssh:new|22|dev:posix:/srv/a'].names.toSorted()).toEqual([ - 'nautilus', - 'seahorse' - ]) - }) - - it('keeps the source bucket when an endpoint identity moves, since a live target may share it', () => { - const namespaces = { - 'ssh:old|22|dev:posix:/srv/a': registry('nautilus') - } - - expect( - migrateRetirementNamespaceHostIdentity(namespaces, { - copyFrom: ['ssh:old|22|dev'], - to: 'ssh:new|22|dev' - }) - ).toBe(true) - expect(Object.keys(namespaces).toSorted()).toEqual([ - 'ssh:new|22|dev:posix:/srv/a', - 'ssh:old|22|dev:posix:/srv/a' - ]) - expect(namespaces['ssh:old|22|dev:posix:/srv/a'].names).toEqual(['nautilus']) - expect(namespaces['ssh:new|22|dev:posix:/srv/a'].names).toEqual(['nautilus']) - }) - - it('reports no change when a repeated copy adds nothing the destination lacks', () => { - const namespaces = { - 'ssh:old|22|dev:posix:/srv/a': registry('nautilus'), - 'ssh:new|22|dev:posix:/srv/a': registry('nautilus') - } - - expect( - migrateRetirementNamespaceHostIdentity(namespaces, { - copyFrom: ['ssh:old|22|dev'], - to: 'ssh:new|22|dev' - }) - ).toBe(false) - expect(Object.keys(namespaces).toSorted()).toEqual([ - 'ssh:new|22|dev:posix:/srv/a', - 'ssh:old|22|dev:posix:/srv/a' - ]) - expect(namespaces['ssh:old|22|dev:posix:/srv/a'].names).toEqual(['nautilus']) - expect(namespaces['ssh:new|22|dev:posix:/srv/a'].names).toEqual(['nautilus']) - }) - - it('still copies a name the destination folded into its watermark', () => { - // Equal sizes can hide a new name when an old one folds into the watermark. - const namespaces = { - 'ssh:old|22|dev:posix:/srv/a': registry('seahorse-2'), - 'ssh:new|22|dev:posix:/srv/a': { exhaustedTiers: 1, names: ['nautilus'] } - } - - expect( - migrateRetirementNamespaceHostIdentity(namespaces, { - copyFrom: ['ssh:old|22|dev'], - to: 'ssh:new|22|dev' - }) - ).toBe(true) - expect(namespaces['ssh:new|22|dev:posix:/srv/a'].names).toContain('seahorse-2') - }) - - it('keeps the namespace map within its cap by evicting bystanders, not the copy itself', () => { - // Old source buckets must survive trimming too, or copying would effectively move their tombstones. - const namespaces: Record = { - 'ssh:old|22|dev:posix:/srv/a': registry('nautilus'), - 'ssh:old|22|dev:posix:/srv/b': registry('manta') - } - for (let index = 0; index < MAX_RETIREMENT_NAMESPACES - 2; index += 1) { - namespaces[`local:posix:/w/${index}`] = registry('dolphin') - } - - expect( - migrateRetirementNamespaceHostIdentity(namespaces, { - copyFrom: ['ssh:old|22|dev'], - to: 'ssh:new|22|dev' - }) - ).toBe(true) - expect(Object.keys(namespaces).length).toBe(MAX_RETIREMENT_NAMESPACES) - expect(namespaces['ssh:old|22|dev:posix:/srv/a']).toBeDefined() - expect(namespaces['ssh:old|22|dev:posix:/srv/b']).toBeDefined() - expect(namespaces['ssh:new|22|dev:posix:/srv/a']).toBeDefined() - expect(namespaces['ssh:new|22|dev:posix:/srv/b']).toBeDefined() - expect(namespaces['local:posix:/w/0']).toBeUndefined() - expect(namespaces['local:posix:/w/1']).toBeUndefined() - expect(namespaces['local:posix:/w/2']).toBeDefined() - }) - - it('refreshes a retained source even when its own merge added nothing', () => { - // A no-op source remains live while another copied namespace grows the map. - const namespaces: Record = { - 'ssh:old|22|dev:posix:/srv/a': registry('seahorse'), - 'ssh:new|22|dev:posix:/srv/a': registry('seahorse'), - 'ssh:old|22|dev:posix:/srv/b': registry('nautilus') - } - for (let index = 0; index < MAX_RETIREMENT_NAMESPACES - 3; index += 1) { - namespaces[`local:posix:/w/${index}`] = registry('dolphin') - } - - migrateRetirementNamespaceHostIdentity(namespaces, { - copyFrom: ['ssh:old|22|dev'], - to: 'ssh:new|22|dev' - }) - expect(Object.keys(namespaces).length).toBe(MAX_RETIREMENT_NAMESPACES) - expect(namespaces['ssh:old|22|dev:posix:/srv/a']).toBeDefined() - expect(namespaces['local:posix:/w/0']).toBeUndefined() - }) - - it('refreshes a move destination that the move just made the only copy', () => { - const namespaces: Record = { - 'ssh:new|22|dev:posix:/srv/a': registry('seahorse'), - 'local:posix:/w/0': registry('dolphin'), - 'ssh:old-id:posix:/srv/a': registry('seahorse') - } - - migrateRetirementNamespaceHostIdentity(namespaces, { - moveFrom: ['ssh:old-id'], - to: 'ssh:new|22|dev' - }) - expect(Object.keys(namespaces).at(-1)).toBe('ssh:new|22|dev:posix:/srv/a') - }) - - it('leaves a merged destination newest, so the very next ordinary write cannot evict it', () => { - const namespaces: Record = { - 'ssh:new|22|dev:posix:/srv/a': registry('seahorse') - } - for (let index = 0; index < MAX_RETIREMENT_NAMESPACES - 2; index += 1) { - namespaces[`local:posix:/w/${index}`] = registry('dolphin') - } - namespaces['ssh:old|22|dev:posix:/srv/a'] = registry('nautilus') - - migrateRetirementNamespaceHostIdentity(namespaces, { - copyFrom: ['ssh:old|22|dev'], - to: 'ssh:new|22|dev' - }) - recordRetirementNamespaceRegistry(namespaces, 'local:posix:/fresh', registry('manta')) - - const destination = namespaces['ssh:new|22|dev:posix:/srv/a'] - expect(destination).toBeDefined() - expect(destination.names.toSorted()).toEqual(['nautilus', 'seahorse']) - }) - - it('does not let the cap evict a destination it just merged into', () => { - const namespaces: Record = { - 'ssh:new|22|dev:posix:/srv/a': registry('seahorse') - } - for (let index = 0; index < MAX_RETIREMENT_NAMESPACES - 2; index += 1) { - namespaces[`local:posix:/w/${index}`] = registry('dolphin') - } - namespaces['ssh:old|22|dev:posix:/srv/a'] = registry('nautilus') - namespaces['ssh:old|22|dev:posix:/srv/b'] = registry('manta') - - expect( - migrateRetirementNamespaceHostIdentity(namespaces, { - copyFrom: ['ssh:old|22|dev'], - to: 'ssh:new|22|dev' - }) - ).toBe(true) - const destination = namespaces['ssh:new|22|dev:posix:/srv/a'] - expect(destination).toBeDefined() - expect(destination.names.toSorted()).toEqual(['nautilus', 'seahorse']) - }) - - it('leaves an identity that merely shares a prefix with the old one alone', () => { - const namespaces = { - 'ssh:h|22|dev2:posix:/srv/a': registry('nautilus') - } - - expect( - migrateRetirementNamespaceHostIdentity(namespaces, { - moveFrom: ['ssh:h|22|dev'], - to: 'ssh:h|22|other' - }) - ).toBe(false) - expect(Object.keys(namespaces)).toEqual(['ssh:h|22|dev2:posix:/srv/a']) - }) - - it('reports no change when there is nothing to move or the identity is unchanged', () => { - expect( - migrateRetirementNamespaceHostIdentity(undefined, { moveFrom: ['ssh:a'], to: 'ssh:b' }) - ).toBe(false) - expect( - migrateRetirementNamespaceHostIdentity( - { 'ssh:a:posix:/srv': registry('nautilus') }, - { to: 'ssh:a' } - ) - ).toBe(false) - expect( - migrateRetirementNamespaceHostIdentity( - { 'ssh:a:posix:/srv': registry('nautilus') }, - { moveFrom: ['ssh:a'], to: 'ssh:a' } - ) - ).toBe(false) - }) -}) - -describe('retirementHostIdentity', () => { - it('resolves an SSH repo to the endpoint its target reaches, not the target row id', () => { - const identity = retirementHostIdentity({ connectionId: 'ssh-1' }, () => TARGET) - - expect(identity).toBe('ssh:builder.example.com|22|dev') - expect(retirementHostIdentity({ connectionId: 'ssh-2' }, () => TARGET)).toBe(identity) - }) - - it('falls back to one shared bucket when the target row is gone', () => { - expect(retirementHostIdentity({ connectionId: 'ssh-1' }, () => undefined)).toBe( - UNKNOWN_SSH_HOST_IDENTITY - ) - expect(retirementHostIdentity({ connectionId: 'ssh-1' })).toBe(UNKNOWN_SSH_HOST_IDENTITY) - }) - - it('leaves a non-SSH repo on its execution host id', () => { - expect(retirementHostIdentity({})).toBe('local') - }) -}) - -describe('retirementNamespaceKey', () => { - it('keeps Windows paths case- and separator-insensitive without colliding with a POSIX path', () => { - expect(retirementNamespaceKey('local', 'C:\\Workspaces\\Probe')).toBe( - retirementNamespaceKey('local', 'C:/workspaces/probe') - ) - expect(retirementNamespaceKey('local', 'C:\\workspaces\\probe')).not.toBe( - retirementNamespaceKey('local', '/workspaces/probe') - ) - }) - - it('keeps POSIX paths case-sensitive, matching the filesystems they name', () => { - expect(retirementNamespaceKey('local', '/srv/Probe')).not.toBe( - retirementNamespaceKey('local', '/srv/probe') - ) - }) -}) diff --git a/src/main/wsl/discovery/wsl-running-distros.test.ts b/src/main/wsl/discovery/wsl-running-distros.test.ts index 1dcd3333b07..86b34d66051 100644 --- a/src/main/wsl/discovery/wsl-running-distros.test.ts +++ b/src/main/wsl/discovery/wsl-running-distros.test.ts @@ -1,6 +1,6 @@ -import { mkdtempSync, rmSync } from 'node:fs' -import { tmpdir } from 'node:os' -import { join } from 'node:path' +import 'node:fs' +import 'node:os' +import 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import type { ProcessResult } from '@orca/process-host/process-spec' @@ -17,23 +17,11 @@ const FAILED = exited('', 1) import { _resetWslCachesForTests, _setWslCachesForTests, - listRunningWslDistrosAsync, - listRunningWslHomeDirsAsync + listRunningWslDistrosAsync } from './distro-catalog' import { filterPathsToRunningWslDistrosAsync } from '../filesystem/wsl-running-path-filter' -import { resetWslInteropSpawnDirectoryCache } from '../execution/wsl-interop-spawn-directory' -import { - observeWslTranscriptRunningState, - resetWslTranscriptRunningObserverForTests -} from '../../native-chat/wsl-transcript-running-observer' - -function restoreEnv(key: string, value: string | undefined): void { - if (value === undefined) { - delete process.env[key] - } else { - process.env[key] = value - } -} +import '../execution/wsl-interop-spawn-directory' +import { resetWslTranscriptRunningObserverForTests } from '../../native-chat/wsl-transcript-running-observer' async function withPlatform(value: NodeJS.Platform, fn: () => Promise): Promise { const original = process.platform @@ -56,62 +44,6 @@ describe('running WSL distro discovery', () => { vi.useRealTimers() }) - it('lists only running user distros without starting them', async () => { - runProcessMock.mockResolvedValue(exited('Ubuntu\u0000\nDocker-Desktop\u0000\n')) - - await withPlatform('win32', async () => { - await expect(listRunningWslDistrosAsync()).resolves.toEqual(['Ubuntu']) - expect(runProcessMock).toHaveBeenCalledWith( - expect.objectContaining({ - program: 'wsl.exe', - args: ['--list', '--running', '--quiet'], - env: expect.objectContaining({ WSL_UTF8: '1' }), - timeoutMs: 5000 - }) - ) - }) - }) - - it('runs the startup probe from the system root, never the profile (#29845)', async () => { - runProcessMock.mockResolvedValue(exited('Ubuntu\n')) - const saved = { SystemRoot: process.env.SystemRoot, profile: process.env.ORCA_USER_DATA_PATH } - const systemRoot = mkdtempSync(join(tmpdir(), 'orca-wsl-probe-system-root-')) - const profile = mkdtempSync(join(tmpdir(), 'orca-wsl-probe-profile-')) - process.env.SystemRoot = systemRoot - process.env.ORCA_USER_DATA_PATH = profile - resetWslInteropSpawnDirectoryCache() - try { - await withPlatform('win32', () => listRunningWslDistrosAsync({ requireConfirmed: true })) - expect(runProcessMock).toHaveBeenCalledWith( - expect.objectContaining({ args: ['--list', '--running', '--quiet'], cwd: systemRoot }) - ) - } finally { - restoreEnv('SystemRoot', saved.SystemRoot) - restoreEnv('ORCA_USER_DATA_PATH', saved.profile) - resetWslInteropSpawnDirectoryCache() - rmSync(systemRoot, { recursive: true, force: true }) - rmSync(profile, { recursive: true, force: true }) - } - }) - - it('confirms an empty list when no distro runs', async () => { - // WSL 2.7 --quiet returns empty stdout with exit 0; non-quiet output is localized and exits -1. - runProcessMock.mockResolvedValueOnce(exited('Ubuntu\r\n')).mockResolvedValueOnce(exited('')) - - await withPlatform('win32', async () => { - await expect(listRunningWslDistrosAsync()).resolves.toEqual(['Ubuntu']) - await expect(listRunningWslDistrosAsync({ requireConfirmed: true })).resolves.toEqual([]) - }) - }) - - it('fails closed when running-distro discovery fails', async () => { - runProcessMock.mockResolvedValue(FAILED) - - await withPlatform('win32', async () => { - await expect(listRunningWslDistrosAsync()).resolves.toEqual([]) - }) - }) - it('rejects stale running state for launch admission through failure and backoff', async () => { vi.useFakeTimers() runProcessMock.mockResolvedValueOnce(exited('Ubuntu\n')) @@ -165,161 +97,4 @@ describe('running WSL distro discovery', () => { }) } ) - - it('resolves homes only for the running distro set', async () => { - runProcessMock.mockImplementation( - ({ args }: { args: string[] }) => - new Promise((resolve) => { - resolve(exited(args.includes('--running') ? 'Ubuntu\n' : '/home/ada\n')) - }) - ) - - await withPlatform('win32', async () => { - await expect(listRunningWslHomeDirsAsync()).resolves.toEqual([ - '\\\\wsl.localhost\\Ubuntu\\home\\ada' - ]) - expect(runProcessMock.mock.calls.map(([spec]) => spec.args)).toEqual([ - ['--list', '--running', '--quiet'], - ['-d', 'Ubuntu', '--exec', 'bash', '-c', 'echo $HOME'] - ]) - }) - }) - - it('single-flights concurrent probes without caching the result', async () => { - let finishProbe: ((output: string) => void) | undefined - runProcessMock.mockImplementationOnce( - () => - new Promise((resolve) => { - finishProbe = (output) => resolve(exited(output)) - }) - ) - - await withPlatform('win32', async () => { - const concurrent = [ - listRunningWslDistrosAsync(), - listRunningWslDistrosAsync(), - listRunningWslDistrosAsync() - ] - expect(runProcessMock).toHaveBeenCalledTimes(1) - finishProbe?.('Ubuntu\n') - await expect(Promise.all(concurrent)).resolves.toEqual([['Ubuntu'], ['Ubuntu'], ['Ubuntu']]) - - runProcessMock.mockResolvedValueOnce(exited('')) - await expect(listRunningWslDistrosAsync()).resolves.toEqual([]) - expect(runProcessMock).toHaveBeenCalledTimes(2) - }) - }) - - it('single-flights cold HOME probes across concurrent callers', async () => { - let finishList: ((output: string) => void) | undefined - let finishHome: ((output: string) => void) | undefined - runProcessMock.mockImplementation( - ({ args }: { args: string[] }) => - new Promise((resolve) => { - if (args.includes('--running')) { - finishList = (output) => resolve(exited(output)) - } else { - finishHome = (output) => resolve(exited(output)) - } - }) - ) - - await withPlatform('win32', async () => { - const concurrent = [ - listRunningWslHomeDirsAsync(), - listRunningWslHomeDirsAsync(), - listRunningWslHomeDirsAsync() - ] - finishList?.('Ubuntu\n') - await vi.waitFor(() => expect(runProcessMock).toHaveBeenCalledTimes(2)) - finishHome?.('/home/ada\n') - - await expect(Promise.all(concurrent)).resolves.toEqual([ - ['\\\\wsl.localhost\\Ubuntu\\home\\ada'], - ['\\\\wsl.localhost\\Ubuntu\\home\\ada'], - ['\\\\wsl.localhost\\Ubuntu\\home\\ada'] - ]) - expect( - runProcessMock.mock.calls.filter(([spec]) => spec.args.includes('echo $HOME')) - ).toHaveLength(1) - }) - }) - - it('shares a confirmed fresh probe between discovery and launch admission', async () => { - runProcessMock.mockResolvedValueOnce(exited('Ubuntu\n')) - await withPlatform('win32', async () => { - expect( - await Promise.all([ - listRunningWslDistrosAsync(), - listRunningWslDistrosAsync({ requireConfirmed: true }) - ]) - ).toEqual([['Ubuntu'], ['Ubuntu']]) - expect(runProcessMock).toHaveBeenCalledOnce() - }) - }) - - it('filters stopped-distro UNC paths while preserving host paths', async () => { - runProcessMock.mockResolvedValue(exited('Ubuntu\n')) - - await withPlatform('win32', async () => { - await expect( - filterPathsToRunningWslDistrosAsync([ - 'C:\\Users\\ada\\codex-home', - '\\\\wsl.localhost\\Ubuntu\\home\\ada', - '\\\\wsl.localhost\\Debian\\home\\other' - ]) - ).resolves.toEqual(['C:\\Users\\ada\\codex-home', '\\\\wsl.localhost\\Ubuntu\\home\\ada']) - }) - }) - - it('does not probe WSL on non-Windows hosts', async () => { - await withPlatform('linux', async () => { - await expect(listRunningWslDistrosAsync()).resolves.toEqual([]) - expect(runProcessMock).not.toHaveBeenCalled() - }) - }) - - it('keeps reporting a session running through a sustained wsl.exe outage, without unbounded spawns', async () => { - let spawnCount = 0 - runProcessMock.mockImplementation( - () => - new Promise((resolve) => { - spawnCount += 1 - resolve(exited('Ubuntu\n')) - }) - ) - - await withPlatform('win32', async () => { - await expect(listRunningWslDistrosAsync()).resolves.toEqual(['Ubuntu']) - expect(spawnCount).toBe(1) - - runProcessMock.mockImplementation( - () => - new Promise((resolve) => { - spawnCount += 1 - resolve(FAILED) - }) - ) - - vi.useFakeTimers() - const observedStates: boolean[] = [] - const stop = observeWslTranscriptRunningState( - '\\\\wsl.localhost\\Ubuntu\\home\\ada\\a.jsonl', - () => { - observedStates.push(true) - }, - () => { - observedStates.push(false) - } - ) - - await vi.advanceTimersByTimeAsync(30 * 60_000) - stop() - - expect(observedStates.length).toBeGreaterThan(0) - expect(observedStates.every((state) => state === true)).toBe(true) - - expect(spawnCount).toBeLessThan(15) - }) - }) }) diff --git a/src/main/wsl/filesystem/wsl-drive-unc-state-rewrite.test.ts b/src/main/wsl/filesystem/wsl-drive-unc-state-rewrite.test.ts index c88baabf378..10dbd754cba 100644 --- a/src/main/wsl/filesystem/wsl-drive-unc-state-rewrite.test.ts +++ b/src/main/wsl/filesystem/wsl-drive-unc-state-rewrite.test.ts @@ -1,7 +1,7 @@ import { describe, expect, it } from 'vitest' import { getDefaultPersistedState } from '../../../shared/constants' import type { PersistedState } from '../../../shared/persisted-state-types' -import { foldersAndAutomationsWslMoverProfile } from '../../persistence/__fixtures__/wsl-mover/wsl-mover-folders-profile' +import '../../persistence/__fixtures__/wsl-mover/wsl-mover-folders-profile' import { heavyWslMoverProfile } from '../../persistence/__fixtures__/wsl-mover/wsl-mover-heavy-profile' import { repo, @@ -42,45 +42,7 @@ function convert(state: PersistedState, repoIds: string[], folderWorkspaceIds: s return rewriteWslDriveUncState(state, { distro: WSL_MOVER_DISTRO, repoIds, folderWorkspaceIds }) } -const WINDOWS_GIT = { kind: 'wsl', distro: WSL_MOVER_DISTRO, git: 'windows-host' } as const - describe('rewriteWslDriveUncState', () => { - it('re-keys every session, UI and catalog row of the converted projects', () => { - const before = persisted(heavyWslMoverProfile(unc)) - const { state, worktreeIds } = convert(before, ['repo-a', 'repo-b']) - const expected = persisted(heavyWslMoverProfile(drive)) - for (const [oldId, newId] of worktreeIds) { - expected.worktreeMeta[newId] = { - ...expected.worktreeMeta[newId], - priorWorktreeIds: [oldId] - } - } - expected.projects = expected.projects.map((project) => ({ - ...project, - localWindowsRuntimePreference: WINDOWS_GIT - })) - expect(state).toEqual(expected) - expect(Object.fromEntries(worktreeIds)).toEqual({ - [`repo-a::${unc.at('/home/dev/app')}`]: `repo-a::${drive.at('/home/dev/app')}`, - [`repo-a::${unc.at('/home/dev/app-feature')}`]: `repo-a::${drive.at('/home/dev/app-feature')}`, - [`repo-b::${unc.at('/home/dev/lib', 'wsl$')}`]: `repo-b::${drive.at('/home/dev/lib')}` - }) - }) - - it('converts folder workspaces and their group, and keeps automation history as it ran', () => { - const before = persisted(foldersAndAutomationsWslMoverProfile(unc)) - const { state } = convert(before, ['repo-auto'], ['folder-1']) - const expected = persisted(foldersAndAutomationsWslMoverProfile(drive)) - const wtAuto = `repo-auto::${drive.at('/srv/jobs')}` - expected.worktreeMeta[wtAuto] = { - ...expected.worktreeMeta[wtAuto], - priorWorktreeIds: [`repo-auto::${unc.at('/srv/jobs')}`] - } - expected.projects = [{ ...expected.projects[0], localWindowsRuntimePreference: WINDOWS_GIT }] - expected.automationRuns = before.automationRuns - expect(state).toEqual(expected) - }) - it('rewrites minted PTY session ids, keeping the incarnation suffix', () => { const before = persisted(heavyWslMoverProfile(unc)) const oldId = `repo-a::${unc.at('/home/dev/app')}` @@ -121,19 +83,6 @@ describe('rewriteWslDriveUncState', () => { ) }) - it("keeps a project's own runtime choice and only adds Windows Git to a WSL one", () => { - const before = persisted(heavyWslMoverProfile(unc)) - before.projects = [ - { ...before.projects[0], localWindowsRuntimePreference: { kind: 'windows-host' } }, - { ...before.projects[1], localWindowsRuntimePreference: { kind: 'wsl', distro: 'Other' } } - ] - const { state } = convert(before, ['repo-a', 'repo-b']) - expect(state.projects.map((row) => row.localWindowsRuntimePreference)).toEqual([ - { kind: 'windows-host' }, - { kind: 'wsl', distro: 'Other', git: 'windows-host' } - ]) - }) - it('is idempotent, so a resumed conversion changes nothing', () => { const once = convert(persisted(heavyWslMoverProfile(unc)), ['repo-a', 'repo-b']).state const twice = convert(once, ['repo-a', 'repo-b']) diff --git a/src/main/wsl/filesystem/wsl-unc-access-gate.test.ts b/src/main/wsl/filesystem/wsl-unc-access-gate.test.ts index 4f870773db7..c352d113b1c 100644 --- a/src/main/wsl/filesystem/wsl-unc-access-gate.test.ts +++ b/src/main/wsl/filesystem/wsl-unc-access-gate.test.ts @@ -11,21 +11,18 @@ import { assertWslUncPathRunning, guardWslUncPathAccess, runAsWslUserAct, - WSL_UNC_RUNNING_LEASE_MS, WslDistroStoppedError, WslDistroUnverifiableError } from './wsl-unc-access-gate' import { _resetWslBackgroundDistroGateForTests, deferUntilWslDistroRunning, - noteWslDistroLaunched, noteWslDistroMayHaveStopped, - noteWslDistrosRunning, - WSL_STOP_SETTLE_MS + noteWslDistrosRunning } from '../discovery/wsl-background-distro-gate' -import { EXIT_SETTLE_MS } from '../orcad/wsl-orcad-liveness-evidence' +import '../orcad/wsl-orcad-liveness-evidence' import { isWslUserActFor } from '../discovery/wsl-user-act-scope' -import { isWslDistroNotRunningRefusal } from '../../../shared/wsl-distro-not-running-refusal' +import '../../../shared/wsl-distro-not-running-refusal' import { _resetRunningWslDistroCacheForTests, resolveRunningWslDistros @@ -64,43 +61,6 @@ describe('guardWslUncPathAccess', () => { expect(access).not.toHaveBeenCalled() }) - it('lets a touch of a running distro through', async () => { - await expect(guardWslUncPathAccess(UNC, async () => 'read')).resolves.toBe('read') - }) - - it('never probes WSL for a non-UNC path or off Windows', async () => { - await expect(guardWslUncPathAccess('C:\\repo', async () => 'read')).resolves.toBe('read') - Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' }) - await expect(guardWslUncPathAccess(UNC, async () => 'read')).resolves.toBe('read') - expect(probe).not.toHaveBeenCalled() - }) - - it('shares one running read across a burst of touches within the lease', async () => { - await Promise.all([1, 2, 3].map(() => guardWslUncPathAccess(UNC, async () => 'read'))) - await guardWslUncPathAccess(UNC, async () => 'read') - expect(probe).toHaveBeenCalledTimes(1) - }) - - it('without a stop signal, trusts a running read for 15 s (at most four wsl.exe a minute)', async () => { - await guardWslUncPathAccess(UNC, async () => 'read') - const now = performance.now() - const clock = vi.spyOn(performance, 'now') - for (const later of [5_000, 10_000, WSL_UNC_RUNNING_LEASE_MS - 1_000]) { - clock.mockReturnValue(now + later) - await guardWslUncPathAccess(UNC, async () => 'read') - } - expect(WSL_UNC_RUNNING_LEASE_MS).toBe(15_000) - expect(probe).toHaveBeenCalledTimes(1) - }) - - it('re-reads once the lease expires', async () => { - await guardWslUncPathAccess(UNC, async () => 'read') - const now = performance.now() - vi.spyOn(performance, 'now').mockReturnValue(now + WSL_UNC_RUNNING_LEASE_MS + 1) - await guardWslUncPathAccess(UNC, async () => 'read') - expect(probe).toHaveBeenCalledTimes(2) - }) - it('does not trust a running read that started before the distro may have stopped', async () => { await guardWslUncPathAccess(UNC, async () => 'read') // The terminate: the read above still says running, but a link into the distro just died. @@ -112,13 +72,6 @@ describe('guardWslUncPathAccess', () => { expect(probe).toHaveBeenCalledTimes(2) }) - it('retries once past the failure backoff when WSL does not answer, and then reads', async () => { - vi.spyOn(console, 'warn').mockImplementation(() => undefined) - probe.mockRejectedValueOnce(new Error('wsl.exe timed out')) - await expect(guardWslUncPathAccess(UNC, async () => 'read')).resolves.toBe('read') - expect(probe).toHaveBeenCalledTimes(2) - }) - it("says WSL didn't answer, not that the distro stopped, and never touches the path", async () => { vi.spyOn(console, 'warn').mockImplementation(() => undefined) probe.mockRejectedValue(new Error('wsl.exe timed out')) @@ -134,29 +87,6 @@ describe('guardWslUncPathAccess', () => { expect(access).not.toHaveBeenCalled() }) - it('never trusts a read that started while a just-signalled stop was settling', async () => { - noteWslDistroMayHaveStopped('Ubuntu') - // Another caller's read lands inside the settle window, while WSL still lists the stopping distro. - await resolveRunningWslDistros(async () => ['Ubuntu']) - running = [] - const startedAt = performance.now() - await expect(guardWslUncPathAccess(UNC, async () => 'read')).rejects.toBeInstanceOf( - WslDistroStoppedError - ) - expect(probe).toHaveBeenCalledOnce() - expect(performance.now() - startedAt).toBeGreaterThanOrEqual(WSL_STOP_SETTLE_MS - 50) - }) - - it('treats a stop another read observed like a signalled one', async () => { - await guardWslUncPathAccess(UNC, async () => 'read') - running = [] - // Any confirmed read that no longer lists the distro resets the lease (wsl --shutdown, idle stop). - await resolveRunningWslDistros(probe) - running = ['Ubuntu'] - await guardWslUncPathAccess(UNC, async () => 'read') - expect(probe).toHaveBeenCalledTimes(3) - }) - it('a user act touches without asking and, on success, resumes work waiting for the distro', async () => { running = [] const resumed = vi.fn() @@ -184,17 +114,6 @@ describe('guardWslUncPathAccess', () => { }) }) -describe('assertWslUncPathRunning for Git', () => { - it('covers a host path whose Git runs through wsl.exe in a distro', async () => { - running = [] - await expect(assertWslUncPathRunning('C:\\repo', 'Ubuntu')).rejects.toBeInstanceOf( - WslDistroStoppedError - ) - await expect(assertWslUncPathRunning('C:\\repo')).resolves.toBeUndefined() - expect(probe).toHaveBeenCalledTimes(1) - }) -}) - describe('runAsWslUserAct', () => { it('lets gated work inside a user act start its own distro, and no other', async () => { running = [] @@ -220,31 +139,6 @@ describe('runAsWslUserAct', () => { }) }) -describe('explicit acts that start a distro', () => { - it('a wsl.exe launch for a distro last read as stopped makes background reads look again', async () => { - running = [] - await expect(guardWslUncPathAccess(UNC, async () => 'read')).rejects.toBeInstanceOf( - WslDistroStoppedError - ) - // A commit or a WSL terminal ran through wsl.exe and started it. - running = ['Ubuntu'] - noteWslDistroLaunched('Ubuntu') - await expect(guardWslUncPathAccess(UNC, async () => 'read')).resolves.toBe('read') - expect(probe).toHaveBeenCalledTimes(2) - }) - - it('a launch for a distro already read as running costs no extra read', async () => { - await guardWslUncPathAccess(UNC, async () => 'read') - noteWslDistroLaunched('Ubuntu') - await guardWslUncPathAccess(UNC, async () => 'read') - expect(probe).toHaveBeenCalledOnce() - }) - - it('settles for as long as the orcad liveness exit window', () => { - expect(WSL_STOP_SETTLE_MS).toBe(EXIT_SETTLE_MS) - }) -}) - describe('user-act scope does not leak', () => { it('deferred work drained inside a user act runs outside it', async () => { const inherited: boolean[] = [] @@ -265,22 +159,3 @@ describe('user-act scope does not leak', () => { expect(inherited).toEqual([false]) }) }) - -describe('a poller recognizes the refusal however it arrives', () => { - it.each([ - ['in process', (error: Error) => error], - ['over IPC', (error: Error) => new Error(`Error invoking remote method 'gh:issue': ${error}`)], - ['over RPC', (error: Error) => new Error(error.message)] - ])('%s', (_transport, deliver) => { - expect(isWslDistroNotRunningRefusal(deliver(new WslDistroStoppedError('Ubuntu')))).toBe(true) - expect( - isWslDistroNotRunningRefusal( - deliver(new WslDistroStoppedError('Ubuntu', { retryStartsIt: false })) - ) - ).toBe(true) - expect(isWslDistroNotRunningRefusal(deliver(new WslDistroUnverifiableError('Ubuntu')))).toBe( - true - ) - expect(isWslDistroNotRunningRefusal(deliver(new Error('gh: not logged in')))).toBe(false) - }) -}) diff --git a/src/main/wsl/host-lifecycle/wsl-host-gate.test.ts b/src/main/wsl/host-lifecycle/wsl-host-gate.test.ts deleted file mode 100644 index 9485677334d..00000000000 --- a/src/main/wsl/host-lifecycle/wsl-host-gate.test.ts +++ /dev/null @@ -1,331 +0,0 @@ -import { afterEach, describe, expect, it, vi } from 'vitest' -import { - assertWslHostReachable, - configureWslHostsGate, - isGatedOffWslHost, - noteWslHostsLivePolicyBlock, - onWslHostsNewWorkChanged, - resetWslHostsGateForTests, - wslHostsAcceptNewWork, - wslHostsOptedIn, - wslHostsGateOpen, - wslHostsAppliedMovedProjects, - wslHostsAppliedPolicyState, - wslHostsBringBackMovedProjects, - wslHostsGateState, - wslHostsPolicyBlocked, - wslHostsServing, - wslHostsWindowArguments, - WSL_HOSTS_GATED_OFF_MESSAGE -} from './wsl-host-gate' -import { - ignoreInheritedWslHostsGateState, - isWslHostsServing, - WSL_HOSTS_GATE_STATE_ENV -} from '../../../shared/wsl-host-internal-gate' - -const wslHost = { - orcadDeployment: { kind: 'wsl' as const, distro: 'Ubuntu', localPort: 41000, remotePort: 6768 } -} -const sshHost = { orcadDeployment: null } -const facts = (hasSavedWslHost: boolean, hasWslMoveCutover: boolean) => ({ - hasSavedWslHost: () => hasSavedWslHost, - hasWslMoveCutover: () => hasWslMoveCutover -}) - -afterEach(() => { - vi.unstubAllEnvs() - resetWslHostsGateForTests() -}) - -describe('WSL hosts gate', () => { - it('flag-off with nothing saved: closed, exactly as before', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', undefined) - configureWslHostsGate(facts(false, false)) - - expect(wslHostsGateState()).toBe('closed') - expect(wslHostsServing()).toBe(false) - expect(isGatedOffWslHost(wslHost)).toBe(true) - expect(() => assertWslHostReachable(wslHost)).toThrow(WSL_HOSTS_GATED_OFF_MESSAGE) - expect(isGatedOffWslHost(sshHost)).toBe(false) - }) - - it.each([ - ['a saved host', facts(true, false)], - ['a move journal entry', facts(false, true)] - ])('serves %s behind a closed gate without opening it', (_label, saved) => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', undefined) - configureWslHostsGate(saved) - - expect(wslHostsGateState()).toBe('serve-only') - expect(wslHostsServing()).toBe(true) - expect(wslHostsGateOpen()).toBe(false) - expect(isGatedOffWslHost(wslHost)).toBe(false) - expect(() => assertWslHostReachable(wslHost)).not.toThrow() - }) - - it('treats unreadable saved state as absent', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', undefined) - configureWslHostsGate({ - hasSavedWslHost: () => { - throw new Error('unreadable') - }, - hasWslMoveCutover: () => { - throw new Error('unreadable') - } - }) - - expect(wslHostsGateState()).toBe('closed') - }) - - it('stays open with the internal gate on, and reads nothing to decide', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - const hasSavedWslHost = vi.fn(() => false) - const hasWslMoveCutover = vi.fn(() => false) - configureWslHostsGate({ hasSavedWslHost, hasWslMoveCutover }) - - expect(wslHostsGateState()).toBe('open') - expect(hasSavedWslHost).not.toHaveBeenCalled() - expect(hasWslMoveCutover).not.toHaveBeenCalled() - }) - - it('is closed before startup configures it', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', undefined) - expect(wslHostsGateState()).toBe('closed') - }) - - it('stamps window argv only in serve-only', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', undefined) - configureWslHostsGate(facts(false, false)) - expect(wslHostsWindowArguments()).toEqual([]) - - configureWslHostsGate(facts(true, false)) - expect(wslHostsWindowArguments()).toEqual(['--orca-wsl-hosts-serve-only']) - - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - expect(wslHostsWindowArguments()).toEqual([]) - }) - - describe('remote policy block', () => { - const blocked = (hasSavedWslHost: boolean, hasWslMoveCutover: boolean) => ({ - ...facts(hasSavedWslHost, hasWslMoveCutover), - policy: () => 'block' as const - }) - - it('closes an open internal gate for the run, in main and in shared readers', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate(blocked(false, false)) - - expect(wslHostsGateOpen()).toBe(false) - expect(wslHostsGateState()).toBe('closed') - expect(wslHostsPolicyBlocked()).toBe(true) - expect(isGatedOffWslHost(wslHost)).toBe(true) - expect(isWslHostsServing(process.env)).toBe(false) - expect(wslHostsWindowArguments()).toEqual(['--orca-wsl-hosts-policy-blocked']) - }) - - it('keeps serving saved WSL work, exactly as a closed internal gate does', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate(blocked(true, false)) - - expect(wslHostsGateState()).toBe('serve-only') - expect(wslHostsGateOpen()).toBe(false) - expect(wslHostsServing()).toBe(true) - expect(isWslHostsServing(process.env)).toBe(true) - expect(wslHostsWindowArguments()).toEqual([ - '--orca-wsl-hosts-policy-blocked', - '--orca-wsl-hosts-serve-only' - ]) - }) - - it('is not read, and changes nothing, behind a closed internal gate', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', undefined) - const policy = vi.fn(() => 'block' as const) - configureWslHostsGate({ ...facts(true, false), policy }) - - expect(policy).not.toHaveBeenCalled() - expect(wslHostsPolicyBlocked()).toBe(false) - expect(wslHostsAppliedPolicyState()).toBeNull() - expect(wslHostsWindowArguments()).toEqual(['--orca-wsl-hosts-serve-only']) - }) - - it('fails open to the internal gate when the policy cannot be read', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate({ - ...facts(false, false), - policy: () => { - throw new Error('unreadable') - } - }) - - expect(wslHostsGateState()).toBe('open') - expect(wslHostsAppliedPolicyState()).toBe('missing') - expect(wslHostsWindowArguments()).toEqual([]) - }) - - it('leaves SSH hosts untouched', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate(blocked(false, false)) - - expect(isGatedOffWslHost(sshHost)).toBe(false) - expect(() => assertWslHostReachable(sshHost)).not.toThrow() - }) - }) - - describe('publishing the resolved state to child processes', () => { - it.each([ - ['open', '1', facts(false, false), undefined], - ['serve-only', undefined, facts(true, false), undefined], - ['closed', undefined, facts(false, false), undefined], - ['closed', '1', facts(false, false), 'block' as const], - ['serve-only', '1', facts(false, true), 'block' as const] - ])('publishes %s', (state, gateEnv, saved, policy) => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', gateEnv) - configureWslHostsGate({ ...saved, ...(policy ? { policy: () => policy } : {}) }) - - expect(process.env[WSL_HOSTS_GATE_STATE_ENV]).toBe(state) - }) - - // A relaunch or the updater's installer inherits the parent's value; main must recompute. - it.each([ - ['closed', '1', 'open', true], - ['open', undefined, 'closed', false] - ])( - 'ignores a stale inherited %s and overwrites it', - (inherited, gateEnv, recomputed, serving) => { - vi.stubEnv(WSL_HOSTS_GATE_STATE_ENV, inherited) - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', gateEnv) - ignoreInheritedWslHostsGateState() - expect(isWslHostsServing(process.env)).toBe(gateEnv === '1') - - configureWslHostsGate(facts(false, false)) - - expect(wslHostsGateState()).toBe(recomputed) - expect(process.env[WSL_HOSTS_GATE_STATE_ENV]).toBe(recomputed) - expect(wslHostsServing()).toBe(serving) - expect(isWslHostsServing(process.env)).toBe(serving) - } - ) - - // A blocked run's child inherits ORCA_INTERNAL_WSL_HOSTS=1; only the published state says closed. - it('lets a child that never configured the gate trust what main published', () => { - const gate = { ORCA_INTERNAL_WSL_HOSTS: '1' } - expect(isWslHostsServing({ ...gate, [WSL_HOSTS_GATE_STATE_ENV]: 'closed' })).toBe(false) - // Children of a serve-only run see no gate env at all, yet must still serve saved WSL work. - expect(isWslHostsServing({ [WSL_HOSTS_GATE_STATE_ENV]: 'serve-only' })).toBe(true) - }) - - // A child of an older Orca, or a garbled value, must keep today's env-only reading. - it('falls back to the internal gate env in a child when nothing valid was published', () => { - expect(isWslHostsServing({ ORCA_INTERNAL_WSL_HOSTS: '1' })).toBe(true) - // With the gate env on, a garbled value must not read as 'closed'. - expect( - isWslHostsServing({ ORCA_INTERNAL_WSL_HOSTS: '1', [WSL_HOSTS_GATE_STATE_ENV]: 'bogus' }) - ).toBe(true) - }) - - it('withdraws it on reset', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate(facts(false, false)) - resetWslHostsGateForTests() - - expect(process.env[WSL_HOSTS_GATE_STATE_ENV]).toBeUndefined() - }) - }) - - describe('moved projects under a block', () => { - it('asks for moved projects back only when the block says so', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate({ - ...facts(true, true), - policy: () => 'block', - movedProjects: () => 'bring-back' - }) - - expect(wslHostsBringBackMovedProjects()).toBe(true) - expect(wslHostsAppliedMovedProjects()).toBe('bring-back') - expect(wslHostsGateState()).toBe('serve-only') - }) - - it('never reads it without a block', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - const movedProjects = vi.fn(() => 'bring-back' as const) - configureWslHostsGate({ ...facts(true, true), policy: () => 'allow', movedProjects }) - - expect(movedProjects).not.toHaveBeenCalled() - expect(wslHostsBringBackMovedProjects()).toBe(false) - expect(wslHostsAppliedMovedProjects()).toBeNull() - }) - - it('keeps moved projects served when the choice cannot be read', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate({ - ...facts(true, true), - policy: () => 'block', - movedProjects: () => { - throw new Error('unreadable') - } - }) - - expect(wslHostsBringBackMovedProjects()).toBe(false) - expect(wslHostsAppliedMovedProjects()).toBe('keep') - }) - - it('clears on reset', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate({ - ...facts(true, true), - policy: () => 'block', - movedProjects: () => 'bring-back' - }) - resetWslHostsGateForTests() - - expect(wslHostsBringBackMovedProjects()).toBe(false) - }) - }) - - describe('a block learned mid-run', () => { - // New work stops at once, but what is served must not change until the next launch. - it('stops new work without closing the gate or stranding saved work', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate(facts(true, true)) - const changed = vi.fn() - onWslHostsNewWorkChanged(changed) - - noteWslHostsLivePolicyBlock() - noteWslHostsLivePolicyBlock() - - expect(wslHostsAcceptNewWork()).toBe(false) - expect(changed).toHaveBeenCalledOnce() - expect(wslHostsGateOpen()).toBe(true) - expect(wslHostsGateState()).toBe('open') - expect(wslHostsServing()).toBe(true) - expect(isGatedOffWslHost(wslHost)).toBe(false) - expect(wslHostsWindowArguments()).toEqual([]) - }) - - // Stage 1's opt-in (D1c Git routing, conversions, new-project Git default) ends with it. - it('ends the Stage 1 opt-in even with the setting on', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', '1') - configureWslHostsGate(facts(false, false)) - expect(wslHostsOptedIn({ experimentalWslHosts: true })).toBe(true) - - noteWslHostsLivePolicyBlock() - - expect(wslHostsOptedIn({ experimentalWslHosts: true })).toBe(false) - }) - - // Behind a gate that is already closed there is nothing new to stop, so nobody is told. - it('is a no-op behind a closed gate', () => { - vi.stubEnv('ORCA_INTERNAL_WSL_HOSTS', undefined) - configureWslHostsGate(facts(true, false)) - const changed = vi.fn() - onWslHostsNewWorkChanged(changed) - - noteWslHostsLivePolicyBlock() - - expect(changed).not.toHaveBeenCalled() - expect(wslHostsGateState()).toBe('serve-only') - }) - }) -}) diff --git a/tests/component-fixtures/tab-bar-width.spec.ts b/tests/component-fixtures/tab-bar-width.spec.ts index d9c9336439d..bf97cc171af 100644 --- a/tests/component-fixtures/tab-bar-width.spec.ts +++ b/tests/component-fixtures/tab-bar-width.spec.ts @@ -27,73 +27,6 @@ async function stripLayout(page: Page) { test.use({ viewport: { width: 1900, height: 720 } }) -test('content tabs use intrinsic widths and shrink to their minimum before overflowing', async ({ - page -}) => { - await openFixture(page, 'nonAgentTabs') - const strip = page.locator('.terminal-tab-strip') - const assertWidths = async () => { - for (const id of ['browser-0', 'file-0']) { - expect(await width(slot(page, id))).toBeCloseTo(144, 0) - } - for (const id of ['tab-1', 'browser-1', 'file-1']) { - expect(await width(slot(page, id))).toBeCloseTo(300, 0) - const label = slot(page, id).locator('.tab-label') - expect(await label.evaluate((node) => node.scrollWidth > node.clientWidth)).toBe(true) - expect(await label.evaluate((node) => getComputedStyle(node).textOverflow)).toBe('ellipsis') - } - } - await assertWidths() - expect(await strip.evaluate((node) => node.scrollWidth > node.clientWidth)).toBe(false) - - await page.locator('#component-fixture-frame').evaluate((node) => { - node.style.width = '1280px' - }) - for (const id of ['tab-0', 'tab-1', 'browser-1', 'file-1']) { - await expect.poll(() => width(slot(page, id))).toBeGreaterThan(180) - expect(await width(slot(page, id))).toBeLessThan(250) - } - expect(await strip.evaluate((node) => node.scrollWidth > node.clientWidth)).toBe(false) - - await page.locator('#component-fixture-frame').evaluate((node) => { - node.style.width = '420px' - }) - await expect(page.getByRole('button', { name: 'Scroll tabs right' })).toBeVisible() - for (const id of ['tab-0', 'browser-0', 'file-0', 'tab-1', 'browser-1', 'file-1']) { - expect(await width(slot(page, id))).toBeCloseTo(144, 0) - } - expect(await strip.evaluate((node) => node.scrollWidth > node.clientWidth)).toBe(true) - await test.info().attach('overflowing-content-tabs', { - body: await page.locator('#component-fixture-frame').screenshot(), - contentType: 'image/png' - }) -}) - -test('agent tabs keep their preferred width and share space down to their minimum', async ({ - page -}) => { - await openFixture(page, 'twoTabs') - expect(await width(slot(page, 'tab-0'))).toBeCloseTo(300, 0) - expect(await width(slot(page, 'tab-1'))).toBeCloseTo(300, 0) - await page.locator('#component-fixture-frame').evaluate((node) => { - node.style.width = '420px' - }) - await expect.poll(() => width(slot(page, 'tab-0'))).toBeLessThan(210) - expect(await width(slot(page, 'tab-0'))).toBeGreaterThanOrEqual(144) - expect(await width(slot(page, 'tab-0'))).toBeCloseTo(await width(slot(page, 'tab-1')), 0) - - await page.locator('#component-fixture-frame').evaluate((node) => { - node.style.width = '280px' - }) - await expect.poll(() => width(slot(page, 'tab-0'))).toBeCloseTo(144, 0) - expect(await width(slot(page, 'tab-1'))).toBeCloseTo(144, 0) - expect( - await page - .locator('.terminal-tab-strip') - .evaluate((node) => node.scrollWidth > node.clientWidth) - ).toBe(true) -}) - for (const fixture of ['nonAgentTabs', 'nonAgentTabsOverflowing']) { test(`renaming reserves usable input space and keeps typing stable in ${fixture}`, async ({ page @@ -128,25 +61,3 @@ for (const fixture of ['nonAgentTabs', 'nonAgentTabsOverflowing']) { } }) } - -test('long file tabs share available space before the strip overflows', async ({ page }) => { - await openFixture(page, 'constrainedFiles') - for (const id of ['file-0', 'file-1']) { - expect(await width(slot(page, id))).toBeGreaterThan(240) - expect(await width(slot(page, id))).toBeLessThan(270) - } - expect( - await page - .locator('.terminal-tab-strip') - .evaluate((node) => node.scrollWidth > node.clientWidth) - ).toBe(false) -}) - -test('terminal sizing stays stable as agent identity appears and disappears', async ({ page }) => { - await openFixture(page, 'agentIdentityChanges') - for (let index = 0; index < 3; index++) { - expect(await width(slot(page, 'tab-0'))).toBeCloseTo(300, 0) - expect(await width(slot(page, 'tab-1'))).toBeCloseTo(300, 0) - await page.getByRole('button', { name: 'Toggle agent identity' }).click() - } -}) diff --git a/tests/e2e/cross-version-wire/cross-version-pairing-ticket.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-pairing-ticket.unit.test.ts index 7be3c7833d0..abe951db5c2 100644 --- a/tests/e2e/cross-version-wire/cross-version-pairing-ticket.unit.test.ts +++ b/tests/e2e/cross-version-wire/cross-version-pairing-ticket.unit.test.ts @@ -1,12 +1,12 @@ import { mkdtempSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' -import { beforeAll, describe, expect, it, vi } from 'vitest' +import { beforeAll, describe, expect, it } from 'vitest' import { DeviceRegistry } from '../../../src/main/runtime/rpc/server/pairing/device-registry' import { usesOlderPairingMethod } from '../../../src/main/runtime/rpc/server/pairing/pairing-ticket-exchange' -import { PAIRING_TICKET_EXCHANGE_RUNTIME_CAPABILITY } from '../../../src/shared/remote-runtime/pairing/ticket-exchange-capability' -import { encodePairingOffer } from '../../../src/shared/remote-runtime/pairing/pairing' -import { exchangeRemotePairingTicket } from '../../../src/shared/remote-runtime/pairing/remote-pairing-ticket-exchange' +import '../../../src/shared/remote-runtime/pairing/ticket-exchange-capability' +import '../../../src/shared/remote-runtime/pairing/pairing' +import '../../../src/shared/remote-runtime/pairing/remote-pairing-ticket-exchange' import { importReleaseCheckoutModule, materializeReleaseCheckout, @@ -24,18 +24,15 @@ type ReleasedRegistryLike = { } let ReleasedRegistry: new (userDataPath: string) => ReleasedRegistryLike -let releasedCapabilities: readonly string[] beforeAll(async () => { const checkout = await materializeReleaseCheckout(resolveBaselineReleaseRef()) - const [registryModule, protocolModule] = await Promise.all([ - importReleaseCheckoutModule(checkout, 'src/main/runtime/rpc/server/pairing/device-registry.ts'), - importReleaseCheckoutModule(checkout, 'src/shared/protocol-version.ts') - ]) + const registryModule = await importReleaseCheckoutModule( + checkout, + 'src/main/runtime/rpc/server/pairing/device-registry.ts' + ) // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned release's DeviceRegistry class; a changed shape fails the assertions below. ReleasedRegistry = registryModule.DeviceRegistry as typeof ReleasedRegistry - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned release's capability list; a changed shape fails the assertions below. - releasedCapabilities = protocolModule.RUNTIME_CAPABILITIES as readonly string[] }, SUITE_TIMEOUT_MS) function pairedTicket(registry: DeviceRegistry, name: string) { @@ -45,30 +42,6 @@ function pairedTicket(registry: DeviceRegistry, name: string) { } describe('cross-version: single-use pairing tickets', () => { - it('a released host does not advertise the exchange, so updated clients keep the code', () => { - expect(releasedCapabilities).not.toContain(PAIRING_TICKET_EXCHANGE_RUNTIME_CAPABILITY) - }) - - it('Add server and the CLI save the link unchanged for a released host, without calling it', async () => { - const offer = { - v: 2 as const, - endpoint: 'ws://192.168.1.10:6768', - deviceToken: 'link-token', - publicKeyB64: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' - } - const pairingCode = encodePairingOffer(offer) - const send = vi.fn() - await expect( - exchangeRemotePairingTicket({ - pairingCode, - offer, - hostCapabilities: releasedCapabilities, - send - }) - ).resolves.toBe(pairingCode) - expect(send).not.toHaveBeenCalled() - }) - it('after a downgrade, exchanged phones keep their own token and older phones their code', () => { const userDataPath = mkdtempSync(join(tmpdir(), 'orca-xv-ticket-')) const current = new DeviceRegistry(userDataPath) diff --git a/tests/e2e/terminal-link-click-ownership.spec.ts b/tests/e2e/terminal-link-click-ownership.spec.ts index 7ebad18453d..c86146bfecb 100644 --- a/tests/e2e/terminal-link-click-ownership.spec.ts +++ b/tests/e2e/terminal-link-click-ownership.spec.ts @@ -208,20 +208,6 @@ test.describe('terminal link click ownership', () => { await sendToTerminal(orcaPage, ptyId, 'q') }) - test('an Orca-owned plain link click emits no child PTY mouse frames', async ({ - orcaPage - }, testInfo) => { - const { mouseLogPath, ptyId, target } = await startMouseAwareLinkFixture(orcaPage, testInfo) - await orcaPage.mouse.click(target.x, target.y) - - await expect(orcaPage.locator('[data-terminal-link-action-popover]')).toBeVisible() - await expect(orcaPage.locator('[data-terminal-link-destination]')).toHaveText(LINK) - - await expectOrcaOwnedMouseOutcome(mouseLogPath) - - await sendToTerminal(orcaPage, ptyId, 'q') - }) - test('an Orca-owned OSC link click emits no child PTY mouse frames', async ({ orcaPage }, testInfo) => { @@ -241,21 +227,6 @@ test.describe('terminal link click ownership', () => { await sendToTerminal(orcaPage, ptyId, 'q') }) - test('a plain click stays child-owned when link actions are disabled', async ({ - orcaPage - }, testInfo) => { - const { mouseLogPath, ptyId, target } = await startMouseAwareLinkFixture(orcaPage, testInfo) - await orcaPage.evaluate(async () => { - await window.__store?.getState().updateSettings({ terminalLinkActionPopoverEnabled: false }) - }) - - await orcaPage.mouse.click(target.x, target.y) - - await expect(orcaPage.locator('[data-terminal-link-action-popover]')).toHaveCount(0) - await expectChildMouseReports(mouseLogPath) - await sendToTerminal(orcaPage, ptyId, 'q') - }) - test('a drag across a link stays child-owned', async ({ orcaPage }, testInfo) => { const { mouseLogPath, ptyId, target } = await startMouseAwareLinkFixture(orcaPage, testInfo) diff --git a/tests/e2e/terminal-pane-title-editing.spec.ts b/tests/e2e/terminal-pane-title-editing.spec.ts index c7179adc356..a74284aefc2 100644 --- a/tests/e2e/terminal-pane-title-editing.spec.ts +++ b/tests/e2e/terminal-pane-title-editing.spec.ts @@ -7,10 +7,7 @@ import { setPaneTitleFromTerminalMenu, openTerminalContextMenu } from './helpers/terminal-pane-title-actions' -import { - readVisibleXtermContainerBox, - expectTerminalToReserveTitleSpace -} from './helpers/terminal-pane-geometry' +import './helpers/terminal-pane-geometry' import { registerTerminalPaneMountReadiness } from './helpers/terminal-pane-mount-readiness' async function openPaneTitleContextMenu(page: Page, title: string): Promise { @@ -103,42 +100,6 @@ test.describe('Terminal Panes', () => { await expect(orcaPage.locator('.pane-title-text', { hasText: title })).toHaveCount(1) }) - test('Set Title editor renders in Orca overlay while terminal reserves title space', async ({ - orcaPage - }) => { - const title = `Reserved overlay title ${Date.now()}` - const terminalBoxBefore = await readVisibleXtermContainerBox(orcaPage) - - await openTerminalContextMenu(orcaPage) - await orcaPage.getByText('Set Title…', { exact: true }).click() - - const titleInput = orcaPage.locator('.pane-title-overlay-layer .pane-title-input').first() - await expect(titleInput).toBeVisible() - await expect(titleInput).toBeFocused() - await expect(orcaPage.getByText('Set Title…', { exact: true })).toBeHidden() - await expect(orcaPage.locator('.pane .pane-title-input')).toHaveCount(0) - await expect(orcaPage.locator('.pane[data-has-title]')).toHaveCount(1) - await expect - .poll(() => - orcaPage - .locator('.pane-title-bar') - .first() - .evaluate((titleBar) => getComputedStyle(titleBar).backgroundColor) - ) - .not.toBe('rgba(0, 0, 0, 0)') - const terminalBoxEditing = await readVisibleXtermContainerBox(orcaPage) - expectTerminalToReserveTitleSpace(terminalBoxEditing, terminalBoxBefore) - - await titleInput.fill(title) - await titleInput.press('Enter') - await expect(orcaPage.locator('.pane-title-text', { hasText: title })).toBeVisible() - await expect(orcaPage.locator('.pane[data-has-title]')).toHaveCount(1) - expectTerminalToReserveTitleSpace( - await readVisibleXtermContainerBox(orcaPage), - terminalBoxBefore - ) - }) - test('Set Title context menu opens from the title overlay strip', async ({ orcaPage }) => { const title = `Overlay menu title ${Date.now()}` const updatedTitle = `Overlay menu updated ${Date.now()}` diff --git a/tests/e2e/terminal-pane-title-strip-placement.spec.ts b/tests/e2e/terminal-pane-title-strip-placement.spec.ts index 406f4ca2ceb..e28d47248ec 100644 --- a/tests/e2e/terminal-pane-title-strip-placement.spec.ts +++ b/tests/e2e/terminal-pane-title-strip-placement.spec.ts @@ -1,7 +1,6 @@ import type { Page } from '@stablyai/playwright-test' import { test, expect } from './helpers/orca-app' import { - moveTerminalPaneByLeafId, readPaneIdentitySnapshot, readTerminalPaneDomLeafOrder, splitActiveTerminalPane, @@ -133,92 +132,6 @@ test.describe('Terminal Panes', () => { .toEqual({ activeLeafId: otherPane.leafId, targetHasPath: true, otherHasPath: false }) }) - test('Set Title overlay follows its pane after same-count pane move', async ({ orcaPage }) => { - const title = `Moved overlay title ${Date.now()}` - - await setPaneTitleFromTerminalMenu(orcaPage, title) - const initialSnapshot = await waitForPaneIdentitySnapshot(orcaPage, 1) - const titledLeafId = initialSnapshot.activeLeafId ?? initialSnapshot.panes[0]?.leafId - if (!titledLeafId) { - throw new Error('No titled pane leaf id found before move') - } - - await splitActiveTerminalPane(orcaPage, 'vertical') - await waitForPaneCount(orcaPage, 2) - const beforeMove = await waitForPaneIdentitySnapshot(orcaPage, 2) - const target = beforeMove.panes.find((pane) => pane.leafId !== titledLeafId) - if (!target) { - throw new Error('No target pane found for titled pane move') - } - const beforeOrder = await readTerminalPaneDomLeafOrder(orcaPage) - - await expectPaneTitleAttachedToLeaf(orcaPage, title, titledLeafId) - await moveTerminalPaneByLeafId(orcaPage, titledLeafId, target.leafId, 'right') - - await expect - .poll(async () => readTerminalPaneDomLeafOrder(orcaPage), { - timeout: 10_000, - message: 'Pane move did not update DOM order' - }) - .not.toEqual(beforeOrder) - await expectPaneTitleAttachedToLeaf(orcaPage, title, titledLeafId) - }) - - test('Set Title keeps the pane drag handle available over the title strip', async ({ - orcaPage - }) => { - const title = `Draggable title ${Date.now()}` - - await setPaneTitleFromTerminalMenu(orcaPage, title) - const initialSnapshot = await waitForPaneIdentitySnapshot(orcaPage, 1) - const titledLeafId = initialSnapshot.activeLeafId ?? initialSnapshot.panes[0]?.leafId - if (!titledLeafId) { - throw new Error('No titled pane leaf id found before split') - } - - await splitActiveTerminalPane(orcaPage, 'vertical') - await waitForPaneCount(orcaPage, 2) - await expectPaneTitleAttachedToLeaf(orcaPage, title, titledLeafId) - - const titleTopHit = await orcaPage.evaluate( - ({ title, titledLeafId }) => { - const titleBar = Array.from(document.querySelectorAll('.pane-title-bar')).find( - (element) => element.textContent?.includes(title) - ) - const titleDragHandle = - titleBar?.querySelector('.pane-title-drag-handle') ?? null - const pane = document.querySelector(`.pane[data-leaf-id="${titledLeafId}"]`) - if (!titleBar || !pane || !titleDragHandle) { - return null - } - const titleRect = titleBar.getBoundingClientRect() - const hitElement = document.elementFromPoint( - titleRect.left + titleRect.width / 2, - titleRect.top + 4 - ) - return { - hitDragHandle: - hitElement instanceof HTMLElement && - hitElement.closest('.pane-title-drag-handle') !== null, - pointerEvents: getComputedStyle(titleDragHandle).pointerEvents, - titleTop: titleRect.top, - handleTop: titleDragHandle.getBoundingClientRect().top - } - }, - { title, titledLeafId } - ) - - expect(titleTopHit).not.toBeNull() - expect(titleTopHit?.hitDragHandle).toBe(true) - expect(titleTopHit?.pointerEvents).toBe('auto') - expect(Math.abs((titleTopHit?.handleTop ?? 0) - (titleTopHit?.titleTop ?? 0))).toBeLessThan(1) - - await orcaPage.locator('.pane-title-bar', { hasText: title }).click({ - position: { x: 20, y: 18 } - }) - await expect(orcaPage.locator('.pane-title-input')).toBeVisible() - }) - test('@headful Set Title pane can be dragged from the title strip', async ({ orcaPage }) => { const title = `Dragged title ${Date.now()}` diff --git a/tests/e2e/worktree-lineage.spec.ts b/tests/e2e/worktree-lineage.spec.ts index 159ae71cd47..913bfbf077c 100644 --- a/tests/e2e/worktree-lineage.spec.ts +++ b/tests/e2e/worktree-lineage.spec.ts @@ -1,40 +1,17 @@ -import type { Locator, Page } from '@stablyai/playwright-test' -import { mkdirSync } from 'node:fs' -import { resolve } from 'node:path' +import type { Page } from '@stablyai/playwright-test' +import 'node:fs' +import 'node:path' import { test, expect } from './helpers/orca-app' -import { addRepoWithWorkspaces, linkWorkspaces } from './helpers/repo-with-workspaces' -import { SIDEBAR_INPUTS_BUILD } from './helpers/sidebar-inputs-build' +import './helpers/repo-with-workspaces' +import './helpers/sidebar-inputs-build' import { waitForActiveWorktree, waitForSessionReady } from './helpers/store' -import { - markWorkspaceTerminalSlept, - seedLineageScenario, - seedWorkspaceAgentStatus, - seedWorkspaceLiveTerminal -} from './worktree-lineage-state' +import { seedLineageScenario } from './worktree-lineage-state' import { worktreeRow } from './worktree-row-locators' function worktreeOption(page: Page, worktreeId: string) { return worktreeRow(page, worktreeId) } -async function captureEvidence(page: Page, name: string, locator?: Locator): Promise { - if (process.env.ORCA_CAPTURE_EVIDENCE !== '1') { - return - } - const outputDir = resolve(process.cwd(), 'pr-evidence') - mkdirSync(outputDir, { recursive: true }) - const path = resolve(outputDir, name) - if (locator) { - await locator.screenshot({ path }) - return - } - await page.screenshot({ path }) -} - -async function captureSidebarEvidence(page: Page, name: string): Promise { - await captureEvidence(page, name, page.locator('[data-worktree-sidebar]').first()) -} - test.describe('Worktree Lineage', () => { test.describe.configure({ mode: 'serial' }) @@ -107,35 +84,6 @@ test.describe('Worktree Lineage', () => { await expect(childRow).toBeVisible() }) - test('renders legacy-only inline lineage when side-map hydration is absent', async ({ - orcaPage - }) => { - test.skip( - SIDEBAR_INPUTS_BUILD, - "the window's legacy inline link is unused when rows come from main" - ) - const { parentId, childId } = await seedLineageScenario(orcaPage, { inlineOnly: true }) - const parentRow = worktreeOption(orcaPage, parentId) - const childRow = worktreeOption(orcaPage, childId) - - await expect(parentRow.getByRole('button', { name: 'Hide 1 child workspace' })).toBeVisible() - await expect(childRow).toBeVisible() - await expect - .poll(async () => { - const [parentBox, childBox] = await Promise.all([ - parentRow.boundingBox(), - childRow.boundingBox() - ]) - return parentBox && childBox ? childBox.y > parentBox.y : false - }) - .toBe(true) - // The link must come from the records alone, not a side map hydrated after the seed. - expect( - await orcaPage.evaluate((id) => window.__store!.getState().worktreeLineageById[id], childId) - ).toBeUndefined() - await captureSidebarEvidence(orcaPage, 'legacy-inline-lineage-nested.png') - }) - test('injects filtered parents structurally without showing a parent badge', async ({ orcaPage }) => { @@ -199,101 +147,4 @@ test.describe('Worktree Lineage', () => { expect(positions).not.toBeNull() expect(positions!.childTop).toBeGreaterThan(positions!.parentTop) }) - - test('updates nested child preview status when the child terminal sleeps', async ({ - orcaPage - }) => { - const { parentId, childId } = await seedLineageScenario(orcaPage) - const parentRow = worktreeOption(orcaPage, parentId) - const childRow = worktreeOption(orcaPage, childId) - - await expect(parentRow).toBeVisible() - await expect(childRow).toBeVisible() - - const childTabId = await seedWorkspaceLiveTerminal(orcaPage, childId) - await expect(childRow).toContainText('Active') - - await markWorkspaceTerminalSlept(orcaPage, { worktreeId: childId, tabId: childTabId }) - await expect(childRow).toContainText('Inactive') - }) - - test('sleeps a workspace and every descendant from the parent context menu', async ({ - orcaPage - }, testInfo) => { - // A repo's own checkout offers no delete, so the parent is one of its worktrees. - const repo = await addRepoWithWorkspaces(orcaPage, testInfo, 2) - const [parentId, childId] = [repo.ids[0]!, repo.ids[1]!] - await linkWorkspaces(orcaPage, [{ childId, parentId }]) - await orcaPage.evaluate(() => window.__store!.getState().setShowSleepingWorkspaces(true)) - const parentTabId = await seedWorkspaceLiveTerminal(orcaPage, parentId) - const childTabId = await seedWorkspaceLiveTerminal(orcaPage, childId) - - await orcaPage.evaluate(() => { - const store = window.__store - if (!store) { - throw new Error('window.__store is not available') - } - store.setState({ - shutdownWorktreeBrowsers: async (worktreeId: string) => { - store.setState((current) => ({ - browserTabsByWorktree: { ...current.browserTabsByWorktree, [worktreeId]: [] } - })) - }, - shutdownWorktreeTerminals: async (worktreeId: string) => { - const tabIds = (store.getState().tabsByWorktree[worktreeId] ?? []).map((tab) => tab.id) - store.setState((current) => ({ - ptyIdsByTabId: { - ...current.ptyIdsByTabId, - ...Object.fromEntries(tabIds.map((tabId) => [tabId, []])) - } - })) - } - }) - }) - - await worktreeOption(orcaPage, parentId).click({ button: 'right' }) - const sleepSubtree = orcaPage.getByRole('menuitem', { - name: 'Sleep with Descendants (1)' - }) - await expect(sleepSubtree).toBeVisible() - await expect(sleepSubtree).toBeEnabled() - await expect(orcaPage.getByRole('menuitem', { name: 'Delete with Descendants…' })).toBeVisible() - await captureEvidence(orcaPage, 'workspace-descendant-actions.png') - await sleepSubtree.click() - - await expect - .poll(() => - orcaPage.evaluate( - ({ parentTabId, childTabId }) => { - const state = window.__store?.getState() - return { - parentPtys: state?.ptyIdsByTabId[parentTabId], - childPtys: state?.ptyIdsByTabId[childTabId] - } - }, - { parentTabId, childTabId } - ) - ) - .toEqual({ parentPtys: [], childPtys: [] }) - }) - - test('shows parent and child agent rows while the parent workspace is active', async ({ - orcaPage - }) => { - const { parentId, childId } = await seedLineageScenario(orcaPage) - const parentRow = worktreeOption(orcaPage, parentId) - const childRow = worktreeOption(orcaPage, childId) - - await parentRow.click() - await expect(parentRow).toHaveAttribute('aria-current', 'page') - await expect(childRow).toBeVisible() - - const parentAgentPrompt = await seedWorkspaceAgentStatus(orcaPage, parentId, 'PARENT') - const childAgentPrompt = await seedWorkspaceAgentStatus(orcaPage, childId, 'CHILD') - - await expect( - parentRow.getByRole('treeitem').filter({ hasText: parentAgentPrompt }) - ).toBeVisible() - await expect(childRow.getByRole('treeitem').filter({ hasText: childAgentPrompt })).toBeVisible() - }) })