test(vm): harden rollback compatibility coverage

config/reliability-gates.jsonc

@@ -42,6 +42,11 @@
         "src/shared/ephemeral-vm-runtime-store-rollback.test.ts",
         "src/shared/ephemeral-vm-runtime-store.test.ts",
         "src/main/ephemeral-vm-runtime-service.test.ts",
+        "src/main/ephemeral-vm-recipe-runner.test.ts",
+        "src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts",
+        "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts",
+        "src/main/ipc/ephemeral-vm.test.ts",
+        "src/main/provisioned-root-ssh-adoption.test.ts",
         "tests/e2e/ephemeral-vm-provisioned-root.spec.ts"
       ],
       "assertionRefs": [

config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts

@@ -1,12 +1,24 @@
-import { existsSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { expect, test } from 'vitest'
+import { afterAll, expect, test } from 'vitest'
 
 const targetRoot = process.env.STA_4274_TARGET_ROOT
 const operation = process.env.STA_4274_OPERATION
-const userDataPath = process.env.STA_4274_USER_DATA_PATH ?? mkdtempSync(join(tmpdir(), 'sta-4274-'))
+const ownedDirs: string[] = []
+
+function makeOwnedDir(prefix: string): string {
+  const dir = mkdtempSync(join(tmpdir(), prefix))
+  ownedDirs.push(dir)
+  return dir
+}
+
+afterAll(() => {
+  for (const dir of ownedDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
 
 const ordinary = {
   id: 'ordinary-runtime',
@@ -72,6 +84,7 @@ test.skipIf(!targetRoot || !operation)(`STA-4274 ${operation ?? 'disabled'}`, as
   if (!targetRoot || !operation) {
     throw new Error('STA_4274_TARGET_ROOT and STA_4274_OPERATION are required')
   }
+  const userDataPath = process.env.STA_4274_USER_DATA_PATH ?? makeOwnedDir('sta-4274-')
   const moduleUrl = pathToFileURL(
     resolve(targetRoot, 'src/shared/ephemeral-vm-runtime-store.ts')
   ).href
@@ -106,7 +119,7 @@ test.skipIf(!targetRoot || !operation)(`STA-4274 ${operation ?? 'disabled'}`, as
       status: 'suspended',
       updatedAt: 3_000
     })
-    const repoPath = mkdtempSync(join(tmpdir(), 'sta-4274-cleanup-'))
+    const repoPath = makeOwnedDir('sta-4274-cleanup-')
     const cleanupPath = join(repoPath, 'cleanup.js')
     const proofPath = join(repoPath, 'cleanup-proof')
     writeFileSync(

src/shared/ephemeral-vm-runtime-store-rollback.test.ts

@@ -5,11 +5,12 @@ import {
   rmSync,
   statSync,
   truncateSync,
+  utimesSync,
   writeFileSync
 } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import {
   getEphemeralVmRuntimeFeatureStorePath,
   MAX_EPHEMERAL_VM_RUNTIME_FEATURE_STORE_FILE_BYTES
@@ -94,16 +95,8 @@ function provisionedRootRecord(): EphemeralVmRuntimeRecord {
 
 describe('ephemeral VM runtime store rollback projection', () => {
   const tempDirs: string[] = []
-  const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
-
-  beforeEach(() => {
-    Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
-  })
 
   afterEach(() => {
-    if (originalPlatform) {
-      Object.defineProperty(process, 'platform', originalPlatform)
-    }
     for (const dir of tempDirs.splice(0)) {
       rmSync(dir, { recursive: true, force: true })
     }
@@ -170,11 +163,15 @@ describe('ephemeral VM runtime store rollback projection', () => {
     upsertEphemeralVmRuntime(userDataPath, older)
     upsertEphemeralVmRuntime(userDataPath, newer)
     const featurePath = getEphemeralVmRuntimeFeatureStorePath(userDataPath)
-    const inode = statSync(featurePath).ino
+    const oldTimestamp = new Date('2020-01-01T00:00:00.000Z')
+    utimesSync(featurePath, oldTimestamp, oldTimestamp)
+    const beforeBytes = readFileSync(featurePath, 'utf8')
+    const beforeMtime = statSync(featurePath).mtimeMs
 
     updateEphemeralVmRuntimeStatus(userDataPath, newer.id, { status: 'suspended' })
 
-    expect(statSync(featurePath).ino).toBe(inode)
+    expect(readFileSync(featurePath, 'utf8')).toBe(beforeBytes)
+    expect(statSync(featurePath).mtimeMs).toBe(beforeMtime)
   })
 
   it('migrates current-main poisoned bytes when they are first read', () => {